75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
Size

508KB
MD5

4021b2581e5521699afcd8d29dfb12b0
SHA1

3cb26d621250ec7a6115ca1d6a037d0166e7cb2b
SHA256

75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493
SHA512

b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc
SSDEEP

12288:FpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqss:FpUNr6YkVRFkgbeqeo68Fhq

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wfklv.exe

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfklv.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxlivsjwpbfmrbwzk.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "urkzxljbpjwbjpawamy.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "tndpkvqfqhrtybjc.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkzxljbpjwbjpawamy.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "urkzxljbpjwbjpawamy.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmzvhdtfxilrveya.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "jfxlivsjwpbfmrbwzk.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ufmpbdp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\thrxmrgpuf = "wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wfklv.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe

Executes dropped EXE 3 IoCs

pid	Process
2024	iffdguquspp.exe
876	wfklv.exe
1504	wfklv.exe

Loads dropped DLL 6 IoCs

pid	Process
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
2024	iffdguquspp.exe
2024	iffdguquspp.exe
2024	iffdguquspp.exe
2024	iffdguquspp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkzxljbpjwbjpawamy.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "urkzxljbpjwbjpawamy.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "wvqhhxxrhdszjreciwkje.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmzvhdtfxilrveya.exe"	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "jfxlivsjwpbfmrbwzk.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmzvhdtfxilrveya.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxlivsjwpbfmrbwzk.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmzvhdtfxilrveya.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "hfzpodcvkftzipbydqdb.exe ."	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkzxljbpjwbjpawamy.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "jfxlivsjwpbfmrbwzk.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe ."	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "jfxlivsjwpbfmrbwzk.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "urkzxljbpjwbjpawamy.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "wvqhhxxrhdszjreciwkje.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "urkzxljbpjwbjpawamy.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "tndpkvqfqhrtybjc.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmzvhdtfxilrveya.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "wvqhhxxrhdszjreciwkje.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "avmzvhdtfxilrveya.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "wvqhhxxrhdszjreciwkje.exe"	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "jfxlivsjwpbfmrbwzk.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndpkvqfqhrtybjc.exe ."	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "hfzpodcvkftzipbydqdb.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxlivsjwpbfmrbwzk.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzpodcvkftzipbydqdb.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "urkzxljbpjwbjpawamy.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "avmzvhdtfxilrveya.exe ."	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqhhxxrhdszjreciwkje.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkzxljbpjwbjpawamy.exe ."	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	wfklv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbnvmtkvcpvt = "avmzvhdtfxilrveya.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\kboxpxpbjxedf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqhhxxrhdszjreciwkje.exe ."	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "urkzxljbpjwbjpawamy.exe"	wfklv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkzxljbpjwbjpawamy.exe"	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "wvqhhxxrhdszjreciwkje.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\anwbpthpt = "jfxlivsjwpbfmrbwzk.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jvdhuxkr = "hfzpodcvkftzipbydqdb.exe"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	wfklv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ldrbudwjshppst = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxlivsjwpbfmrbwzk.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\odovlrhrxjo = "hfzpodcvkftzipbydqdb.exe"	wfklv.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wfklv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wfklv.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	whatismyip.everdot.org
8	www.showmyipaddress.com
10	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tndpkvqfqhrtybjc.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\jfxlivsjwpbfmrbwzk.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\hfzpodcvkftzipbydqdb.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\wvqhhxxrhdszjreciwkje.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\nnjbctupgdtbmvjipettph.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\jfxlivsjwpbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\hfzpodcvkftzipbydqdb.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\jfxlivsjwpbfmrbwzk.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\hfzpodcvkftzipbydqdb.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\wvqhhxxrhdszjreciwkje.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\nnjbctupgdtbmvjipettph.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\nnjbctupgdtbmvjipettph.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\tndpkvqfqhrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe
File created	C:\Windows\SysWOW64\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe
File created	C:\Windows\SysWOW64\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\urkzxljbpjwbjpawamy.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\wvqhhxxrhdszjreciwkje.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\tndpkvqfqhrtybjc.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\avmzvhdtfxilrveya.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\urkzxljbpjwbjpawamy.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\avmzvhdtfxilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\urkzxljbpjwbjpawamy.exe	wfklv.exe
File opened for modification	C:\Windows\SysWOW64\avmzvhdtfxilrveya.exe	wfklv.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File created	C:\Program Files (x86)\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File opened for modification	C:\Program Files (x86)\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe
File created	C:\Program Files (x86)\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe
File opened for modification	C:\Windows\tndpkvqfqhrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\urkzxljbpjwbjpawamy.exe	iffdguquspp.exe
File opened for modification	C:\Windows\jfxlivsjwpbfmrbwzk.exe	wfklv.exe
File opened for modification	C:\Windows\urkzxljbpjwbjpawamy.exe	wfklv.exe
File opened for modification	C:\Windows\nnjbctupgdtbmvjipettph.exe	wfklv.exe
File opened for modification	C:\Windows\ohwhblftdtcdhjqiiqyrgrlvpdndmnrtassai.qbv	wfklv.exe
File opened for modification	C:\Windows\nnjbctupgdtbmvjipettph.exe	iffdguquspp.exe
File opened for modification	C:\Windows\tndpkvqfqhrtybjc.exe	wfklv.exe
File opened for modification	C:\Windows\nnjbctupgdtbmvjipettph.exe	wfklv.exe
File created	C:\Windows\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File opened for modification	C:\Windows\nvzzihqtsxvlevrynkhpttcbkn.rpf	wfklv.exe
File opened for modification	C:\Windows\avmzvhdtfxilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\hfzpodcvkftzipbydqdb.exe	iffdguquspp.exe
File opened for modification	C:\Windows\tndpkvqfqhrtybjc.exe	wfklv.exe
File opened for modification	C:\Windows\avmzvhdtfxilrveya.exe	wfklv.exe
File opened for modification	C:\Windows\urkzxljbpjwbjpawamy.exe	wfklv.exe
File opened for modification	C:\Windows\wvqhhxxrhdszjreciwkje.exe	wfklv.exe
File opened for modification	C:\Windows\wvqhhxxrhdszjreciwkje.exe	wfklv.exe
File opened for modification	C:\Windows\jfxlivsjwpbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\wvqhhxxrhdszjreciwkje.exe	iffdguquspp.exe
File opened for modification	C:\Windows\avmzvhdtfxilrveya.exe	wfklv.exe
File opened for modification	C:\Windows\hfzpodcvkftzipbydqdb.exe	wfklv.exe
File opened for modification	C:\Windows\jfxlivsjwpbfmrbwzk.exe	wfklv.exe
File opened for modification	C:\Windows\hfzpodcvkftzipbydqdb.exe	wfklv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
1504	wfklv.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
1504	wfklv.exe
1504	wfklv.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	wfklv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2024	992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	27
PID 992 wrote to memory of 2024	992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	27
PID 992 wrote to memory of 2024	992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	27
PID 992 wrote to memory of 2024	992	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	27
PID 2024 wrote to memory of 876	2024	iffdguquspp.exe	28
PID 2024 wrote to memory of 876	2024	iffdguquspp.exe	28
PID 2024 wrote to memory of 876	2024	iffdguquspp.exe	28
PID 2024 wrote to memory of 876	2024	iffdguquspp.exe	28
PID 2024 wrote to memory of 1504	2024	iffdguquspp.exe	29
PID 2024 wrote to memory of 1504	2024	iffdguquspp.exe	29
PID 2024 wrote to memory of 1504	2024	iffdguquspp.exe	29
PID 2024 wrote to memory of 1504	2024	iffdguquspp.exe	29

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wfklv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wfklv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wfklv.exe

C:\Users\Admin\AppData\Local\Temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
"C:\Users\Admin\AppData\Local\Temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe
  "C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\wfklv.exe
    "C:\Users\Admin\AppData\Local\Temp\wfklv.exe" "-C:\Users\Admin\AppData\Local\Temp\tndpkvqfqhrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\wfklv.exe
    "C:\Users\Admin\AppData\Local\Temp\wfklv.exe" "-C:\Users\Admin\AppData\Local\Temp\tndpkvqfqhrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\avmzvhdtfxilrveya.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfzpodcvkftzipbydqdb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
32164a94403b25235acbf981adf75517

SHA1
b8c59fda85f962342fd46738d26694a2244a595d

SHA256
19de3cb3d302b0a9bb8606efbd8984030624206fb25fbda2bc39e1d7a116d4e2

SHA512
e85ef766c198c8cf992a1be40280cbfbd8f1272f4f1c6631e3c6cec63c6af896c8ad5667e703a8b66188a9ea4e59f14bb1425d7cd83141daebb6df9bbcd64c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
32164a94403b25235acbf981adf75517

SHA1
b8c59fda85f962342fd46738d26694a2244a595d

SHA256
19de3cb3d302b0a9bb8606efbd8984030624206fb25fbda2bc39e1d7a116d4e2

SHA512
e85ef766c198c8cf992a1be40280cbfbd8f1272f4f1c6631e3c6cec63c6af896c8ad5667e703a8b66188a9ea4e59f14bb1425d7cd83141daebb6df9bbcd64c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfxlivsjwpbfmrbwzk.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nnjbctupgdtbmvjipettph.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tndpkvqfqhrtybjc.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\urkzxljbpjwbjpawamy.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wvqhhxxrhdszjreciwkje.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\avmzvhdtfxilrveya.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\hfzpodcvkftzipbydqdb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\jfxlivsjwpbfmrbwzk.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\nnjbctupgdtbmvjipettph.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\tndpkvqfqhrtybjc.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\urkzxljbpjwbjpawamy.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\wvqhhxxrhdszjreciwkje.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\avmzvhdtfxilrveya.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\avmzvhdtfxilrveya.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\hfzpodcvkftzipbydqdb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\hfzpodcvkftzipbydqdb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\jfxlivsjwpbfmrbwzk.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\jfxlivsjwpbfmrbwzk.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\nnjbctupgdtbmvjipettph.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\nnjbctupgdtbmvjipettph.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\tndpkvqfqhrtybjc.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\urkzxljbpjwbjpawamy.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\urkzxljbpjwbjpawamy.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\wvqhhxxrhdszjreciwkje.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\wvqhhxxrhdszjreciwkje.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
32164a94403b25235acbf981adf75517

SHA1
b8c59fda85f962342fd46738d26694a2244a595d

SHA256
19de3cb3d302b0a9bb8606efbd8984030624206fb25fbda2bc39e1d7a116d4e2

SHA512
e85ef766c198c8cf992a1be40280cbfbd8f1272f4f1c6631e3c6cec63c6af896c8ad5667e703a8b66188a9ea4e59f14bb1425d7cd83141daebb6df9bbcd64c9f

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
32164a94403b25235acbf981adf75517

SHA1
b8c59fda85f962342fd46738d26694a2244a595d

SHA256
19de3cb3d302b0a9bb8606efbd8984030624206fb25fbda2bc39e1d7a116d4e2

SHA512
e85ef766c198c8cf992a1be40280cbfbd8f1272f4f1c6631e3c6cec63c6af896c8ad5667e703a8b66188a9ea4e59f14bb1425d7cd83141daebb6df9bbcd64c9f

Download Submit
\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
\Users\Admin\AppData\Local\Temp\wfklv.exe

Filesize
700KB

MD5
65835eb7f9f28a0ceb14a9f16499ccb5

SHA1
8c78dc6e8dd5cb9700af02124491bfa13d15c1f7

SHA256
8b3c5991b0ebf7c8fe13acb92bf8507db50dd0e417b60805b4f868ebe871282c

SHA512
77da88d565d21971b6464a754759b9ca2e2aaf6644d0c09ad75a6670fc4fe38edb3e1c7309772c56b68a96a4db73b32fc3762bc59c4413c0f4ea3eb23f4c4af4

Download Submit
memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download