f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

Analysis

max time kernel
152s
max time network
188s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
Size

584KB
MD5

8057321335b8890a9f6b3332bbc50774
SHA1

0421b8808a74d3ef33e38177a3f7710d320c4546
SHA256

f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2
SHA512

bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8
SSDEEP

12288:7pUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsAv:7pUNr6YkVRFkgbeqeo68Fhq

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	cimnq.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cimnq.exe

Adds policy Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ixiyjejjshs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pizndusirnfcuwiprk.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "zqfrfuqelfvqggqv.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "gyobqgdsavmizalrs.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyobqgdsavmizalrs.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "nibrjccufdxwquirvqjz.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "pizndusirnfcuwiprk.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tybb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "aumbskjakhayruhpsme.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "zqfrfuqelfvqggqv.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiorwcp = "aumbskjakhayruhpsme.exe"	cimnq.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ixiyjejjshs.exe

Executes dropped EXE 3 IoCs

pid	Process
1508	ixiyjejjshs.exe
836	cimnq.exe
1392	cimnq.exe

Loads dropped DLL 6 IoCs

pid	Process
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1508	ixiyjejjshs.exe
1508	ixiyjejjshs.exe
1508	ixiyjejjshs.exe
1508	ixiyjejjshs.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "gyobqgdsavmizalrs.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyfjpwkq = "pizndusirnfcuwiprk.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyfjpwkq = "zqfrfuqelfvqggqv.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "aumbskjakhayruhpsme.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe"	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyfjpwkq = "cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "zqfrfuqelfvqggqv.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "gyobqgdsavmizalrs.exe ."	ixiyjejjshs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aumbskjakhayruhpsme.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "aumbskjakhayruhpsme.exe ."	cimnq.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ixiyjejjshs.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "aumbskjakhayruhpsme.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "gyobqgdsavmizalrs.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pizndusirnfcuwiprk.exe"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyobqgdsavmizalrs.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyfjpwkq = "gyobqgdsavmizalrs.exe"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cimnq.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "gyobqgdsavmizalrs.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "pizndusirnfcuwiprk.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pizndusirnfcuwiprk.exe"	ixiyjejjshs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqfrfuqelfvqggqv.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "nibrjccufdxwquirvqjz.exe"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyfjpwkq = "gyobqgdsavmizalrs.exe"	cimnq.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyobqgdsavmizalrs.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "cysjcwxqcbwwrwlvawqha.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pizndusirnfcuwiprk.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyobqgdsavmizalrs.exe ."	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugqxgqhqshs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "pizndusirnfcuwiprk.exe ."	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cimnq = "aumbskjakhayruhpsme.exe"	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "cysjcwxqcbwwrwlvawqha.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "nibrjccufdxwquirvqjz.exe ."	ixiyjejjshs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyobqgdsavmizalrs.exe ."	ixiyjejjshs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aumbskjakhayruhpsme.exe"	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cimnq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cysjcwxqcbwwrwlvawqha.exe"	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aumbskjakhayruhpsme.exe ."	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ixiyjejjshs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nuzbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "aumbskjakhayruhpsme.exe ."	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ixiyjejjshs.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cimnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zktzhqgopd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibrjccufdxwquirvqjz.exe ."	cimnq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqydkshoo = "gyobqgdsavmizalrs.exe ."	cimnq.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ixiyjejjshs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cimnq.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	whatismyipaddress.com
12	whatismyip.everdot.org
13	www.showmyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cysjcwxqcbwwrwlvawqha.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\gyobqgdsavmizalrs.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\aumbskjakhayruhpsme.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe
File created	C:\Windows\SysWOW64\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\gyobqgdsavmizalrs.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\gyobqgdsavmizalrs.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\cysjcwxqcbwwrwlvawqha.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\pizndusirnfcuwiprk.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\cysjcwxqcbwwrwlvawqha.exe	cimnq.exe
File created	C:\Windows\SysWOW64\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\aumbskjakhayruhpsme.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\nibrjccufdxwquirvqjz.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\tqldxsuobbxyuaqbhezrlg.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\aumbskjakhayruhpsme.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\zqfrfuqelfvqggqv.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\tqldxsuobbxyuaqbhezrlg.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\nibrjccufdxwquirvqjz.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\tqldxsuobbxyuaqbhezrlg.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\zqfrfuqelfvqggqv.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\pizndusirnfcuwiprk.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\SysWOW64\zqfrfuqelfvqggqv.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\pizndusirnfcuwiprk.exe	cimnq.exe
File opened for modification	C:\Windows\SysWOW64\nibrjccufdxwquirvqjz.exe	cimnq.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File created	C:\Program Files (x86)\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File opened for modification	C:\Program Files (x86)\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe
File created	C:\Program Files (x86)\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tqldxsuobbxyuaqbhezrlg.exe	cimnq.exe
File opened for modification	C:\Windows\gyobqgdsavmizalrs.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\aumbskjakhayruhpsme.exe	cimnq.exe
File opened for modification	C:\Windows\nibrjccufdxwquirvqjz.exe	cimnq.exe
File opened for modification	C:\Windows\tqldxsuobbxyuaqbhezrlg.exe	cimnq.exe
File opened for modification	C:\Windows\cysjcwxqcbwwrwlvawqha.exe	cimnq.exe
File opened for modification	C:\Windows\cysjcwxqcbwwrwlvawqha.exe	cimnq.exe
File opened for modification	C:\Windows\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File opened for modification	C:\Windows\zqfrfuqelfvqggqv.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\pizndusirnfcuwiprk.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\cysjcwxqcbwwrwlvawqha.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\tqldxsuobbxyuaqbhezrlg.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\pizndusirnfcuwiprk.exe	cimnq.exe
File created	C:\Windows\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe
File opened for modification	C:\Windows\nibrjccufdxwquirvqjz.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\pizndusirnfcuwiprk.exe	cimnq.exe
File opened for modification	C:\Windows\aumbskjakhayruhpsme.exe	cimnq.exe
File created	C:\Windows\eecxusxuknmqpyrfoomhe.heu	cimnq.exe
File opened for modification	C:\Windows\zktzhqgopdncmgkjdoxdluksthrgqkon.sbh	cimnq.exe
File opened for modification	C:\Windows\nibrjccufdxwquirvqjz.exe	cimnq.exe
File opened for modification	C:\Windows\aumbskjakhayruhpsme.exe	ixiyjejjshs.exe
File opened for modification	C:\Windows\zqfrfuqelfvqggqv.exe	cimnq.exe
File opened for modification	C:\Windows\gyobqgdsavmizalrs.exe	cimnq.exe
File opened for modification	C:\Windows\zqfrfuqelfvqggqv.exe	cimnq.exe
File opened for modification	C:\Windows\gyobqgdsavmizalrs.exe	cimnq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1392	cimnq.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	cimnq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1508	1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	27
PID 1736 wrote to memory of 1508	1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	27
PID 1736 wrote to memory of 1508	1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	27
PID 1736 wrote to memory of 1508	1736	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	27
PID 1508 wrote to memory of 836	1508	ixiyjejjshs.exe	28
PID 1508 wrote to memory of 836	1508	ixiyjejjshs.exe	28
PID 1508 wrote to memory of 836	1508	ixiyjejjshs.exe	28
PID 1508 wrote to memory of 836	1508	ixiyjejjshs.exe	28
PID 1508 wrote to memory of 1392	1508	ixiyjejjshs.exe	29
PID 1508 wrote to memory of 1392	1508	ixiyjejjshs.exe	29
PID 1508 wrote to memory of 1392	1508	ixiyjejjshs.exe	29
PID 1508 wrote to memory of 1392	1508	ixiyjejjshs.exe	29

System policy modification 1 TTPs 35 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ixiyjejjshs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ixiyjejjshs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ixiyjejjshs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cimnq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cimnq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	cimnq.exe

C:\Users\Admin\AppData\Local\Temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
"C:\Users\Admin\AppData\Local\Temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe
  "C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe" "c:\users\admin\appdata\local\temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1508
- - C:\Users\Admin\AppData\Local\Temp\cimnq.exe
    "C:\Users\Admin\AppData\Local\Temp\cimnq.exe" "-C:\Users\Admin\AppData\Local\Temp\zqfrfuqelfvqggqv.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:836
- - C:\Users\Admin\AppData\Local\Temp\cimnq.exe
    "C:\Users\Admin\AppData\Local\Temp\cimnq.exe" "-C:\Users\Admin\AppData\Local\Temp\zqfrfuqelfvqggqv.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aumbskjakhayruhpsme.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
C:\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
C:\Users\Admin\AppData\Local\Temp\cysjcwxqcbwwrwlvawqha.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyobqgdsavmizalrs.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe

Filesize
320KB

MD5
a61ed7a936d5eb46a750297c5b92cd71

SHA1
98042f09391368c1d30699c9d190a2e129d89e34

SHA256
62eea3c47388e0c7c3ab5bfdb4768e031224c6cdaa38423e59766166e3e4794c

SHA512
d9f5ed6a00b5cf56139e306bd56ca5c1ad4e023b88bc4e632753d15d1c30cc249e919db1ce626a92fffed3fd80dbe83801f82c05eed70861c5c1d1910c96fbc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe

Filesize
320KB

MD5
a61ed7a936d5eb46a750297c5b92cd71

SHA1
98042f09391368c1d30699c9d190a2e129d89e34

SHA256
62eea3c47388e0c7c3ab5bfdb4768e031224c6cdaa38423e59766166e3e4794c

SHA512
d9f5ed6a00b5cf56139e306bd56ca5c1ad4e023b88bc4e632753d15d1c30cc249e919db1ce626a92fffed3fd80dbe83801f82c05eed70861c5c1d1910c96fbc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nibrjccufdxwquirvqjz.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pizndusirnfcuwiprk.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tqldxsuobbxyuaqbhezrlg.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zqfrfuqelfvqggqv.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\aumbskjakhayruhpsme.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\cysjcwxqcbwwrwlvawqha.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\gyobqgdsavmizalrs.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\nibrjccufdxwquirvqjz.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\pizndusirnfcuwiprk.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\tqldxsuobbxyuaqbhezrlg.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\zqfrfuqelfvqggqv.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\aumbskjakhayruhpsme.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\aumbskjakhayruhpsme.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\cysjcwxqcbwwrwlvawqha.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\cysjcwxqcbwwrwlvawqha.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\gyobqgdsavmizalrs.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\gyobqgdsavmizalrs.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\nibrjccufdxwquirvqjz.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\nibrjccufdxwquirvqjz.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\pizndusirnfcuwiprk.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\pizndusirnfcuwiprk.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\tqldxsuobbxyuaqbhezrlg.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\tqldxsuobbxyuaqbhezrlg.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\zqfrfuqelfvqggqv.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\zqfrfuqelfvqggqv.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
\Users\Admin\AppData\Local\Temp\cimnq.exe

Filesize
708KB

MD5
022b484a876e9b136d2fe6a7aeb8c72e

SHA1
1968828de64485dd9af051ac69e49e6ed476f4ae

SHA256
0d063fcfefdf7490747ae94f8e1c5aa5184217d5d7babd4d5ba8782975a2174b

SHA512
8285cede4df911be30d9f68f7b5a91e49319e0d40b3606217fd9cb6899ecea36bd8a703f8cfc682b12ed4e35223a5e4d27a3e8112440d8ff9dac8933a31aa503

Download Submit
\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe

Filesize
320KB

MD5
a61ed7a936d5eb46a750297c5b92cd71

SHA1
98042f09391368c1d30699c9d190a2e129d89e34

SHA256
62eea3c47388e0c7c3ab5bfdb4768e031224c6cdaa38423e59766166e3e4794c

SHA512
d9f5ed6a00b5cf56139e306bd56ca5c1ad4e023b88bc4e632753d15d1c30cc249e919db1ce626a92fffed3fd80dbe83801f82c05eed70861c5c1d1910c96fbc8

Download Submit
\Users\Admin\AppData\Local\Temp\ixiyjejjshs.exe

Filesize
320KB

MD5
a61ed7a936d5eb46a750297c5b92cd71

SHA1
98042f09391368c1d30699c9d190a2e129d89e34

SHA256
62eea3c47388e0c7c3ab5bfdb4768e031224c6cdaa38423e59766166e3e4794c

SHA512
d9f5ed6a00b5cf56139e306bd56ca5c1ad4e023b88bc4e632753d15d1c30cc249e919db1ce626a92fffed3fd80dbe83801f82c05eed70861c5c1d1910c96fbc8

Download Submit
memory/836-63-0x0000000000000000-mapping.dmp

Download
memory/1392-68-0x0000000000000000-mapping.dmp

Download
memory/1508-57-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download