Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Trojan-Ransom.Win32.Blocker.exe
Resource
win10v2004-20220812-en
General
-
Target
Trojan-Ransom.Win32.Blocker.exe
-
Size
500KB
-
MD5
066d72cf2de962249f8561b63c84f1cc
-
SHA1
d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
-
SHA256
9bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
-
SHA512
53cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
SSDEEP
12288:fwgHsqmAdjxORA4GTe2Pr9hroyCMJOcddfm+YWnz:fEqmwjfz79iSJOUY0z
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yborjrewily.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrljcxuldivsfhzwykhf.exe" udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "jdypkasmaprbvfetnm.exe" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "tletmaqiuhhphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "upldzqjetjmxsddtooy.exe" udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "hdatqicyofjvrdevrsdz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrljcxuldivsfhzwykhf.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "hdatqicyofjvrdevrsdz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "wtrljcxuldivsfhzwykhf.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "wtrljcxuldivsfhzwykhf.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzozoykygplp = "atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alxfryhsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe" yborjrewily.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe -
Executes dropped EXE 4 IoCs
pid Process 1936 yborjrewily.exe 3700 udntdip.exe 948 udntdip.exe 4884 yborjrewily.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Trojan-Ransom.Win32.Blocker.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation yborjrewily.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "atndxmdwjxyhajhvo.exe ." yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "jdypkasmaprbvfetnm.exe ." yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "upldzqjetjmxsddtooy.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrljcxuldivsfhzwykhf.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "upldzqjetjmxsddtooy.exe" udntdip.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "wtrljcxuldivsfhzwykhf.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "tletmaqiuhhphpmz.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "upldzqjetjmxsddtooy.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe ." yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe ." yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "hdatqicyofjvrdevrsdz.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tletmaqiuhhphpmz.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "tletmaqiuhhphpmz.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "wtrljcxuldivsfhzwykhf.exe ." yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tletmaqiuhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tletmaqiuhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtrljcxuldivsfhzwykhf.exe" udntdip.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe ." yborjrewily.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "upldzqjetjmxsddtooy.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "hdatqicyofjvrdevrsdz.exe ." udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "upldzqjetjmxsddtooy.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tletmaqiuhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "tletmaqiuhhphpmz.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "wtrljcxuldivsfhzwykhf.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "tletmaqiuhhphpmz.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tletmaqiuhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe" udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe ." udntdip.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "upldzqjetjmxsddtooy.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "tletmaqiuhhphpmz.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "atndxmdwjxyhajhvo.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" udntdip.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdypkasmaprbvfetnm.exe ." yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzpbrcpenxuzo = "wtrljcxuldivsfhzwykhf.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe ." udntdip.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbsfwiwmwhflbh = "hdatqicyofjvrdevrsdz.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atndxmdwjxyhajhvo.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\obpznwhubje = "jdypkasmaprbvfetnm.exe ." udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsbowgsyf = "hdatqicyofjvrdevrsdz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tletmaqiuhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upldzqjetjmxsddtooy.exe" udntdip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofxldqfwhtszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdatqicyofjvrdevrsdz.exe ." udntdip.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 whatismyipaddress.com 48 whatismyip.everdot.org 62 whatismyip.everdot.org 8 whatismyipaddress.com 11 whatismyip.everdot.org 20 whatismyip.everdot.org 23 www.showmyipaddress.com -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\jdypkasmaprbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\wtrljcxuldivsfhzwykhf.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\wtrljcxuldivsfhzwykhf.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\nlkfeyuskdjxvjmfdgtrql.exe udntdip.exe File created C:\Windows\SysWOW64\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe File opened for modification C:\Windows\SysWOW64\tletmaqiuhhphpmz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\hdatqicyofjvrdevrsdz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\tletmaqiuhhphpmz.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\atndxmdwjxyhajhvo.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\jdypkasmaprbvfetnm.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\nlkfeyuskdjxvjmfdgtrql.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\jdypkasmaprbvfetnm.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\upldzqjetjmxsddtooy.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\upldzqjetjmxsddtooy.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\nlkfeyuskdjxvjmfdgtrql.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\upldzqjetjmxsddtooy.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\wtrljcxuldivsfhzwykhf.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\hdatqicyofjvrdevrsdz.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\tletmaqiuhhphpmz.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\hdatqicyofjvrdevrsdz.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File opened for modification C:\Windows\SysWOW64\tletmaqiuhhphpmz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\atndxmdwjxyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\jdypkasmaprbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\atndxmdwjxyhajhvo.exe udntdip.exe File created C:\Windows\SysWOW64\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File opened for modification C:\Windows\SysWOW64\hdatqicyofjvrdevrsdz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\atndxmdwjxyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\wtrljcxuldivsfhzwykhf.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\nlkfeyuskdjxvjmfdgtrql.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\upldzqjetjmxsddtooy.exe udntdip.exe File opened for modification C:\Windows\SysWOW64\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File created C:\Program Files (x86)\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File opened for modification C:\Program Files (x86)\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe File created C:\Program Files (x86)\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\tletmaqiuhhphpmz.exe yborjrewily.exe File opened for modification C:\Windows\nlkfeyuskdjxvjmfdgtrql.exe yborjrewily.exe File opened for modification C:\Windows\hdatqicyofjvrdevrsdz.exe udntdip.exe File created C:\Windows\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File opened for modification C:\Windows\upldzqjetjmxsddtooy.exe udntdip.exe File opened for modification C:\Windows\nlkfeyuskdjxvjmfdgtrql.exe yborjrewily.exe File opened for modification C:\Windows\upldzqjetjmxsddtooy.exe yborjrewily.exe File opened for modification C:\Windows\tletmaqiuhhphpmz.exe udntdip.exe File opened for modification C:\Windows\glrtzadihhupupzzeointvbcf.jjw udntdip.exe File opened for modification C:\Windows\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe File opened for modification C:\Windows\jdypkasmaprbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\jdypkasmaprbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\atndxmdwjxyhajhvo.exe udntdip.exe File opened for modification C:\Windows\wtrljcxuldivsfhzwykhf.exe udntdip.exe File opened for modification C:\Windows\wtrljcxuldivsfhzwykhf.exe yborjrewily.exe File opened for modification C:\Windows\tletmaqiuhhphpmz.exe udntdip.exe File opened for modification C:\Windows\jdypkasmaprbvfetnm.exe udntdip.exe File opened for modification C:\Windows\nlkfeyuskdjxvjmfdgtrql.exe udntdip.exe File opened for modification C:\Windows\upldzqjetjmxsddtooy.exe yborjrewily.exe File opened for modification C:\Windows\wtrljcxuldivsfhzwykhf.exe yborjrewily.exe File opened for modification C:\Windows\atndxmdwjxyhajhvo.exe udntdip.exe File opened for modification C:\Windows\jdypkasmaprbvfetnm.exe udntdip.exe File created C:\Windows\lbsfwiwmwhflbhcndydtkxoaoeozxdtzufvq.lcp udntdip.exe File opened for modification C:\Windows\hdatqicyofjvrdevrsdz.exe yborjrewily.exe File opened for modification C:\Windows\tletmaqiuhhphpmz.exe yborjrewily.exe File opened for modification C:\Windows\atndxmdwjxyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\atndxmdwjxyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\hdatqicyofjvrdevrsdz.exe yborjrewily.exe File opened for modification C:\Windows\upldzqjetjmxsddtooy.exe udntdip.exe File opened for modification C:\Windows\hdatqicyofjvrdevrsdz.exe udntdip.exe File opened for modification C:\Windows\nlkfeyuskdjxvjmfdgtrql.exe udntdip.exe File opened for modification C:\Windows\wtrljcxuldivsfhzwykhf.exe udntdip.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 3700 udntdip.exe 3700 udntdip.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 3700 udntdip.exe 3700 udntdip.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe 4736 Trojan-Ransom.Win32.Blocker.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3700 udntdip.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4736 wrote to memory of 1936 4736 Trojan-Ransom.Win32.Blocker.exe 77 PID 4736 wrote to memory of 1936 4736 Trojan-Ransom.Win32.Blocker.exe 77 PID 4736 wrote to memory of 1936 4736 Trojan-Ransom.Win32.Blocker.exe 77 PID 1936 wrote to memory of 3700 1936 yborjrewily.exe 78 PID 1936 wrote to memory of 3700 1936 yborjrewily.exe 78 PID 1936 wrote to memory of 3700 1936 yborjrewily.exe 78 PID 1936 wrote to memory of 948 1936 yborjrewily.exe 79 PID 1936 wrote to memory of 948 1936 yborjrewily.exe 79 PID 1936 wrote to memory of 948 1936 yborjrewily.exe 79 PID 4736 wrote to memory of 4884 4736 Trojan-Ransom.Win32.Blocker.exe 82 PID 4736 wrote to memory of 4884 4736 Trojan-Ransom.Win32.Blocker.exe 82 PID 4736 wrote to memory of 4884 4736 Trojan-Ransom.Win32.Blocker.exe 82 -
System policy modification 1 TTPs 41 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" udntdip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" udntdip.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" udntdip.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe"C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\trojan-ransom.win32.blocker.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\udntdip.exe"C:\Users\Admin\AppData\Local\Temp\udntdip.exe" "-C:\Users\Admin\AppData\Local\Temp\tletmaqiuhhphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3700
-
-
C:\Users\Admin\AppData\Local\Temp\udntdip.exe"C:\Users\Admin\AppData\Local\Temp\udntdip.exe" "-C:\Users\Admin\AppData\Local\Temp\tletmaqiuhhphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:948
-
-
-
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe"C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\trojan-ransom.win32.blocker.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4884
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
692KB
MD5963e01ce40a5e84220d1afba7c30b113
SHA1c1543c56ffb47ab61967f7d3828f5c9214314ea9
SHA256d4b6cfd54bda6a2181dafcd6f5c557712cd2b5528f1a155e9b713212fe95d05d
SHA51256a8398f1ef26b7ae9564d3dc49447bd15cecad22780612074f49eb20811eb0c4f4eb7b557c5e4424742f6b0203f6f10347a9525f0500c597faaad52bc2eb933
-
Filesize
692KB
MD5963e01ce40a5e84220d1afba7c30b113
SHA1c1543c56ffb47ab61967f7d3828f5c9214314ea9
SHA256d4b6cfd54bda6a2181dafcd6f5c557712cd2b5528f1a155e9b713212fe95d05d
SHA51256a8398f1ef26b7ae9564d3dc49447bd15cecad22780612074f49eb20811eb0c4f4eb7b557c5e4424742f6b0203f6f10347a9525f0500c597faaad52bc2eb933
-
Filesize
692KB
MD5963e01ce40a5e84220d1afba7c30b113
SHA1c1543c56ffb47ab61967f7d3828f5c9214314ea9
SHA256d4b6cfd54bda6a2181dafcd6f5c557712cd2b5528f1a155e9b713212fe95d05d
SHA51256a8398f1ef26b7ae9564d3dc49447bd15cecad22780612074f49eb20811eb0c4f4eb7b557c5e4424742f6b0203f6f10347a9525f0500c597faaad52bc2eb933
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
320KB
MD5b92314203327a733531042bc58e54f57
SHA11f3d0081f308a82c9659f4a57fc1ad551167a181
SHA256d936bfd3b4264fe1650dee22119858b9d0cc58598e7e956ebecf72fb82f7c7d3
SHA5122982559183e13830cd795c7badadb15b4dad50315155299d9713970aff034c827ade98c79d6da836aea743890aca71bc0f7d5348a32f2858b4f40884ecccf7f7
-
Filesize
320KB
MD5b92314203327a733531042bc58e54f57
SHA11f3d0081f308a82c9659f4a57fc1ad551167a181
SHA256d936bfd3b4264fe1650dee22119858b9d0cc58598e7e956ebecf72fb82f7c7d3
SHA5122982559183e13830cd795c7badadb15b4dad50315155299d9713970aff034c827ade98c79d6da836aea743890aca71bc0f7d5348a32f2858b4f40884ecccf7f7
-
Filesize
320KB
MD5b92314203327a733531042bc58e54f57
SHA11f3d0081f308a82c9659f4a57fc1ad551167a181
SHA256d936bfd3b4264fe1650dee22119858b9d0cc58598e7e956ebecf72fb82f7c7d3
SHA5122982559183e13830cd795c7badadb15b4dad50315155299d9713970aff034c827ade98c79d6da836aea743890aca71bc0f7d5348a32f2858b4f40884ecccf7f7
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59
-
Filesize
500KB
MD5066d72cf2de962249f8561b63c84f1cc
SHA1d6c60b94a4d03f0b1a9f860807c26146f7ceb35d
SHA2569bb5c1ba34c80331b301d99d55045452856f6ae8cab48707fe1eef7ea3bedcce
SHA51253cf86f17d049ad1d0c8bd390889951194ef6f9fdcd58f9ca3b52b5a9f78c464d00a0eef9aeff34b87f5a98bf3ea89210e595bcc4343a4c41f30944808f27d59