Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Resource
win10v2004-20220812-en
General
-
Target
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
-
Size
1016KB
-
MD5
2ab2beedcf4290c6bab69d344ec0f3b0
-
SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3
-
SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
-
SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
SSDEEP
6144:TIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUPzo0zo:TIXsgtvm1De5YlOx6lzBH46UPzo0zo
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" grrfdxtjqbb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" whpqels.exe -
Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "vpgqndtfwhpfkdgf.exe" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "jhcqrlfvqfrlurybgffd.exe" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "wtnaatmbvjunvrxzdba.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "wtnaatmbvjunvrxzdba.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe" grrfdxtjqbb.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe -
Executes dropped EXE 4 IoCs
pid Process 4784 grrfdxtjqbb.exe 4856 whpqels.exe 4648 whpqels.exe 1764 grrfdxtjqbb.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation grrfdxtjqbb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "wtnaatmbvjunvrxzdba.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "vpgqndtfwhpfkdgf.exe" grrfdxtjqbb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "jhcqrlfvqfrlurybgffd.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "jhcqrlfvqfrlurybgffd.exe ." whpqels.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "yxtikfarndqlvtbfllmlh.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "wtnaatmbvjunvrxzdba.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "lhamldvjcpzrytyzcz.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "wtnaatmbvjunvrxzdba.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "yxtikfarndqlvtbfllmlh.exe ." whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "cxpaypgtlxgxdxbbd.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "lhamldvjcpzrytyzcz.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "cxpaypgtlxgxdxbbd.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "lhamldvjcpzrytyzcz.exe" whpqels.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "jhcqrlfvqfrlurybgffd.exe ." whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "lhamldvjcpzrytyzcz.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ." whpqels.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "lhamldvjcpzrytyzcz.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "yxtikfarndqlvtbfllmlh.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "cxpaypgtlxgxdxbbd.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe" whpqels.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "lhamldvjcpzrytyzcz.exe" whpqels.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 whatismyip.everdot.org 12 www.showmyipaddress.com 21 whatismyipaddress.com 47 whatismyip.everdot.org 54 whatismyip.everdot.org -
Drops file in System32 directory 32 IoCs
description ioc Process File created C:\Windows\SysWOW64\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File opened for modification C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe whpqels.exe File created C:\Windows\SysWOW64\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe File opened for modification C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File opened for modification C:\Windows\SysWOW64\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe File opened for modification C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe whpqels.exe File opened for modification C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe whpqels.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe File opened for modification C:\Program Files (x86)\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File created C:\Program Files (x86)\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File opened for modification C:\Program Files (x86)\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe File opened for modification C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe whpqels.exe File opened for modification C:\Windows\lhamldvjcpzrytyzcz.exe whpqels.exe File opened for modification C:\Windows\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File opened for modification C:\Windows\vpgqndtfwhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\yxtikfarndqlvtbfllmlh.exe grrfdxtjqbb.exe File opened for modification C:\Windows\vpgqndtfwhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\cxpaypgtlxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\vpgqndtfwhpfkdgf.exe whpqels.exe File opened for modification C:\Windows\lhamldvjcpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\cxpaypgtlxgxdxbbd.exe whpqels.exe File opened for modification C:\Windows\yxtikfarndqlvtbfllmlh.exe whpqels.exe File opened for modification C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe whpqels.exe File created C:\Windows\iptqadgfjhcfxdtftbkrvscfi.lje whpqels.exe File opened for modification C:\Windows\wtnaatmbvjunvrxzdba.exe grrfdxtjqbb.exe File opened for modification C:\Windows\jhcqrlfvqfrlurybgffd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\yxtikfarndqlvtbfllmlh.exe grrfdxtjqbb.exe File opened for modification C:\Windows\wtnaatmbvjunvrxzdba.exe whpqels.exe File opened for modification C:\Windows\jhcqrlfvqfrlurybgffd.exe whpqels.exe File created C:\Windows\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem whpqels.exe File opened for modification C:\Windows\cxpaypgtlxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\wtnaatmbvjunvrxzdba.exe grrfdxtjqbb.exe File opened for modification C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\cxpaypgtlxgxdxbbd.exe whpqels.exe File opened for modification C:\Windows\jhcqrlfvqfrlurybgffd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\lhamldvjcpzrytyzcz.exe whpqels.exe File opened for modification C:\Windows\yxtikfarndqlvtbfllmlh.exe whpqels.exe File opened for modification C:\Windows\lhamldvjcpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\wtnaatmbvjunvrxzdba.exe whpqels.exe File opened for modification C:\Windows\jhcqrlfvqfrlurybgffd.exe whpqels.exe File opened for modification C:\Windows\vpgqndtfwhpfkdgf.exe whpqels.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 4856 whpqels.exe 4856 whpqels.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 4856 whpqels.exe 4856 whpqels.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4856 whpqels.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4784 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 81 PID 5004 wrote to memory of 4784 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 81 PID 5004 wrote to memory of 4784 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 81 PID 4784 wrote to memory of 4856 4784 grrfdxtjqbb.exe 82 PID 4784 wrote to memory of 4856 4784 grrfdxtjqbb.exe 82 PID 4784 wrote to memory of 4856 4784 grrfdxtjqbb.exe 82 PID 4784 wrote to memory of 4648 4784 grrfdxtjqbb.exe 83 PID 4784 wrote to memory of 4648 4784 grrfdxtjqbb.exe 83 PID 4784 wrote to memory of 4648 4784 grrfdxtjqbb.exe 83 PID 5004 wrote to memory of 1764 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 92 PID 5004 wrote to memory of 1764 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 92 PID 5004 wrote to memory of 1764 5004 78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe 92 -
System policy modification 1 TTPs 41 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" whpqels.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" whpqels.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" whpqels.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe"C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\whpqels.exe"C:\Users\Admin\AppData\Local\Temp\whpqels.exe" "-C:\Users\Admin\AppData\Local\Temp\vpgqndtfwhpfkdgf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4856
-
-
C:\Users\Admin\AppData\Local\Temp\whpqels.exe"C:\Users\Admin\AppData\Local\Temp\whpqels.exe" "-C:\Users\Admin\AppData\Local\Temp\vpgqndtfwhpfkdgf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4648
-
-
-
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe"C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1764
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
320KB
MD53e4dd0824e2dd2318d91cab6b10bb1a1
SHA1dd3baf597868657280a39bbbb3a89aad903a5a68
SHA256db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c
SHA51215fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3
-
Filesize
320KB
MD53e4dd0824e2dd2318d91cab6b10bb1a1
SHA1dd3baf597868657280a39bbbb3a89aad903a5a68
SHA256db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c
SHA51215fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3
-
Filesize
320KB
MD53e4dd0824e2dd2318d91cab6b10bb1a1
SHA1dd3baf597868657280a39bbbb3a89aad903a5a68
SHA256db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c
SHA51215fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
712KB
MD5a0871738fd611eb34958d8cc79917267
SHA198ecf848ed315a484760c019bbc4dc7243204fc0
SHA2564d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b
SHA512502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded
-
Filesize
712KB
MD5a0871738fd611eb34958d8cc79917267
SHA198ecf848ed315a484760c019bbc4dc7243204fc0
SHA2564d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b
SHA512502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded
-
Filesize
712KB
MD5a0871738fd611eb34958d8cc79917267
SHA198ecf848ed315a484760c019bbc4dc7243204fc0
SHA2564d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b
SHA512502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
-
Filesize
1016KB
MD52ab2beedcf4290c6bab69d344ec0f3b0
SHA143c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA25678259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9