78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Size

1016KB
MD5

2ab2beedcf4290c6bab69d344ec0f3b0
SHA1

43c45908ed559bd95a2d0cd08300d4e67e6fcab3
SHA256

78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e
SHA512

b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9
SSDEEP

6144:TIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUPzo0zo:TIXsgtvm1De5YlOx6lzBH46UPzo0zo

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	whpqels.exe

Adds policy Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "vpgqndtfwhpfkdgf.exe"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "wtnaatmbvjunvrxzdba.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "wtnaatmbvjunvrxzdba.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cpzcsbkpz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ndqwpbnviptf = "lhamldvjcpzrytyzcz.exe"	grrfdxtjqbb.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe

Executes dropped EXE 4 IoCs

pid	Process
4784	grrfdxtjqbb.exe
4856	whpqels.exe
4648	whpqels.exe
1764	grrfdxtjqbb.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	grrfdxtjqbb.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "wtnaatmbvjunvrxzdba.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "vpgqndtfwhpfkdgf.exe"	grrfdxtjqbb.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "jhcqrlfvqfrlurybgffd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "jhcqrlfvqfrlurybgffd.exe ."	whpqels.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "yxtikfarndqlvtbfllmlh.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "wtnaatmbvjunvrxzdba.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qjzietitjtaptln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "lhamldvjcpzrytyzcz.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhamldvjcpzrytyzcz.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "wtnaatmbvjunvrxzdba.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "yxtikfarndqlvtbfllmlh.exe ."	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtnaatmbvjunvrxzdba.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "cxpaypgtlxgxdxbbd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "lhamldvjcpzrytyzcz.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "cxpaypgtlxgxdxbbd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "lhamldvjcpzrytyzcz.exe"	whpqels.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "jhcqrlfvqfrlurybgffd.exe ."	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nfucxlzjyhnbev = "lhamldvjcpzrytyzcz.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qfrwozkrdjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe ."	whpqels.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "lhamldvjcpzrytyzcz.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "yxtikfarndqlvtbfllmlh.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "cxpaypgtlxgxdxbbd.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vjuypzjpaf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpgqndtfwhpfkdgf.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpgqndtfwhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhcqrlfvqfrlurybgffd.exe"	whpqels.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdrysfsbpxcpr = "lhamldvjcpzrytyzcz.exe"	whpqels.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	whatismyip.everdot.org
12	www.showmyipaddress.com
21	whatismyipaddress.com
47	whatismyip.everdot.org
54	whatismyip.everdot.org

Drops file in System32 directory 32 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe	whpqels.exe
File created	C:\Windows\SysWOW64\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe	whpqels.exe
File opened for modification	C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe	whpqels.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe
File opened for modification	C:\Program Files (x86)\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File created	C:\Program Files (x86)\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File opened for modification	C:\Program Files (x86)\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe
File opened for modification	C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe	whpqels.exe
File opened for modification	C:\Windows\lhamldvjcpzrytyzcz.exe	whpqels.exe
File opened for modification	C:\Windows\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File opened for modification	C:\Windows\vpgqndtfwhpfkdgf.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\yxtikfarndqlvtbfllmlh.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vpgqndtfwhpfkdgf.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\cxpaypgtlxgxdxbbd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vpgqndtfwhpfkdgf.exe	whpqels.exe
File opened for modification	C:\Windows\lhamldvjcpzrytyzcz.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\cxpaypgtlxgxdxbbd.exe	whpqels.exe
File opened for modification	C:\Windows\yxtikfarndqlvtbfllmlh.exe	whpqels.exe
File opened for modification	C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe	whpqels.exe
File created	C:\Windows\iptqadgfjhcfxdtftbkrvscfi.lje	whpqels.exe
File opened for modification	C:\Windows\wtnaatmbvjunvrxzdba.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\jhcqrlfvqfrlurybgffd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\yxtikfarndqlvtbfllmlh.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\wtnaatmbvjunvrxzdba.exe	whpqels.exe
File opened for modification	C:\Windows\jhcqrlfvqfrlurybgffd.exe	whpqels.exe
File created	C:\Windows\nfucxlzjyhnbevwtslfxmupdrbqzftwnolkd.pem	whpqels.exe
File opened for modification	C:\Windows\cxpaypgtlxgxdxbbd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\wtnaatmbvjunvrxzdba.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\cxpaypgtlxgxdxbbd.exe	whpqels.exe
File opened for modification	C:\Windows\jhcqrlfvqfrlurybgffd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\lhamldvjcpzrytyzcz.exe	whpqels.exe
File opened for modification	C:\Windows\yxtikfarndqlvtbfllmlh.exe	whpqels.exe
File opened for modification	C:\Windows\lhamldvjcpzrytyzcz.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\wtnaatmbvjunvrxzdba.exe	whpqels.exe
File opened for modification	C:\Windows\jhcqrlfvqfrlurybgffd.exe	whpqels.exe
File opened for modification	C:\Windows\vpgqndtfwhpfkdgf.exe	whpqels.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
4856	whpqels.exe
4856	whpqels.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
4856	whpqels.exe
4856	whpqels.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	whpqels.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4784	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	81
PID 5004 wrote to memory of 4784	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	81
PID 5004 wrote to memory of 4784	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	81
PID 4784 wrote to memory of 4856	4784	grrfdxtjqbb.exe	82
PID 4784 wrote to memory of 4856	4784	grrfdxtjqbb.exe	82
PID 4784 wrote to memory of 4856	4784	grrfdxtjqbb.exe	82
PID 4784 wrote to memory of 4648	4784	grrfdxtjqbb.exe	83
PID 4784 wrote to memory of 4648	4784	grrfdxtjqbb.exe	83
PID 4784 wrote to memory of 4648	4784	grrfdxtjqbb.exe	83
PID 5004 wrote to memory of 1764	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	92
PID 5004 wrote to memory of 1764	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	92
PID 5004 wrote to memory of 1764	5004	78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe	92

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	whpqels.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	whpqels.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	whpqels.exe

C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe
"C:\Users\Admin\AppData\Local\Temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\whpqels.exe
    "C:\Users\Admin\AppData\Local\Temp\whpqels.exe" "-C:\Users\Admin\AppData\Local\Temp\vpgqndtfwhpfkdgf.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\whpqels.exe
    "C:\Users\Admin\AppData\Local\Temp\whpqels.exe" "-C:\Users\Admin\AppData\Local\Temp\vpgqndtfwhpfkdgf.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4648
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cxpaypgtlxgxdxbbd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
3e4dd0824e2dd2318d91cab6b10bb1a1

SHA1
dd3baf597868657280a39bbbb3a89aad903a5a68

SHA256
db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c

SHA512
15fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
3e4dd0824e2dd2318d91cab6b10bb1a1

SHA1
dd3baf597868657280a39bbbb3a89aad903a5a68

SHA256
db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c

SHA512
15fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
3e4dd0824e2dd2318d91cab6b10bb1a1

SHA1
dd3baf597868657280a39bbbb3a89aad903a5a68

SHA256
db41fa05e3d1c9f17f3ffc7a0570ce2ef6e4d02fa2eb353e45df8f270c939d0c

SHA512
15fd53f7c4aab74b19965c1158fcb0e20b61b5660460372b5608d62989d58d8b42cc7f0067742c2e8b4ab7236c786380d470029e2a4e3f782b6ad081375f73e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhcqrlfvqfrlurybgffd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\lhamldvjcpzrytyzcz.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppmcfbxpmdrnyxglstvvsi.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\vpgqndtfwhpfkdgf.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\whpqels.exe

Filesize
712KB

MD5
a0871738fd611eb34958d8cc79917267

SHA1
98ecf848ed315a484760c019bbc4dc7243204fc0

SHA256
4d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b

SHA512
502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\whpqels.exe

Filesize
712KB

MD5
a0871738fd611eb34958d8cc79917267

SHA1
98ecf848ed315a484760c019bbc4dc7243204fc0

SHA256
4d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b

SHA512
502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\whpqels.exe

Filesize
712KB

MD5
a0871738fd611eb34958d8cc79917267

SHA1
98ecf848ed315a484760c019bbc4dc7243204fc0

SHA256
4d0455b8c0f9d084e68f44411e4f507d39a6d120c4a44c5f755a39695b5d052b

SHA512
502b273203cefd70c4252318df74871a9e4f817e294d6e6abc5d4e7d10c9c19933047d42bc9cc5485e94efc65c2455e411c509c63d44903db0402f402a067ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtnaatmbvjunvrxzdba.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\yxtikfarndqlvtbfllmlh.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\cxpaypgtlxgxdxbbd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\jhcqrlfvqfrlurybgffd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\lhamldvjcpzrytyzcz.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\ppmcfbxpmdrnyxglstvvsi.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\vpgqndtfwhpfkdgf.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\wtnaatmbvjunvrxzdba.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\SysWOW64\yxtikfarndqlvtbfllmlh.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\cxpaypgtlxgxdxbbd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\cxpaypgtlxgxdxbbd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\cxpaypgtlxgxdxbbd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\jhcqrlfvqfrlurybgffd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\jhcqrlfvqfrlurybgffd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\jhcqrlfvqfrlurybgffd.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\lhamldvjcpzrytyzcz.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\lhamldvjcpzrytyzcz.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\lhamldvjcpzrytyzcz.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\ppmcfbxpmdrnyxglstvvsi.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\vpgqndtfwhpfkdgf.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\vpgqndtfwhpfkdgf.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\vpgqndtfwhpfkdgf.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\wtnaatmbvjunvrxzdba.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\wtnaatmbvjunvrxzdba.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\wtnaatmbvjunvrxzdba.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\yxtikfarndqlvtbfllmlh.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\yxtikfarndqlvtbfllmlh.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit
C:\Windows\yxtikfarndqlvtbfllmlh.exe

Filesize
1016KB

MD5
2ab2beedcf4290c6bab69d344ec0f3b0

SHA1
43c45908ed559bd95a2d0cd08300d4e67e6fcab3

SHA256
78259303018f277df8faf433b90d88b299edc6cc88c203ca68631dc55b573d6e

SHA512
b70a8be830428b3dd82d6bd6f2df61b72a5ceb9215c509f271e14f55f27e71c085c628b39a9798f3d2c47dd885241acf2091dd062537f96a049bd9694f229ed9

Download Submit