96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

Analysis

max time kernel
226s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
Size

564KB
MD5

35084dce4f1d7e745db63636bf4bd4a8
SHA1

2f84e7a337b92d439694d628fbc44af04e93d073
SHA256

96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02
SHA512

94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5
SSDEEP

12288:L/pUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqs0u:LpUNr6YkVRFkgbeqeo68FhqN

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wjkqs.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wjkqs.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjzulgfvmwdrokozhjlb.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "azmeskgthosdxqrze.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe"	fdiwjegfpns.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jzdmranr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "trduhytfsyblewwd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "uvkeuombragtpknxefg.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "azmeskgthosdxqrze.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohoaiukrzay = "azmeskgthosdxqrze.exe"	wjkqs.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fdiwjegfpns.exe

Executes dropped EXE 3 IoCs

pid	Process
2128	fdiwjegfpns.exe
4528	wjkqs.exe
5096	wjkqs.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	fdiwjegfpns.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfnajwnvegfl = "uvkeuombragtpknxefg.exe"	fdiwjegfpns.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	wjkqs.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfnajwnvegfl = "wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjzulgfvmwdrokozhjlb.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "azmeskgthosdxqrze.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe ."	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe"	fdiwjegfpns.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfnajwnvegfl = "trduhytfsyblewwd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "trduhytfsyblewwd.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe ."	fdiwjegfpns.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "trduhytfsyblewwd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "azmeskgthosdxqrze.exe"	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "azmeskgthosdxqrze.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "uvkeuombragtpknxefg.exe ."	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "azmeskgthosdxqrze.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfnajwnvegfl = "wzqmeaarjucrpmrdmpsjf.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lfnajwnvegfl = "jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "wzqmeaarjucrpmrdmpsjf.exe"	fdiwjegfpns.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe ."	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "uvkeuombragtpknxefg.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "uvkeuombragtpknxefg.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe"	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjzulgfvmwdrokozhjlb.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "jjxqfyvjyglxsmoxdd.exe ."	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trduhytfsyblewwd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "trduhytfsyblewwd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe ."	wjkqs.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe"	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe ."	fdiwjegfpns.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "jjxqfyvjyglxsmoxdd.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uvkeuombragtpknxefg.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "hjzulgfvmwdrokozhjlb.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kfocmasbloovl = "uvkeuombragtpknxefg.exe ."	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	fdiwjegfpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\olwmyoitfkmvned = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjzulgfvmwdrokozhjlb.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azmeskgthosdxqrze.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jjxqfyvjyglxsmoxdd.exe"	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\arwgmwkpv = "trduhytfsyblewwd.exe"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lhrgrgzjuyzhyo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wzqmeaarjucrpmrdmpsjf.exe ."	wjkqs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tlrcjujpww = "wzqmeaarjucrpmrdmpsjf.exe ."	wjkqs.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wjkqs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fdiwjegfpns.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wzqmeaarjucrpmrdmpsjf.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\nrjgzwxpiudtsqwjtxbtqj.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\uvkeuombragtpknxefg.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\trduhytfsyblewwd.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\jjxqfyvjyglxsmoxdd.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\hjzulgfvmwdrokozhjlb.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\hjzulgfvmwdrokozhjlb.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\trduhytfsyblewwd.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\uvkeuombragtpknxefg.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File created	C:\Windows\SysWOW64\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\azmeskgthosdxqrze.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\wzqmeaarjucrpmrdmpsjf.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\nrjgzwxpiudtsqwjtxbtqj.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\trduhytfsyblewwd.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\uvkeuombragtpknxefg.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\SysWOW64\wzqmeaarjucrpmrdmpsjf.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\hjzulgfvmwdrokozhjlb.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\nrjgzwxpiudtsqwjtxbtqj.exe	wjkqs.exe
File created	C:\Windows\SysWOW64\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\azmeskgthosdxqrze.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\jjxqfyvjyglxsmoxdd.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\azmeskgthosdxqrze.exe	wjkqs.exe
File opened for modification	C:\Windows\SysWOW64\jjxqfyvjyglxsmoxdd.exe	wjkqs.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe
File opened for modification	C:\Program Files (x86)\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File created	C:\Program Files (x86)\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File opened for modification	C:\Program Files (x86)\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe
File opened for modification	C:\Windows\trduhytfsyblewwd.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\azmeskgthosdxqrze.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\trduhytfsyblewwd.exe	wjkqs.exe
File opened for modification	C:\Windows\uvkeuombragtpknxefg.exe	wjkqs.exe
File opened for modification	C:\Windows\wzqmeaarjucrpmrdmpsjf.exe	wjkqs.exe
File opened for modification	C:\Windows\nrjgzwxpiudtsqwjtxbtqj.exe	wjkqs.exe
File opened for modification	C:\Windows\uvkeuombragtpknxefg.exe	wjkqs.exe
File opened for modification	C:\Windows\azmeskgthosdxqrze.exe	wjkqs.exe
File opened for modification	C:\Windows\nrjgzwxpiudtsqwjtxbtqj.exe	wjkqs.exe
File opened for modification	C:\Windows\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File created	C:\Windows\yfaawwavrgslnoxnahojj.fje	wjkqs.exe
File opened for modification	C:\Windows\jjxqfyvjyglxsmoxdd.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\hjzulgfvmwdrokozhjlb.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\wzqmeaarjucrpmrdmpsjf.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\nrjgzwxpiudtsqwjtxbtqj.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\hjzulgfvmwdrokozhjlb.exe	wjkqs.exe
File opened for modification	C:\Windows\wzqmeaarjucrpmrdmpsjf.exe	wjkqs.exe
File opened for modification	C:\Windows\uvkeuombragtpknxefg.exe	fdiwjegfpns.exe
File opened for modification	C:\Windows\azmeskgthosdxqrze.exe	wjkqs.exe
File opened for modification	C:\Windows\jjxqfyvjyglxsmoxdd.exe	wjkqs.exe
File opened for modification	C:\Windows\trduhytfsyblewwd.exe	wjkqs.exe
File opened for modification	C:\Windows\jjxqfyvjyglxsmoxdd.exe	wjkqs.exe
File opened for modification	C:\Windows\hjzulgfvmwdrokozhjlb.exe	wjkqs.exe
File created	C:\Windows\tlrcjujpwwtxkwqrphzfqxixdkkhlyke.dvn	wjkqs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	wjkqs.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2128	3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe	83
PID 3256 wrote to memory of 2128	3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe	83
PID 3256 wrote to memory of 2128	3256	96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe	83
PID 2128 wrote to memory of 4528	2128	fdiwjegfpns.exe	84
PID 2128 wrote to memory of 4528	2128	fdiwjegfpns.exe	84
PID 2128 wrote to memory of 4528	2128	fdiwjegfpns.exe	84
PID 2128 wrote to memory of 5096	2128	fdiwjegfpns.exe	85
PID 2128 wrote to memory of 5096	2128	fdiwjegfpns.exe	85
PID 2128 wrote to memory of 5096	2128	fdiwjegfpns.exe	85

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fdiwjegfpns.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wjkqs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	fdiwjegfpns.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	fdiwjegfpns.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wjkqs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wjkqs.exe

C:\Users\Admin\AppData\Local\Temp\96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe
"C:\Users\Admin\AppData\Local\Temp\96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe
  "C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe" "c:\users\admin\appdata\local\temp\96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\wjkqs.exe
    "C:\Users\Admin\AppData\Local\Temp\wjkqs.exe" "-C:\Users\Admin\AppData\Local\Temp\trduhytfsyblewwd.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\wjkqs.exe
    "C:\Users\Admin\AppData\Local\Temp\wjkqs.exe" "-C:\Users\Admin\AppData\Local\Temp\trduhytfsyblewwd.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:5096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\azmeskgthosdxqrze.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe

Filesize
320KB

MD5
cd6b3a0eadf944cc16bef9910e79a477

SHA1
853506695aef3befde4d990f88953b7610a3c2b3

SHA256
38edc99cb3fd5cd1f3e71dd4290c3a57a2d1c2ad7ef22db303ec35a63b65739d

SHA512
b834300380d73be6509b02c611bc433880a145ba24f907d6d1bf4f695a3903cbdf0d2d7f5a8469f7b563f27737729c4d65e82690d64e91b8bf63711409e6752e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdiwjegfpns.exe

Filesize
320KB

MD5
cd6b3a0eadf944cc16bef9910e79a477

SHA1
853506695aef3befde4d990f88953b7610a3c2b3

SHA256
38edc99cb3fd5cd1f3e71dd4290c3a57a2d1c2ad7ef22db303ec35a63b65739d

SHA512
b834300380d73be6509b02c611bc433880a145ba24f907d6d1bf4f695a3903cbdf0d2d7f5a8469f7b563f27737729c4d65e82690d64e91b8bf63711409e6752e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hjzulgfvmwdrokozhjlb.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\jjxqfyvjyglxsmoxdd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nrjgzwxpiudtsqwjtxbtqj.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\trduhytfsyblewwd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvkeuombragtpknxefg.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjkqs.exe

Filesize
700KB

MD5
c8e7875f2dd26b0725e1db7fdc312e21

SHA1
23979f7fca8f7d97fd3260190e282c5f6b3833ae

SHA256
57e9127042692ed14d962701b3a2e4b35c845c98826e3e6231168a1fd5e54f4d

SHA512
bcccf27afff8938bb733a552c0ba81ac1bfea50d058672933e59d4e93129d243d31eed5399200cc0f6d735114320efdfacf938160418dac3aa72154527cd7f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjkqs.exe

Filesize
700KB

MD5
c8e7875f2dd26b0725e1db7fdc312e21

SHA1
23979f7fca8f7d97fd3260190e282c5f6b3833ae

SHA256
57e9127042692ed14d962701b3a2e4b35c845c98826e3e6231168a1fd5e54f4d

SHA512
bcccf27afff8938bb733a552c0ba81ac1bfea50d058672933e59d4e93129d243d31eed5399200cc0f6d735114320efdfacf938160418dac3aa72154527cd7f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjkqs.exe

Filesize
700KB

MD5
c8e7875f2dd26b0725e1db7fdc312e21

SHA1
23979f7fca8f7d97fd3260190e282c5f6b3833ae

SHA256
57e9127042692ed14d962701b3a2e4b35c845c98826e3e6231168a1fd5e54f4d

SHA512
bcccf27afff8938bb733a552c0ba81ac1bfea50d058672933e59d4e93129d243d31eed5399200cc0f6d735114320efdfacf938160418dac3aa72154527cd7f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzqmeaarjucrpmrdmpsjf.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\azmeskgthosdxqrze.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\hjzulgfvmwdrokozhjlb.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\jjxqfyvjyglxsmoxdd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\nrjgzwxpiudtsqwjtxbtqj.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\trduhytfsyblewwd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\uvkeuombragtpknxefg.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\SysWOW64\wzqmeaarjucrpmrdmpsjf.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\azmeskgthosdxqrze.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\azmeskgthosdxqrze.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\hjzulgfvmwdrokozhjlb.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\hjzulgfvmwdrokozhjlb.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\jjxqfyvjyglxsmoxdd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\jjxqfyvjyglxsmoxdd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\nrjgzwxpiudtsqwjtxbtqj.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\nrjgzwxpiudtsqwjtxbtqj.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\trduhytfsyblewwd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\trduhytfsyblewwd.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\uvkeuombragtpknxefg.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\uvkeuombragtpknxefg.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\wzqmeaarjucrpmrdmpsjf.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit
C:\Windows\wzqmeaarjucrpmrdmpsjf.exe

Filesize
564KB

MD5
35084dce4f1d7e745db63636bf4bd4a8

SHA1
2f84e7a337b92d439694d628fbc44af04e93d073

SHA256
96f61de90a974ccc68cfc41e4b6b37fce21d7a05504a20bd13dc617e97259e02

SHA512
94e1d41fab0cacf04ea7c7f8eee08be4ee9af7529d1c8fa2611d187a57b61c9e7ff6bf7e57dcb4bf8ead73bd0c00dd50e7a435f0c357d9058fd67d2fed504ad5

Download Submit