Analysis
-
max time kernel
174s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 02:48
Static task
static1
Behavioral task
behavioral1
Sample
9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe
Resource
win7-20221111-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe
-
Size
564KB
-
MD5
f07ca0bf5aa6c52f33e3d83852eb6ffc
-
SHA1
6f4277b6d4b58f54a45ff5da54c7529ea01fd02c
-
SHA256
9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
-
SHA512
679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
SSDEEP
6144:F8XXRUw9Oz5+iUU03pej1YpTYzOb0kLXhlJFTaLTGu0yvHcr+JB8aU:OnRy+ZyYpaCDJFuPyAHcqrU
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xzsqxqazhjc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bjmvzjr.exe -
Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "qjxrgbujwsqzzessjp.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "ardvibsfqkgnloay.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzmftnftfaxfeivuk.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjxrgbujwsqzzessjp.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzmftnftfaxfeivuk.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "qjxrgbujwsqzzessjp.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "hzmftnftfaxfeivuk.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "hzmftnftfaxfeivuk.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjxrgbujwsqzzessjp.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "hzmftnftfaxfeivuk.exe" bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qzdnsdmr = "ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\djkrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe -
Executes dropped EXE 3 IoCs
pid Process 3636 xzsqxqazhjc.exe 5072 bjmvzjr.exe 2444 bjmvzjr.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation xzsqxqazhjc.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvkfvrlbpmlvwcrskrf.exe ." bjmvzjr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzmftnftfaxfeivuk.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfnbkzmvcskn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "dzqnfdzrhghtwevysbrne.exe ." bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "qjxrgbujwsqzzessjp.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfnbkzmvcskn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "ojzvmjevkiitvcsunvkf.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "hzmftnftfaxfeivuk.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhobjxjrxmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjxrgbujwsqzzessjp.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhobjxjrxmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bjmvzjr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "hzmftnftfaxfeivuk.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "hzmftnftfaxfeivuk.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzmftnftfaxfeivuk.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhobjxjrxmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "qjxrgbujwsqzzessjp.exe ." bjmvzjr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "hzmftnftfaxfeivuk.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "bvkfvrlbpmlvwcrskrf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "ardvibsfqkgnloay.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "bvkfvrlbpmlvwcrskrf.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "ardvibsfqkgnloay.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "ojzvmjevkiitvcsunvkf.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "ojzvmjevkiitvcsunvkf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "hzmftnftfaxfeivuk.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhobjxjrxmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjxrgbujwsqzzessjp.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ardvibsfqkgnloay.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ovxfir = "hzmftnftfaxfeivuk.exe" bjmvzjr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhobjxjrxmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvkfvrlbpmlvwcrskrf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "bvkfvrlbpmlvwcrskrf.exe ." bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ovxfir = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvkfvrlbpmlvwcrskrf.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "hzmftnftfaxfeivuk.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hrwhnzjpt = "dzqnfdzrhghtwevysbrne.exe" bjmvzjr.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\alrdkxipui = "hzmftnftfaxfeivuk.exe ." bjmvzjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bjmvzjr = "dzqnfdzrhghtwevysbrne.exe ." xzsqxqazhjc.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 68 whatismyipaddress.com 85 whatismyip.everdot.org 89 www.showmyipaddress.com 98 whatismyip.everdot.org 67 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf bjmvzjr.exe File created C:\autorun.inf bjmvzjr.exe -
Drops file in System32 directory 46 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File created C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe bjmvzjr.exe File created C:\Windows\SysWOW64\ardvibsfqkgnloay.exe bjmvzjr.exe File created C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File created C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File created C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe bjmvzjr.exe File created C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe File created C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File created C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File created C:\Windows\SysWOW64\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\ardvibsfqkgnloay.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe File created C:\Windows\SysWOW64\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe File created C:\Windows\SysWOW64\ardvibsfqkgnloay.exe xzsqxqazhjc.exe File created C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\hzmftnftfaxfeivuk.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\ardvibsfqkgnloay.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\ardvibsfqkgnloay.exe bjmvzjr.exe File created C:\Windows\SysWOW64\ardvibsfqkgnloay.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File created C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe File created C:\Windows\SysWOW64\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File opened for modification C:\Windows\SysWOW64\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File created C:\Windows\SysWOW64\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File created C:\Windows\SysWOW64\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File created C:\Windows\SysWOW64\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File created C:\Program Files (x86)\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File opened for modification C:\Program Files (x86)\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe File created C:\Program Files (x86)\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe -
Drops file in Windows directory 33 IoCs
description ioc Process File created C:\Windows\qjxrgbujwsqzzessjp.exe xzsqxqazhjc.exe File created C:\Windows\bvkfvrlbpmlvwcrskrf.exe xzsqxqazhjc.exe File created C:\Windows\urjhazwpggivziaezjaxpn.exe xzsqxqazhjc.exe File created C:\Windows\hzmftnftfaxfeivuk.exe bjmvzjr.exe File opened for modification C:\Windows\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File opened for modification C:\Windows\dzqnfdzrhghtwevysbrne.exe bjmvzjr.exe File opened for modification C:\Windows\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File opened for modification C:\Windows\hzmftnftfaxfeivuk.exe xzsqxqazhjc.exe File opened for modification C:\Windows\dzqnfdzrhghtwevysbrne.exe xzsqxqazhjc.exe File opened for modification C:\Windows\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe File opened for modification C:\Windows\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File opened for modification C:\Windows\ardvibsfqkgnloay.exe bjmvzjr.exe File opened for modification C:\Windows\bvkfvrlbpmlvwcrskrf.exe bjmvzjr.exe File opened for modification C:\Windows\ojzvmjevkiitvcsunvkf.exe xzsqxqazhjc.exe File opened for modification C:\Windows\urjhazwpggivziaezjaxpn.exe xzsqxqazhjc.exe File created C:\Windows\ardvibsfqkgnloay.exe xzsqxqazhjc.exe File created C:\Windows\hzmftnftfaxfeivuk.exe xzsqxqazhjc.exe File opened for modification C:\Windows\bvkfvrlbpmlvwcrskrf.exe xzsqxqazhjc.exe File created C:\Windows\ojzvmjevkiitvcsunvkf.exe xzsqxqazhjc.exe File opened for modification C:\Windows\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File opened for modification C:\Windows\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File opened for modification C:\Windows\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe File opened for modification C:\Windows\qjxrgbujwsqzzessjp.exe xzsqxqazhjc.exe File opened for modification C:\Windows\hzmftnftfaxfeivuk.exe bjmvzjr.exe File opened for modification C:\Windows\hzmftnftfaxfeivuk.exe bjmvzjr.exe File created C:\Windows\dzqnfdzrhghtwevysbrne.exe xzsqxqazhjc.exe File opened for modification C:\Windows\qjxrgbujwsqzzessjp.exe bjmvzjr.exe File opened for modification C:\Windows\urjhazwpggivziaezjaxpn.exe bjmvzjr.exe File opened for modification C:\Windows\ardvibsfqkgnloay.exe xzsqxqazhjc.exe File opened for modification C:\Windows\ardvibsfqkgnloay.exe bjmvzjr.exe File opened for modification C:\Windows\ojzvmjevkiitvcsunvkf.exe bjmvzjr.exe File created C:\Windows\fhehfjljfkrjsgdmmbxzwzx.dbx bjmvzjr.exe File created C:\Windows\sfnbkzmvcsknhgoittanvjshudkasvpowq.biv bjmvzjr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 5072 bjmvzjr.exe 5072 bjmvzjr.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 5072 bjmvzjr.exe 5072 bjmvzjr.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5072 bjmvzjr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1360 wrote to memory of 3636 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 84 PID 1360 wrote to memory of 3636 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 84 PID 1360 wrote to memory of 3636 1360 9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe 84 PID 3636 wrote to memory of 5072 3636 xzsqxqazhjc.exe 85 PID 3636 wrote to memory of 5072 3636 xzsqxqazhjc.exe 85 PID 3636 wrote to memory of 5072 3636 xzsqxqazhjc.exe 85 PID 3636 wrote to memory of 2444 3636 xzsqxqazhjc.exe 86 PID 3636 wrote to memory of 2444 3636 xzsqxqazhjc.exe 86 PID 3636 wrote to memory of 2444 3636 xzsqxqazhjc.exe 86 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bjmvzjr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bjmvzjr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe"C:\Users\Admin\AppData\Local\Temp\9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe"C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe" "c:\users\admin\appdata\local\temp\9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\bjmvzjr.exe"C:\Users\Admin\AppData\Local\Temp\bjmvzjr.exe" "-c:\users\admin\appdata\local\temp\9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\bjmvzjr.exe"C:\Users\Admin\AppData\Local\Temp\bjmvzjr.exe" "-c:\users\admin\appdata\local\temp\9977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2444
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
692KB
MD5259cd920053c792030c9e0cb6cae6f5b
SHA17891d42be446c78b0fe76842236dcf2a3d6a5fda
SHA25620c765d65fc718c2909ee90e421ebe094214b77666178817157ce4419df789d6
SHA512366cce1376f8814e612424779cdee7717c9a42addfbf632fe5438359bd0275c673e60e8ce53310f25c6f6c7edfef0bbb71514cd28d5a39fd91f0abb19ba7ce9a
-
Filesize
692KB
MD5259cd920053c792030c9e0cb6cae6f5b
SHA17891d42be446c78b0fe76842236dcf2a3d6a5fda
SHA25620c765d65fc718c2909ee90e421ebe094214b77666178817157ce4419df789d6
SHA512366cce1376f8814e612424779cdee7717c9a42addfbf632fe5438359bd0275c673e60e8ce53310f25c6f6c7edfef0bbb71514cd28d5a39fd91f0abb19ba7ce9a
-
Filesize
692KB
MD5259cd920053c792030c9e0cb6cae6f5b
SHA17891d42be446c78b0fe76842236dcf2a3d6a5fda
SHA25620c765d65fc718c2909ee90e421ebe094214b77666178817157ce4419df789d6
SHA512366cce1376f8814e612424779cdee7717c9a42addfbf632fe5438359bd0275c673e60e8ce53310f25c6f6c7edfef0bbb71514cd28d5a39fd91f0abb19ba7ce9a
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
308KB
MD585cb856b920e7b0b7b75115336fc2af2
SHA11d1a207efec2f5187583b652c35aef74ee4c473f
SHA2566fff20aabe8265b6e811c9dbcb987f9c15cf07d1d8b80ced7b287d96900f5c62
SHA512120ff9c77c19216e5691b6ba812f09f7db7b46685a391027fff56e5b73200f4211b6bac2c2d28cdfe461d1fbf10f1a3204adeedbd0a34a034a862c6278d901e8
-
Filesize
308KB
MD585cb856b920e7b0b7b75115336fc2af2
SHA11d1a207efec2f5187583b652c35aef74ee4c473f
SHA2566fff20aabe8265b6e811c9dbcb987f9c15cf07d1d8b80ced7b287d96900f5c62
SHA512120ff9c77c19216e5691b6ba812f09f7db7b46685a391027fff56e5b73200f4211b6bac2c2d28cdfe461d1fbf10f1a3204adeedbd0a34a034a862c6278d901e8
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec
-
Filesize
564KB
MD5f07ca0bf5aa6c52f33e3d83852eb6ffc
SHA16f4277b6d4b58f54a45ff5da54c7529ea01fd02c
SHA2569977667c2cbbcaec1a2bab8eef10d25d61b381bc3e5686c1e7f07721d6e8ccb2
SHA512679f83e7ae340386054cb371bf58f1793dc244e4cac642c87c10bdd37a80d23447f18083ea4345be9cafcf0a23324eda6db2702f2b580004a7e458e9dc6c12ec