Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Resource
win10v2004-20221111-en
General
-
Target
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
-
Size
524KB
-
MD5
f2bee96df56e120e5496568a17919a38
-
SHA1
48177f9e7e03b5c719032eca70164009629906d6
-
SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
-
SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
SSDEEP
6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lsxbfk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lsxbfk.exe -
Adds policy Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "yskbskmcypywzfydxjd.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "lgzrjcfwtlvuyfzfanib.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "xodrfutgzntoorhj.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ngxnduvkfvdachzdwh.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ngxnduvkfvdachzdwh.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ewmbqgguodkghlcfx.exe" lsxbfk.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe -
Executes dropped EXE 3 IoCs
pid Process 292 uvlgepmyefv.exe 468 lsxbfk.exe 1712 lsxbfk.exe -
Loads dropped DLL 6 IoCs
pid Process 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 292 uvlgepmyefv.exe 292 uvlgepmyefv.exe 292 uvlgepmyefv.exe 292 uvlgepmyefv.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "xodrfutgzntoorhj.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "yskbskmcypywzfydxjd.exe ." uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "lgzrjcfwtlvuyfzfanib.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "lgzrjcfwtlvuyfzfanib.exe ." lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "awqjcwasqjuuzhcjftpjc.exe" lsxbfk.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "ngxnduvkfvdachzdwh.exe ." lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ." lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "awqjcwasqjuuzhcjftpjc.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "xodrfutgzntoorhj.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "xodrfutgzntoorhj.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "lgzrjcfwtlvuyfzfanib.exe ." lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "ngxnduvkfvdachzdwh.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe ." lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "xodrfutgzntoorhj.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "lgzrjcfwtlvuyfzfanib.exe" uvlgepmyefv.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "yskbskmcypywzfydxjd.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "xodrfutgzntoorhj.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe" lsxbfk.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe" lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "yskbskmcypywzfydxjd.exe" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe" uvlgepmyefv.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "lgzrjcfwtlvuyfzfanib.exe" lsxbfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe" lsxbfk.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "awqjcwasqjuuzhcjftpjc.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "awqjcwasqjuuzhcjftpjc.exe ." lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce lsxbfk.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run lsxbfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "awqjcwasqjuuzhcjftpjc.exe" lsxbfk.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 www.showmyipaddress.com 5 whatismyipaddress.com 2 whatismyip.everdot.org -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe File opened for modification C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\xodrfutgzntoorhj.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\xodrfutgzntoorhj.exe uvlgepmyefv.exe File created C:\Windows\SysWOW64\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe File opened for modification C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe lsxbfk.exe File created C:\Windows\SysWOW64\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe File opened for modification C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\xodrfutgzntoorhj.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe lsxbfk.exe File opened for modification C:\Windows\SysWOW64\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe File opened for modification C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe uvlgepmyefv.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe File created C:\Program Files (x86)\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe File opened for modification C:\Program Files (x86)\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe File created C:\Program Files (x86)\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\xodrfutgzntoorhj.exe lsxbfk.exe File opened for modification C:\Windows\ngxnduvkfvdachzdwh.exe lsxbfk.exe File opened for modification C:\Windows\yskbskmcypywzfydxjd.exe lsxbfk.exe File opened for modification C:\Windows\rojdxsxqpjvwclhpmbytnh.exe lsxbfk.exe File opened for modification C:\Windows\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe File opened for modification C:\Windows\ngxnduvkfvdachzdwh.exe uvlgepmyefv.exe File opened for modification C:\Windows\awqjcwasqjuuzhcjftpjc.exe uvlgepmyefv.exe File opened for modification C:\Windows\ewmbqgguodkghlcfx.exe lsxbfk.exe File opened for modification C:\Windows\yskbskmcypywzfydxjd.exe lsxbfk.exe File opened for modification C:\Windows\lgzrjcfwtlvuyfzfanib.exe lsxbfk.exe File opened for modification C:\Windows\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe File opened for modification C:\Windows\lgzrjcfwtlvuyfzfanib.exe uvlgepmyefv.exe File opened for modification C:\Windows\rojdxsxqpjvwclhpmbytnh.exe uvlgepmyefv.exe File opened for modification C:\Windows\xodrfutgzntoorhj.exe lsxbfk.exe File opened for modification C:\Windows\ngxnduvkfvdachzdwh.exe lsxbfk.exe File opened for modification C:\Windows\ewmbqgguodkghlcfx.exe lsxbfk.exe File opened for modification C:\Windows\awqjcwasqjuuzhcjftpjc.exe lsxbfk.exe File opened for modification C:\Windows\awqjcwasqjuuzhcjftpjc.exe lsxbfk.exe File created C:\Windows\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may lsxbfk.exe File opened for modification C:\Windows\xodrfutgzntoorhj.exe uvlgepmyefv.exe File opened for modification C:\Windows\ewmbqgguodkghlcfx.exe uvlgepmyefv.exe File opened for modification C:\Windows\yskbskmcypywzfydxjd.exe uvlgepmyefv.exe File opened for modification C:\Windows\lgzrjcfwtlvuyfzfanib.exe lsxbfk.exe File opened for modification C:\Windows\rojdxsxqpjvwclhpmbytnh.exe lsxbfk.exe File created C:\Windows\rwzbdgtubdxgulpfkhmprtwjkr.nwk lsxbfk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1712 lsxbfk.exe 1712 lsxbfk.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1712 lsxbfk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1060 wrote to memory of 292 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 28 PID 1060 wrote to memory of 292 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 28 PID 1060 wrote to memory of 292 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 28 PID 1060 wrote to memory of 292 1060 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 28 PID 292 wrote to memory of 468 292 uvlgepmyefv.exe 29 PID 292 wrote to memory of 468 292 uvlgepmyefv.exe 29 PID 292 wrote to memory of 468 292 uvlgepmyefv.exe 29 PID 292 wrote to memory of 468 292 uvlgepmyefv.exe 29 PID 292 wrote to memory of 1712 292 uvlgepmyefv.exe 30 PID 292 wrote to memory of 1712 292 uvlgepmyefv.exe 30 PID 292 wrote to memory of 1712 292 uvlgepmyefv.exe 30 PID 292 wrote to memory of 1712 292 uvlgepmyefv.exe 30 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" lsxbfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" lsxbfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lsxbfk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe"C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe" "c:\users\admin\appdata\local\temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:292 -
C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe"C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xodrfutgzntoorhj.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:468
-
-
C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe"C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xodrfutgzntoorhj.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1712
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
320KB
MD57898a21395faefe6a4673158dbaa9339
SHA19877ceaff6e0da570bc143816023cf5307ee9d41
SHA256ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3
SHA51277c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92
-
Filesize
320KB
MD57898a21395faefe6a4673158dbaa9339
SHA19877ceaff6e0da570bc143816023cf5307ee9d41
SHA256ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3
SHA51277c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
700KB
MD5fb2658e072747d7abf701daaad8b8817
SHA10471c81afbfc737c1946c0ea20050311a4b9d3ff
SHA256b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a
SHA5128a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6
-
Filesize
320KB
MD57898a21395faefe6a4673158dbaa9339
SHA19877ceaff6e0da570bc143816023cf5307ee9d41
SHA256ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3
SHA51277c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92
-
Filesize
320KB
MD57898a21395faefe6a4673158dbaa9339
SHA19877ceaff6e0da570bc143816023cf5307ee9d41
SHA256ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3
SHA51277c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92