efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

Analysis

max time kernel
190s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Size

524KB
MD5

f2bee96df56e120e5496568a17919a38
SHA1

48177f9e7e03b5c719032eca70164009629906d6
SHA256

efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA512

23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
SSDEEP

6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wfpuagm.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfpuagm.exe

Adds policy Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "jfcungzwsfitvcsunvfb.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "jfcungzwsfitvcsunvfb.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe"	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe"	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe

Executes dropped EXE 3 IoCs

pid	Process
1936	xzsqxqazhjc.exe
1904	wfpuagm.exe
2240	wfpuagm.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	xzsqxqazhjc.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe"	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "jfcungzwsfitvcsunvfb.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "cvpeukaunxxfeivuk.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "yvtmgauspdhtwevysbmjh.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe ."	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	xzsqxqazhjc.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "yvtmgauspdhtwevysbmjh.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "cvpeukaunxxfeivuk.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "jfcungzwsfitvcsunvfb.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "cvpeukaunxxfeivuk.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "wrnewogcxjlvwcrskra.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "vngujyngyhgnloay.exe"	wfpuagm.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "cvpeukaunxxfeivuk.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "wrnewogcxjlvwcrskra.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "vngujyngyhgnloay.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ."	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "yvtmgauspdhtwevysbmjh.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ."	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "cvpeukaunxxfeivuk.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "lfaqhypkepqzzessjp.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "jfcungzwsfitvcsunvfb.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe"	wfpuagm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ."	wfpuagm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe ."	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe"	xzsqxqazhjc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ."	xzsqxqazhjc.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xzsqxqazhjc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
82	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe	wfpuagm.exe
File created	C:\Windows\SysWOW64\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\vngujyngyhgnloay.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\vngujyngyhgnloay.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe	wfpuagm.exe
File created	C:\Windows\SysWOW64\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File opened for modification	C:\Windows\SysWOW64\vngujyngyhgnloay.exe	wfpuagm.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File created	C:\Program Files (x86)\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File opened for modification	C:\Program Files (x86)\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe
File created	C:\Program Files (x86)\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wrnewogcxjlvwcrskra.exe	wfpuagm.exe
File opened for modification	C:\Windows\pnmgbwrqodivziaezjvtsm.exe	wfpuagm.exe
File opened for modification	C:\Windows\cvpeukaunxxfeivuk.exe	wfpuagm.exe
File opened for modification	C:\Windows\pnmgbwrqodivziaezjvtsm.exe	wfpuagm.exe
File opened for modification	C:\Windows\jfcungzwsfitvcsunvfb.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\vngujyngyhgnloay.exe	wfpuagm.exe
File opened for modification	C:\Windows\lfaqhypkepqzzessjp.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\pnmgbwrqodivziaezjvtsm.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\cvpeukaunxxfeivuk.exe	wfpuagm.exe
File opened for modification	C:\Windows\vngujyngyhgnloay.exe	wfpuagm.exe
File opened for modification	C:\Windows\lfaqhypkepqzzessjp.exe	wfpuagm.exe
File opened for modification	C:\Windows\jfcungzwsfitvcsunvfb.exe	wfpuagm.exe
File opened for modification	C:\Windows\vngujyngyhgnloay.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\cvpeukaunxxfeivuk.exe	xzsqxqazhjc.exe
File created	C:\Windows\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File opened for modification	C:\Windows\yvtmgauspdhtwevysbmjh.exe	wfpuagm.exe
File opened for modification	C:\Windows\dhmmnopuytexhwuefvnrwwxy.eid	wfpuagm.exe
File opened for modification	C:\Windows\jfcungzwsfitvcsunvfb.exe	wfpuagm.exe
File opened for modification	C:\Windows\yvtmgauspdhtwevysbmjh.exe	wfpuagm.exe
File created	C:\Windows\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe
File opened for modification	C:\Windows\wrnewogcxjlvwcrskra.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\yvtmgauspdhtwevysbmjh.exe	xzsqxqazhjc.exe
File opened for modification	C:\Windows\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr	wfpuagm.exe
File opened for modification	C:\Windows\lfaqhypkepqzzessjp.exe	wfpuagm.exe
File opened for modification	C:\Windows\wrnewogcxjlvwcrskra.exe	wfpuagm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	wfpuagm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1936	4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	87
PID 4568 wrote to memory of 1936	4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	87
PID 4568 wrote to memory of 1936	4568	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	87
PID 1936 wrote to memory of 1904	1936	xzsqxqazhjc.exe	92
PID 1936 wrote to memory of 1904	1936	xzsqxqazhjc.exe	92
PID 1936 wrote to memory of 1904	1936	xzsqxqazhjc.exe	92
PID 1936 wrote to memory of 2240	1936	xzsqxqazhjc.exe	93
PID 1936 wrote to memory of 2240	1936	xzsqxqazhjc.exe	93
PID 1936 wrote to memory of 2240	1936	xzsqxqazhjc.exe	93

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xzsqxqazhjc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wfpuagm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wfpuagm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xzsqxqazhjc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xzsqxqazhjc.exe

C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
"C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe
  "C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe" "c:\users\admin\appdata\local\temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe
    "C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe" "-C:\Users\Admin\AppData\Local\Temp\vngujyngyhgnloay.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe
    "C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe" "-C:\Users\Admin\AppData\Local\Temp\vngujyngyhgnloay.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvpeukaunxxfeivuk.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfcungzwsfitvcsunvfb.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lfaqhypkepqzzessjp.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnmgbwrqodivziaezjvtsm.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vngujyngyhgnloay.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe

Filesize
712KB

MD5
5342c34f5c1d498489f065dd2033b618

SHA1
15d82d7ca9b522be78c183c18af951920da462ff

SHA256
507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d

SHA512
540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe

Filesize
712KB

MD5
5342c34f5c1d498489f065dd2033b618

SHA1
15d82d7ca9b522be78c183c18af951920da462ff

SHA256
507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d

SHA512
540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe

Filesize
712KB

MD5
5342c34f5c1d498489f065dd2033b618

SHA1
15d82d7ca9b522be78c183c18af951920da462ff

SHA256
507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d

SHA512
540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrnewogcxjlvwcrskra.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe

Filesize
320KB

MD5
7ff2bbb090c7de34a738f85de091e92b

SHA1
aa17661f4a1a5711f273ff363649afdc494af2db

SHA256
d948ab3b584e64e70b2610e6ee6baf6516e645eaa1b1ac8a6204b128ea44c30f

SHA512
aea42492253c684c98209c5d8f2232a3dbc87766301b4ab2422f8fedef412257d620b3b31bff4e5368e2c1902a32d91ee76b443247f1ec04da19ee50f7e0f476

Download Submit
C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe

Filesize
320KB

MD5
7ff2bbb090c7de34a738f85de091e92b

SHA1
aa17661f4a1a5711f273ff363649afdc494af2db

SHA256
d948ab3b584e64e70b2610e6ee6baf6516e645eaa1b1ac8a6204b128ea44c30f

SHA512
aea42492253c684c98209c5d8f2232a3dbc87766301b4ab2422f8fedef412257d620b3b31bff4e5368e2c1902a32d91ee76b443247f1ec04da19ee50f7e0f476

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvtmgauspdhtwevysbmjh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\vngujyngyhgnloay.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\cvpeukaunxxfeivuk.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\cvpeukaunxxfeivuk.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\jfcungzwsfitvcsunvfb.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\jfcungzwsfitvcsunvfb.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\lfaqhypkepqzzessjp.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\lfaqhypkepqzzessjp.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\pnmgbwrqodivziaezjvtsm.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\pnmgbwrqodivziaezjvtsm.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\vngujyngyhgnloay.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\vngujyngyhgnloay.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\wrnewogcxjlvwcrskra.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\wrnewogcxjlvwcrskra.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\yvtmgauspdhtwevysbmjh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\yvtmgauspdhtwevysbmjh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit