9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

Analysis

max time kernel
175s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

496KB
MD5

87aaad0c5b8828cad71e09035e29a567
SHA1

450a37eec021aa9e324d1e93484b8877b88287ec
SHA256

9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd
SHA512

8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682
SSDEEP

12288:ypUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsDX:ypUNr6YkVRFkgbeqeo68FhqyX

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winrdhp.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe

Adds policy Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrjjbxvlogimmcmerrkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "wulbzpjftukkmkygwhf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "vqermzqjusfcbwhm.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "cynbxldxjiwuuqciw.exe"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe"	zhztjppxjrj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "yyrjjbxvlogimmcmerrkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "jiarqhczoqhilkzizlkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgpxnvhvbuc = "yyrjjbxvlogimmcmerrkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lyejwbkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrjjbxvlogimmcmerrkc.exe"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	zhztjppxjrj.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	zhztjppxjrj.exe

Executes dropped EXE 3 IoCs

pid	Process
5056	zhztjppxjrj.exe
2284	winrdhp.exe
2124	winrdhp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoxoxkzgajc = "vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "vqermzqjusfcbwhm.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qkxjdpfxheqmkeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "wulbzpjftukkmkygwhf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qkxjdpfxheqmkeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe"	winrdhp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "liynkzsnaapopmzgvf.exe ."	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe ."	zhztjppxjrj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "yyrjjbxvlogimmcmerrkc.exe ."	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "liynkzsnaapopmzgvf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "wulbzpjftukkmkygwhf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoxoxkzgajc = "vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "vqermzqjusfcbwhm.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "cynbxldxjiwuuqciw.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "jiarqhczoqhilkzizlkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qkxjdpfxheqmkeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "wulbzpjftukkmkygwhf.exe ."	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe ."	zhztjppxjrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoxoxkzgajc = "liynkzsnaapopmzgvf.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "cynbxldxjiwuuqciw.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrjjbxvlogimmcmerrkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "wulbzpjftukkmkygwhf.exe ."	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "liynkzsnaapopmzgvf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "yyrjjbxvlogimmcmerrkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qkxjdpfxheqmkeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "yyrjjbxvlogimmcmerrkc.exe"	zhztjppxjrj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neoxoxkzgajc = "wulbzpjftukkmkygwhf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wulbzpjftukkmkygwhf.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe"	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "yyrjjbxvlogimmcmerrkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrjjbxvlogimmcmerrkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyrjjbxvlogimmcmerrkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vkszovgtyq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cynbxldxjiwuuqciw.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liynkzsnaapopmzgvf.exe ."	zhztjppxjrj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	winrdhp.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	winrdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngsdwhwnwsdyvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiarqhczoqhilkzizlkc.exe ."	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqxdrxhtx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqermzqjusfcbwhm.exe"	winrdhp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mepzrbpfnismi = "yyrjjbxvlogimmcmerrkc.exe ."	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winrdhp.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zhztjppxjrj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winrdhp.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	www.showmyipaddress.com
54	whatismyip.everdot.org
39	whatismyipaddress.com
42	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\liynkzsnaapopmzgvf.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\yyrjjbxvlogimmcmerrkc.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\vqermzqjusfcbwhm.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\liynkzsnaapopmzgvf.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\jiarqhczoqhilkzizlkc.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\yyrjjbxvlogimmcmerrkc.exe	winrdhp.exe
File created	C:\Windows\SysWOW64\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\cynbxldxjiwuuqciw.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\wulbzpjftukkmkygwhf.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\yyrjjbxvlogimmcmerrkc.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\cynbxldxjiwuuqciw.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\liynkzsnaapopmzgvf.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\cynbxldxjiwuuqciw.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\pqkdexutkohkpqhslzauno.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\wulbzpjftukkmkygwhf.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\vqermzqjusfcbwhm.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\jiarqhczoqhilkzizlkc.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\pqkdexutkohkpqhslzauno.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\SysWOW64\vqermzqjusfcbwhm.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\wulbzpjftukkmkygwhf.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\jiarqhczoqhilkzizlkc.exe	winrdhp.exe
File created	C:\Windows\SysWOW64\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\pqkdexutkohkpqhslzauno.exe	winrdhp.exe
File opened for modification	C:\Windows\SysWOW64\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe
File created	C:\Program Files (x86)\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe
File opened for modification	C:\Program Files (x86)\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe
File created	C:\Program Files (x86)\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\cynbxldxjiwuuqciw.exe	winrdhp.exe
File opened for modification	C:\Windows\yyrjjbxvlogimmcmerrkc.exe	winrdhp.exe
File opened for modification	C:\Windows\pqkdexutkohkpqhslzauno.exe	winrdhp.exe
File opened for modification	C:\Windows\vqermzqjusfcbwhm.exe	winrdhp.exe
File opened for modification	C:\Windows\jiarqhczoqhilkzizlkc.exe	winrdhp.exe
File opened for modification	C:\Windows\yyrjjbxvlogimmcmerrkc.exe	winrdhp.exe
File opened for modification	C:\Windows\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe
File opened for modification	C:\Windows\vqermzqjusfcbwhm.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\pqkdexutkohkpqhslzauno.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\liynkzsnaapopmzgvf.exe	winrdhp.exe
File opened for modification	C:\Windows\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe
File created	C:\Windows\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp	winrdhp.exe
File opened for modification	C:\Windows\pqkdexutkohkpqhslzauno.exe	winrdhp.exe
File opened for modification	C:\Windows\cynbxldxjiwuuqciw.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\liynkzsnaapopmzgvf.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\wulbzpjftukkmkygwhf.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\vqermzqjusfcbwhm.exe	winrdhp.exe
File opened for modification	C:\Windows\wulbzpjftukkmkygwhf.exe	winrdhp.exe
File opened for modification	C:\Windows\cynbxldxjiwuuqciw.exe	winrdhp.exe
File opened for modification	C:\Windows\liynkzsnaapopmzgvf.exe	winrdhp.exe
File opened for modification	C:\Windows\jiarqhczoqhilkzizlkc.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\yyrjjbxvlogimmcmerrkc.exe	zhztjppxjrj.exe
File opened for modification	C:\Windows\jiarqhczoqhilkzizlkc.exe	winrdhp.exe
File opened for modification	C:\Windows\wulbzpjftukkmkygwhf.exe	winrdhp.exe
File created	C:\Windows\agfdjhjnjsqyiokayrxwuay.eaj	winrdhp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe
1964	1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	winrdhp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5056	1964	1.exe	80
PID 1964 wrote to memory of 5056	1964	1.exe	80
PID 1964 wrote to memory of 5056	1964	1.exe	80
PID 5056 wrote to memory of 2284	5056	zhztjppxjrj.exe	81
PID 5056 wrote to memory of 2284	5056	zhztjppxjrj.exe	81
PID 5056 wrote to memory of 2284	5056	zhztjppxjrj.exe	81
PID 5056 wrote to memory of 2124	5056	zhztjppxjrj.exe	82
PID 5056 wrote to memory of 2124	5056	zhztjppxjrj.exe	82
PID 5056 wrote to memory of 2124	5056	zhztjppxjrj.exe	82

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winrdhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	zhztjppxjrj.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	zhztjppxjrj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winrdhp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winrdhp.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\zhztjppxjrj.exe
  "C:\Users\Admin\AppData\Local\Temp\zhztjppxjrj.exe" "c:\users\admin\appdata\local\temp\1.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5056
- - C:\Users\Admin\AppData\Local\Temp\winrdhp.exe
    "C:\Users\Admin\AppData\Local\Temp\winrdhp.exe" "-C:\Users\Admin\AppData\Local\Temp\vqermzqjusfcbwhm.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\winrdhp.exe
    "C:\Users\Admin\AppData\Local\Temp\winrdhp.exe" "-C:\Users\Admin\AppData\Local\Temp\vqermzqjusfcbwhm.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\agfdjhjnjsqyiokayrxwuay.eaj

Filesize
280B

MD5
39c191152e24126185c9eebdfe9def08

SHA1
2f9c9e775476fe175b7198087b7306d64016de1e

SHA256
3faef9d3aa61a2b423c3ef141b50241e88e352f7d33ae054186b84052c8d5c8f

SHA512
18511f13802bb4e39759bf63898f7a654df753fa07288ba5546130792e256884848c745ab5d70c40c7093fa1e9b14262ae143e356fa24b7ed476ce1bcf6d9f7c

Download Submit
C:\Program Files (x86)\agfdjhjnjsqyiokayrxwuay.eaj

Filesize
280B

MD5
0ce6d5d3751ef75c1b6f04f07c127fd1

SHA1
cf84adef81504f958c1b2c3ebc38216889f9b104

SHA256
f5a2b610bee5afc0a0f3ace3c75d3a2828322853fc4fb3266aa8b43df9e4a4c2

SHA512
0d3346de39e1ff0de74d912435531e9da0a43cba929b3bc4e95eb27a83deca2b18396b7271331c0326e732c10a9c49425d1507e4d21fce4aba681ae09ad0fa1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cynbxldxjiwuuqciw.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\jiarqhczoqhilkzizlkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\liynkzsnaapopmzgvf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\pqkdexutkohkpqhslzauno.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\vqermzqjusfcbwhm.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrdhp.exe

Filesize
720KB

MD5
b7d264f433e3f52b686f335fd59801aa

SHA1
4cc2d0a96fcb8f7e175c55ed39a4ccd809762bbd

SHA256
c27819574885a68ce4df68aec32b2cf9ce2df10399bd5a0ca1f295655c3d044f

SHA512
fd0187aee181d794191783a30825f6635f3cc6d579d5fe8ad164e6b1c8d69622a96629375e5baa9659ae9b5d7791388651cb574649512137f3d458c4dc9d9d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrdhp.exe

Filesize
720KB

MD5
b7d264f433e3f52b686f335fd59801aa

SHA1
4cc2d0a96fcb8f7e175c55ed39a4ccd809762bbd

SHA256
c27819574885a68ce4df68aec32b2cf9ce2df10399bd5a0ca1f295655c3d044f

SHA512
fd0187aee181d794191783a30825f6635f3cc6d579d5fe8ad164e6b1c8d69622a96629375e5baa9659ae9b5d7791388651cb574649512137f3d458c4dc9d9d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrdhp.exe

Filesize
720KB

MD5
b7d264f433e3f52b686f335fd59801aa

SHA1
4cc2d0a96fcb8f7e175c55ed39a4ccd809762bbd

SHA256
c27819574885a68ce4df68aec32b2cf9ce2df10399bd5a0ca1f295655c3d044f

SHA512
fd0187aee181d794191783a30825f6635f3cc6d579d5fe8ad164e6b1c8d69622a96629375e5baa9659ae9b5d7791388651cb574649512137f3d458c4dc9d9d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrdhp.exe

Filesize
720KB

MD5
b7d264f433e3f52b686f335fd59801aa

SHA1
4cc2d0a96fcb8f7e175c55ed39a4ccd809762bbd

SHA256
c27819574885a68ce4df68aec32b2cf9ce2df10399bd5a0ca1f295655c3d044f

SHA512
fd0187aee181d794191783a30825f6635f3cc6d579d5fe8ad164e6b1c8d69622a96629375e5baa9659ae9b5d7791388651cb574649512137f3d458c4dc9d9d75

Download Submit
C:\Users\Admin\AppData\Local\Temp\wulbzpjftukkmkygwhf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyrjjbxvlogimmcmerrkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhztjppxjrj.exe

Filesize
320KB

MD5
c97e506a3fa236f8831d3f155c85b751

SHA1
dad9aa510bf85abe6fd986f2cb00475d8de9d25d

SHA256
8445b9b7fa382dc899edb5907c3878b0d0ecfd52bd000ff83e072d254fff7359

SHA512
cacf798d1c699d40e66b6d3c6a462cf812c80a671cbb6a49091cb94ec2f54f08c251b25b4b2523eef2e91d8c109ce4d3db76cbfce4c5b5ce9e2bd64c977d6def

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhztjppxjrj.exe

Filesize
320KB

MD5
c97e506a3fa236f8831d3f155c85b751

SHA1
dad9aa510bf85abe6fd986f2cb00475d8de9d25d

SHA256
8445b9b7fa382dc899edb5907c3878b0d0ecfd52bd000ff83e072d254fff7359

SHA512
cacf798d1c699d40e66b6d3c6a462cf812c80a671cbb6a49091cb94ec2f54f08c251b25b4b2523eef2e91d8c109ce4d3db76cbfce4c5b5ce9e2bd64c977d6def

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhztjppxjrj.exe

Filesize
320KB

MD5
c97e506a3fa236f8831d3f155c85b751

SHA1
dad9aa510bf85abe6fd986f2cb00475d8de9d25d

SHA256
8445b9b7fa382dc899edb5907c3878b0d0ecfd52bd000ff83e072d254fff7359

SHA512
cacf798d1c699d40e66b6d3c6a462cf812c80a671cbb6a49091cb94ec2f54f08c251b25b4b2523eef2e91d8c109ce4d3db76cbfce4c5b5ce9e2bd64c977d6def

Download Submit
C:\Users\Admin\AppData\Local\agfdjhjnjsqyiokayrxwuay.eaj

Filesize
280B

MD5
c6cc3ab711db4d051369481838dcd28e

SHA1
9136740d6c5a4e207e10cc5ced030298edfa6b3a

SHA256
c0b5d2c2125c2bff4dedfa0b06d2db42072dc0a081aad433eb637f73878a6c93

SHA512
bf3c78fd65fd474d268a27400cd2ed8e37ee857daa307a8e949e2779e1bb38ca2363fe10278ca8ae63b6032d63c1ba714e9f96b29037850a0ddbe414dafd41cc

Download Submit
C:\Users\Admin\AppData\Local\neoxoxkzgajcxovwfjaktktgvcwfytkrsb.wgp

Filesize
4KB

MD5
0f417b0389888a2610cfc2245138e113

SHA1
51d9fcd55bd94c7872fadf425013fa9aa785591b

SHA256
3d53cf625962d6a2cbc9dffe685463c4f6c048d3feab451548e64e3863df1e55

SHA512
d0fe1f0e9435a9113c66f4dc1b61079237f255f41e51ccb315e71cdada5755b70b161811181fdd9c7fac93726943e977f7d487e94978908e061a560a12f58572

Download Submit
C:\Windows\SysWOW64\cynbxldxjiwuuqciw.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\jiarqhczoqhilkzizlkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\liynkzsnaapopmzgvf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\liynkzsnaapopmzgvf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\pqkdexutkohkpqhslzauno.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\vqermzqjusfcbwhm.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\wulbzpjftukkmkygwhf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\SysWOW64\yyrjjbxvlogimmcmerrkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\cynbxldxjiwuuqciw.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\cynbxldxjiwuuqciw.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\jiarqhczoqhilkzizlkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\jiarqhczoqhilkzizlkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\liynkzsnaapopmzgvf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\liynkzsnaapopmzgvf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\pqkdexutkohkpqhslzauno.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\pqkdexutkohkpqhslzauno.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\vqermzqjusfcbwhm.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\vqermzqjusfcbwhm.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\wulbzpjftukkmkygwhf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\wulbzpjftukkmkygwhf.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\yyrjjbxvlogimmcmerrkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit
C:\Windows\yyrjjbxvlogimmcmerrkc.exe

Filesize
496KB

MD5
87aaad0c5b8828cad71e09035e29a567

SHA1
450a37eec021aa9e324d1e93484b8877b88287ec

SHA256
9fcb44630b5a502ee3c94751c6736eebc11dbd9268d6c686addabc3e2c5e6acd

SHA512
8c99f3196f6a33d32570b01abfff2b7cd94f072a5be53cc00e95e97da34f0efc30147d5ce1c905277a8cb17f307e9d1dfb151ea28145bfbdbf4f53867c107682

Download Submit