Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 07:25
Static task
static1
Behavioral task
behavioral1
Sample
969b2dabe6080bc2da7236a0d455ced7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
969b2dabe6080bc2da7236a0d455ced7.exe
Resource
win10v2004-20231215-en
General
-
Target
969b2dabe6080bc2da7236a0d455ced7.exe
-
Size
480KB
-
MD5
969b2dabe6080bc2da7236a0d455ced7
-
SHA1
f2b4c9c70bbb5e11ec823846ad88a20c235775cd
-
SHA256
4e7ae8c1b57d2178d7014c18b11a0d9ff1444f07d513ea8fdfa5af7a11f02873
-
SHA512
1218dab072f3144304196c98f1b3c0494448929b8e6be35d5db88ef3dee0d0c12191f8cf3c94d8287195cde1af9a2a910a230d2e96f987e196e34ba00ae247c0
-
SSDEEP
6144:Kjg5pk1GS0xX3lPtbNN/DNRgkpiZzjhDQ0oeGF91YVusYJx+9sisyYpFTOOzHTvP:Kg5pBHxXptbN5ZRgOiBjw/C0AWzFjPvP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" sfquntntcpa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sfquntntcpa.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "livldzvfwslfxiivwj.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "jixpjhfrkidztgixapfe.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" sfquntntcpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "cykzqlgpfaslcmlxx.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe" wikpwhs.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sfquntntcpa.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe -
Executes dropped EXE 4 IoCs
pid Process 2304 sfquntntcpa.exe 2480 wikpwhs.exe 2984 wikpwhs.exe 2228 sfquntntcpa.exe -
Loads dropped DLL 8 IoCs
pid Process 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2304 sfquntntcpa.exe 2304 sfquntntcpa.exe 2304 sfquntntcpa.exe 2304 sfquntntcpa.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "vqbpfztbqkbtjsqb.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "yyohcbanhgczuilbfvmmc.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "vqbpfztbqkbtjsqb.exe" sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "jixpjhfrkidztgixapfe.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "jixpjhfrkidztgixapfe.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "livldzvfwslfxiivwj.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "cykzqlgpfaslcmlxx.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "cykzqlgpfaslcmlxx.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "vqbpfztbqkbtjsqb.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "livldzvfwslfxiivwj.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "wuizspmxpmgbughvxla.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "wuizspmxpmgbughvxla.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "yyohcbanhgczuilbfvmmc.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "yyohcbanhgczuilbfvmmc.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "cykzqlgpfaslcmlxx.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe" sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "wuizspmxpmgbughvxla.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe" sfquntntcpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe ." wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "livldzvfwslfxiivwj.exe ." wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ." sfquntntcpa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe" wikpwhs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe" wikpwhs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "jixpjhfrkidztgixapfe.exe ." wikpwhs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wikpwhs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyipaddress.com 5 www.showmyipaddress.com 10 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf wikpwhs.exe File opened for modification F:\autorun.inf wikpwhs.exe File created F:\autorun.inf wikpwhs.exe File opened for modification C:\autorun.inf wikpwhs.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe wikpwhs.exe File created C:\Windows\SysWOW64\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe File opened for modification C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File opened for modification C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe wikpwhs.exe File created C:\Windows\SysWOW64\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File opened for modification C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe sfquntntcpa.exe File opened for modification C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe wikpwhs.exe File opened for modification C:\Windows\SysWOW64\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe File opened for modification C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe sfquntntcpa.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File created C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File opened for modification C:\Program Files (x86)\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe File created C:\Program Files (x86)\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\livldzvfwslfxiivwj.exe wikpwhs.exe File opened for modification C:\Windows\jixpjhfrkidztgixapfe.exe wikpwhs.exe File opened for modification C:\Windows\vqbpfztbqkbtjsqb.exe wikpwhs.exe File opened for modification C:\Windows\livldzvfwslfxiivwj.exe wikpwhs.exe File opened for modification C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe wikpwhs.exe File created C:\Windows\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe File opened for modification C:\Windows\wuizspmxpmgbughvxla.exe sfquntntcpa.exe File opened for modification C:\Windows\cykzqlgpfaslcmlxx.exe wikpwhs.exe File opened for modification C:\Windows\livldzvfwslfxiivwj.exe sfquntntcpa.exe File opened for modification C:\Windows\vqbpfztbqkbtjsqb.exe sfquntntcpa.exe File opened for modification C:\Windows\jixpjhfrkidztgixapfe.exe wikpwhs.exe File opened for modification C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe wikpwhs.exe File opened for modification C:\Windows\wuizspmxpmgbughvxla.exe wikpwhs.exe File opened for modification C:\Windows\cykzqlgpfaslcmlxx.exe sfquntntcpa.exe File opened for modification C:\Windows\jixpjhfrkidztgixapfe.exe sfquntntcpa.exe File opened for modification C:\Windows\yyohcbanhgczuilbfvmmc.exe wikpwhs.exe File created C:\Windows\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File opened for modification C:\Windows\vqbpfztbqkbtjsqb.exe sfquntntcpa.exe File opened for modification C:\Windows\yyohcbanhgczuilbfvmmc.exe sfquntntcpa.exe File opened for modification C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe sfquntntcpa.exe File opened for modification C:\Windows\yyohcbanhgczuilbfvmmc.exe sfquntntcpa.exe File opened for modification C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe sfquntntcpa.exe File opened for modification C:\Windows\yyohcbanhgczuilbfvmmc.exe wikpwhs.exe File opened for modification C:\Windows\wuizspmxpmgbughvxla.exe sfquntntcpa.exe File opened for modification C:\Windows\vqbpfztbqkbtjsqb.exe wikpwhs.exe File opened for modification C:\Windows\wuizspmxpmgbughvxla.exe wikpwhs.exe File opened for modification C:\Windows\livldzvfwslfxiivwj.exe sfquntntcpa.exe File opened for modification C:\Windows\jixpjhfrkidztgixapfe.exe sfquntntcpa.exe File opened for modification C:\Windows\cykzqlgpfaslcmlxx.exe wikpwhs.exe File opened for modification C:\Windows\yiilqzifjsyfkivvjjkuuxclurv.krw wikpwhs.exe File opened for modification C:\Windows\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd wikpwhs.exe File opened for modification C:\Windows\cykzqlgpfaslcmlxx.exe sfquntntcpa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe 2480 wikpwhs.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 1888 969b2dabe6080bc2da7236a0d455ced7.exe 2480 wikpwhs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2480 wikpwhs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2304 1888 969b2dabe6080bc2da7236a0d455ced7.exe 28 PID 1888 wrote to memory of 2304 1888 969b2dabe6080bc2da7236a0d455ced7.exe 28 PID 1888 wrote to memory of 2304 1888 969b2dabe6080bc2da7236a0d455ced7.exe 28 PID 1888 wrote to memory of 2304 1888 969b2dabe6080bc2da7236a0d455ced7.exe 28 PID 2304 wrote to memory of 2480 2304 sfquntntcpa.exe 29 PID 2304 wrote to memory of 2480 2304 sfquntntcpa.exe 29 PID 2304 wrote to memory of 2480 2304 sfquntntcpa.exe 29 PID 2304 wrote to memory of 2480 2304 sfquntntcpa.exe 29 PID 2304 wrote to memory of 2984 2304 sfquntntcpa.exe 30 PID 2304 wrote to memory of 2984 2304 sfquntntcpa.exe 30 PID 2304 wrote to memory of 2984 2304 sfquntntcpa.exe 30 PID 2304 wrote to memory of 2984 2304 sfquntntcpa.exe 30 PID 1888 wrote to memory of 2228 1888 969b2dabe6080bc2da7236a0d455ced7.exe 33 PID 1888 wrote to memory of 2228 1888 969b2dabe6080bc2da7236a0d455ced7.exe 33 PID 1888 wrote to memory of 2228 1888 969b2dabe6080bc2da7236a0d455ced7.exe 33 PID 1888 wrote to memory of 2228 1888 969b2dabe6080bc2da7236a0d455ced7.exe 33 -
System policy modification 1 TTPs 41 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" sfquntntcpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer sfquntntcpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" sfquntntcpa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" sfquntntcpa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wikpwhs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wikpwhs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wikpwhs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\969b2dabe6080bc2da7236a0d455ced7.exe"C:\Users\Admin\AppData\Local\Temp\969b2dabe6080bc2da7236a0d455ced7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe"C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe" "c:\users\admin\appdata\local\temp\969b2dabe6080bc2da7236a0d455ced7.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe"C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe" "-C:\Users\Admin\AppData\Local\Temp\vqbpfztbqkbtjsqb.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2480
-
-
C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe"C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe" "-C:\Users\Admin\AppData\Local\Temp\vqbpfztbqkbtjsqb.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2984
-
-
-
C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe"C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe" "c:\users\admin\appdata\local\temp\969b2dabe6080bc2da7236a0d455ced7.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2228
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD588e95deb352716a77cb004b8661c42bf
SHA1972076260781a3d1b482f6a4f7a3f1a53c39820b
SHA256be8c0dfea498fcda87875a10bce6392cc99d759935833e86d847d71101806bc3
SHA512fc1d6808d4c6184302e7e0123526f9ad602649c450873a46c88e8bbc3a33b826c31c5a2af982f8a45848bba76b61c90ab3f615f033cc7a8f88b145373cfa71c1
-
Filesize
272B
MD5f01fb83579d90b04fea75deae84dd37c
SHA1730ba2dd37f4edf5476c833776e9224dc367fa9c
SHA256222e911ed3f8b219a885f582036113fa0e1db2a7da83dca8c6015dd30947c400
SHA51299396df384e1cad5603ab9d273d0bd49ed25609d3a6906051aa4f5ff24f6b2005945062fac1466ba28f4caa43655e8082ef1d5feb6b18cd99218626deeb12584
-
Filesize
272B
MD51482c2661f766237cc0fe603ff3beafe
SHA1cd23542f8e6c4a47ec5157f5b5064973ec7146c1
SHA2565b2fb2ffd361382da93ea34c38d8ff42825c7c2e0b0aae37a343b6911b3573f7
SHA512fb31b6436026dc58dac03e6af44ceb0f0fb25f8fa06a70d417ea1ef9465f1cd11600d6c49047a2c59938f3a08c7e737999314ae178a4a37a069cdce79b58ce61
-
Filesize
272B
MD5416ef557127a9d3379ae051818776d77
SHA1985834526a062a166e6cd342e0a494a6ecf3d86c
SHA25683645c903dc694d820596be1311b555a684ebd8e043cb5fd29e9204dd1318450
SHA512fbdf730b43dbe4781defc479f6dbe99820a8a78bfe4f6fdf1786a3ccdd78deb0b5e9be6569ecca1651b1c1a2a87eb7d1af35efbe72059972e3ad707d6fdd0f57
-
Filesize
272B
MD539f73dd0e2e30750f01ad0c1ae1e9f8c
SHA1e476ff9cfe52b135349158153d6891918111ad53
SHA2569d100a0691591377559dc086ef2e8927117bed953cc24ddcd34f77e383ec657c
SHA5126635c001f0aaabf8126080119cd0eb02ac5478875516e919a03fdbfd3f11f1abbe3ed0c34f64258001e6d38f5b45e94ea985abffc7ded8ce540a7a4ef9618cfa
-
Filesize
272B
MD5e4b9ca30ca046c5acf044f3f1e006d31
SHA1822dd572b5280d32c52f4a835527a94da8c5037e
SHA25653e8eebc71398700c7f6826100879c21b9bb7a2c335836a3edf55aebfed68168
SHA512ad40b24bb59fb7b68eb5fd7b558dfa83b793b1fb6c443772a0b9703888e32ac37e89862b6298e1ed57e0ef35fbf4151efe8eeb464a8e7f117fdeb61c8a7637ee
-
Filesize
272B
MD55fddeba64824012580166fb06062fbd0
SHA1e64d496dacbcec5341cb89c02b1d59d311e85262
SHA256090d395e7b0cdd4fb10fc872b265e077b272fe36f61ae5d5980cb48585bc846e
SHA51255d96558e7107c7b4f6a6caacbc0da3d25fc646db6f7e6f1b9cda4951954c69ba22f130999354ffa8debd4dc302e855f21e381dd699c0ff6067e1e8a8778becb
-
Filesize
410KB
MD58bad2c9e93133d9864b1835c09a9f442
SHA12ccc3f838e8be9fb606a2ad0b08b7c2b1604d073
SHA256525a8a930abf265959ab6e38e950c7b98e2505ef282ee4eeeef96ed3f9c82146
SHA5123274c416e905dbda5875000a34908b7727ba921cece1f686b7668fc1916cea4da03a73d01c0a4128ac45f30bac83b380915c8c58700e35e3d2e9031660d20d5a
-
Filesize
42KB
MD57b8efa63afdb5483675dc41fe2ac59f6
SHA10c3edc842be180252e68ea09b9c1373ce5465123
SHA256acd56748e386d3763b269627cf0b882553e40cfc6a8e7528868adf94ab3bc2f1
SHA512ab6da90c2a78d818ca133a23b9e9492d84222d3e9a32fa4dc681c55b82e4afe321e1f600769c661759bbb008c2c68bf6c662d06fded1d32683be10c0f6ef42f3
-
Filesize
328KB
MD5dede4c492515a8ac29d511a8ada60bd1
SHA1f91059064a640821a00764b12f2636aace10c135
SHA2567d0e1602b881bd52a67e2de8e3206b5591a3cd7359b2e30c609a0e219b466676
SHA5129cadd0ab2c1d2dbf6cdfafa0c6ee717549fbad3b7b4b982a6462bb3c17dfc3a37a2d9c5ef8699bb4f91bf8d1e0edb4cc014636a5a8d6d164d3741ca8fd096e7d
-
Filesize
20KB
MD5609308a5798687be9d4e9750b8f607b3
SHA193e08711f028b41f88b38127d087d559c099fa11
SHA25645fcb6f701537ef431cbaba5d57bb20a3fcb4749bd0fa0da4630844c55f6adb2
SHA512a0e1908444b1de300b89dcc42be3dee6127ec7c8bf1d4096593f1fb7d09a3c41a4fbd7164ae81fa28f32e0edb48316d95a6a43dba660c2ae80ae8e5f9e639890
-
Filesize
320KB
MD5eb09c682903ecbd87f30b0366e008d8f
SHA159b0dc27c06ce536327490439a37751a3dbd5e38
SHA256c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1
SHA51283236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d
-
Filesize
128KB
MD51cf9d96d6c581bbe47581e9289753135
SHA12ca86cfc45fcda94aee325f745435a8e94de6e86
SHA2569a978fafb39adab06f7fbd5353bd79d307e2a857fa26ff4aea4d22e2e96fb148
SHA5129029f01eacba27525ac46e99d52f943243bfe225174f1cddf81dff3f61726e46d7bc7b52e77a99f6c2555c9fe1203188bc95aac1a097c82a6367e58be940c545
-
Filesize
466KB
MD5d8cc670403f6a65406116cb9b1855b7a
SHA102dc24e003e710272226313809b7eff3ed415869
SHA2564f12f035ca279e0b0b57518f6a76d3513530a4b0023565fac92d82b135200fc8
SHA51203f35067bdf900498b53bf482f3306f044e39f19cad9324e439424528f3a0c1af698ea40d2f0ea850ff1fde2b14019822bdb7f5421f2f5ee33eed740da1e98f4
-
Filesize
522KB
MD5561409fbb793c5199cbbd169fba1d5b0
SHA1a7732333ad414d78b11e419ded7c20903cf61068
SHA2561ed0528a9a720ec3f0c5f725be8411c3013b03e44d121d1ea45f05087a24a360
SHA5128bcc83fdc5bac4eb9108cbb33604f3b8f72c3ee4736120282c159ed702b8dd56c57c7b4156067e36665eddec5813bb2efa28f45aa4b1de9257c3e4fb7bfd646a
-
Filesize
454KB
MD5f75fee83240d2eed8bfb1ff90726a428
SHA15d68ff832bd7deb045b73e7cad2b405e5ee6754a
SHA256e361a9e2cbcb906885fa3236fe9844a1695c21f28c77e5b790c407b971dffabb
SHA51283b7236a629815a5a50f90e7829d6d49c235f2700d99aad08539ede97a69bf4cf5ac3ef5e5ac117499f1881877369d18027dd5954de45aa60f00e863ed241044
-
Filesize
401KB
MD59793998e0611c872f6c3a7b404e540aa
SHA117c29a515ab75feeadbc152b61a9c748ff01d675
SHA256f4df167c6f4900f025b08d4cd2e4784b78ecadd5d184cdfe1df1b3dc5e6bd0d6
SHA51260001b8f901865e3f37ceb48d0cfbdaf361a88773461b867726a81f87a764fa8f9c6b2876f1bdc203315c6c6693722fff69414955b98f4f425a704b718a4786e
-
Filesize
15KB
MD5c2121a56e2eeaa704de0e89452757cde
SHA1135998abdfe06eea251b7d943c05f13d1f15653b
SHA256e2b0f721dc1a646f0164e4a1c37bec6afc1080ae39938022a703e7fb0b3124c7
SHA512034c7b0571bd64add92c88b2ffde6d7199207ea3537eae28c2f1e778011560f436726dfcb7cd838f500367672e37b8a8fde952223e361357f86790b17c88d0f0
-
Filesize
7KB
MD57df156943beffecec0d75a7c70822246
SHA1486372e2ae5845576324c0005a5f99bd115677d0
SHA25615eb45ec3b7aab3ee2ffff1db5d3a73d6e9c016dfda357e09d7a9e88e598a7c0
SHA51267d0481c52056775bcb999cfbdd8647596991f6cd1e7ed6258213b6eed56f352916a5a5d002bfb8b7e3eae7fd4cd5769cc9a3163e2e853a60602f31fa7ef2a14
-
Filesize
3KB
MD59ad099608f651d5598e0134e524f8676
SHA1a7fb07e905973405e31351aa1062a07b0b5cd418
SHA256186f05092e3cdd02a986bce78f51c038fcc6a70d224552e336fa95dce7c84403
SHA51270f2def761743473fb1e4e47154868238e761cc6f9f8d50c7c149023969c02cf3969cdf63bdb0a240d3571cc75a20d8389d39bc2ae22aafaedc6a8ea0f20cf1c
-
Filesize
272B
MD5b481e850829ed692d913ec8406cece07
SHA10b15b59fe32504eb065312934a90b40e5caefd76
SHA2564e27ca3da1642da6f526c40954dcec7956e2778425ce5fbb3246ca62f4441018
SHA512d272ebca2337e49de43a56fd9d70884321b108dd463562da5638ecb4c12e3b87f681572552cfb1a48a33f9a6dcb13c4ef82ac0e8039e4ac3c4cbb874b7f25b0e
-
Filesize
330KB
MD5c4c346b5b09878eeb58eb9a5bbc7a48b
SHA103895692a1ecf89a6ad77d48540e846f63bd3033
SHA2567e0203b87313d0ce09e35b549bed925cd400e53c7fa354d47992afc3f37ce0d5
SHA512931f35c8dea42597b26186c7c4ed8ea4a616858819f1bc14e248c21943c113dd11f12629e4d8d14565f175420b1947b327f8b3f98b3da993724c8becd1b26955
-
Filesize
8KB
MD55d94befac3e6c21ad8fd633f1868553d
SHA178fa2d0aaba052dcc4d627d1bd491dadf8f0bae3
SHA256714b32beea8078f8a93c6cd9c45e5a38c45453849d0e0cdc078894b76219e040
SHA512958a15520c95c0321b7999bbaf51496cf82f20e0d188d7b2f35fe2e8070f563eaef28d08e46bd7261f1f8e377fb42dacf47b1e42719349d5997f339f5798a55d
-
Filesize
480KB
MD5969b2dabe6080bc2da7236a0d455ced7
SHA1f2b4c9c70bbb5e11ec823846ad88a20c235775cd
SHA2564e7ae8c1b57d2178d7014c18b11a0d9ff1444f07d513ea8fdfa5af7a11f02873
SHA5121218dab072f3144304196c98f1b3c0494448929b8e6be35d5db88ef3dee0d0c12191f8cf3c94d8287195cde1af9a2a910a230d2e96f987e196e34ba00ae247c0
-
Filesize
346KB
MD5fddd06ddc12c78cd444f694e1e90bde0
SHA1fbe665ded53dc6f5ec12a2be1a0f7b9bede7798a
SHA25647f607a8cc5becc0d35750de266dd752887da4bd074e175d2977713191fcf983
SHA512c29083b4aca3bc16fa6e5a0c2f1a1ea71c1ec92970fc35631339d995fc25bb4c3b709a9bf226c185fc52f2b9d7be97b9f889f457072ecee0460b82f7b7d78dfa
-
Filesize
383KB
MD58905609ab8486ab9b82b7bb679e23262
SHA1aa923290caf664b6ad6f6e4fe3b2025eff1a3c17
SHA2561fe9056b458827bd4e295fcf1845079d2fe77d81b4553a04e44c2bb602b111e5
SHA51271b68208cfc0b53f7584ba9603318575ad3ac0274997a90615a08545a4d47d482a6bcd3c44a39576b72011783f5224a7ece4a53a254ef181e594ddc33e85f659
-
Filesize
60KB
MD5d3b85bb9d196e72698be344ac96002e7
SHA1c298e4ea9027a35145f44f8c7d19a67c0ed12153
SHA256d20130ad085156d26c8e5c65721b7bc576d6c2d68d9cfc76a9ffdca839d049fb
SHA512e08d4e1e350c548bc7542a4951a032e048407cb17a81d4e3286fd25d7e7f792c97a1f414a58c757263111e073080e7bbd36c6baad1a89d5292f1235eef271adb
-
Filesize
473KB
MD5b33c85b85ea534306b6c224aafca6288
SHA130afbda92782a4db21698dd91d220794dbb6c290
SHA2568bbe00be71f37a463b07e5c5bce647602910da21a401dbda6fbf68f2a3b272c2
SHA512179630255685a210451956ae2071cb0441938496d81eeed816251d4deb39b7069ec0d13cdbfe33d315692c6f5b3150c39248d24ad53e67c6a860935c95ecb86d
-
Filesize
231KB
MD546533812270c38fdad0333fac33a40e0
SHA167f1a29d8f11e3fa8bf67cf54eaa9c7c8baab306
SHA256388722ccd3182df4b7a70643810a2a9b6cad9005e0e5fb6ad99de72b747a7795
SHA512a51636f73a6089a434f7486721fa5bf423ed477b9c07a8bf43591c3c82dc836395c1666f6dd9ba61ade436b3190d2cef0c011eb8c5ab71dada8d2fed4d6515f3
-
Filesize
281KB
MD516a84aa029c8d009f41d9799efcde815
SHA147f00029672deb459c13f857ae8d8cfd66725b4e
SHA256be198d380f2925dfd09a75cac067f13b8c0e084dd8db4d1977a1cf5ad0ce342e
SHA512b193e509e4dc2014eeb7571073f92931aab3854f6a994d18475b9eb1c7114d40e2a627bbfcdb9158e33aad0844071fe905e0f96e09f86980ccafa52fe09d8826
-
Filesize
266KB
MD52a0fdb56bcdac9d0f35ebdda719af1a3
SHA19aebde91ccb628e93e87b74705e153f28df68d3f
SHA2566fe98abebe8d188da079921f2a75dd0844cf6ab19c0c09789e8c855fedbb7874
SHA512361d21a95d6644142d2e45d7c1a40e352081041e58f2fa679d6f8dad9d0bbca965d6c676bcdcd5ecd0b8a1503a0da821aa65988b7903b44f6904f4e59132cf9e
-
Filesize
1KB
MD5a85e3ec970d604e74a4f6cb886831a10
SHA1df59d472d35aafec3b1dea821798045e73ce7840
SHA2563171cea157d515f7b0fe2c21a4a1fb824e58d5a3edaaef0b1307fb5eb39cc35e
SHA512e81225e2bd01a30a2d74395bdde4ca095758e11eb4a4a1973dea9e7b6c2b884c3d5d599f95441d23d36d9e1d236459dd3c35b815637f1f415946794dc852b0a1
-
Filesize
164KB
MD5e15ee1ad793c23936edf78e6cf880275
SHA13c4adf17ad230cdf1c673e4508838cf9413aa06b
SHA256ef4516d9efa14547dcfbd998e9b1242bdb4390ee96647923e895ebebc6696677
SHA512c9c5498f8ec339600d8e71f27350b0932fcbbd179ba534afbac63f8cd61ad6857edd98c7e3345b632f59031d68821704cdf63f38aa40b714365f9d67e4a06fea
-
Filesize
327KB
MD53e402fd865c5356193d10a2d3c2a4bbc
SHA1548b616550c30c4314f981afdad93c709ceff07b
SHA256e7e39fa56d35570795fc94938b54cfbc3d66caa00bffc6bb61038cc1251fd59d
SHA5123ed4ad92cda15c51d7103a88cc9d25ecc9ba3ccc8be1d75382d2fda285f040df61fe20347c45a2a2feebe592eaa26b11fb3e3449b8a7e9e32f8bb23cfd7be2d4
-
Filesize
293KB
MD556969fe407f70167d6bf073484b8aca4
SHA1d13e271130912319c0eeb2d8ce333ff203d96ef2
SHA256460345fa518fd9b89c947305acec34620b2ef2f94edd608e51bc393bc6bf35ec
SHA512e4405955f73f2299d2b0c37498a56bcc9e90ee28fb127c7b4cb29fd3c341000f86cfcef9bafdff591de9c08259e1a23fccbdca29a2fe918c87c66066e1429c2c
-
Filesize
19KB
MD553cfeb28fbaa062fe013a8a2bdd24389
SHA101ce9e164e719363f2ec6bf49ef92b9987cb3893
SHA25675e13cbab08d30fddd122ce9f2876737609685c54f497adc5161bdb79d7c64d0
SHA512ba86ce01801d539fc1c8424d702e409d6c6acf1c282f85055966aeee0d232a1ac960d9ea8c5af33f6f576b01ffd9b94e02e5285c2c47f91529db0fd49144383f
-
Filesize
228KB
MD550fd695a115c2e5de457ccc2d0693726
SHA116cc62c618bd71e5092cf332008ec41157092981
SHA256fde0c95694e63e24826522ed44bc668868ae6454326b0f6ca17e242f9275b6d6
SHA51290ec5c04e766733d2baa289c822928672f7ff20a4c07b84ade4673122a386589ae5c2a54805bf52d23f58c3b908ec85b2c6f544826f0199c512386e10773a097
-
Filesize
314KB
MD554f4a3bb00ab2de372fc279a232e5112
SHA13e0e9ab2046f5c4154e31d75d833b81de95ec370
SHA256d9bc2d224f8dbd24fb272bc9dfc2be67ad7354baed790187371fdcb302b67a22
SHA5122319ba394ebf4df89bcbd6f450a70fb9410ec0679fa391a87eb65a8c13f0c17b089049573509eaf607a1c01945f6e56bf28be322b026fdd01ebef9feb8ff360b
-
Filesize
161KB
MD5e06e217fbc4c1bd8d42d8d454cb93b55
SHA1ba7df5a5298107755c6fff9bd04df45d8cea18eb
SHA25643726232712430a7a98e29ff43a3eef7272c0c19c8a22027878ee8c0bd5aa6a4
SHA5123f16e5e2f0936f25dff9252be1b2a0aa15440f1b4c8d63455a1fbbbe2e49ec6b88b6c117125d355314a64171660ab4870bd1826262dcac8281a519ea793f04af
-
Filesize
293KB
MD5ad19b52f28c0465a293cac7387845aa1
SHA17fa6c31ead15e1b7ce6f545ae155e06216d0f90e
SHA256ab07ff31a061abd5ed050f4b950f67fe25c1fbd2939daf296a2799f035182ef8
SHA512140b27235796b07f9eea8db2eebac64f676fa4bd5d5ea48bb9175674d5f397c8d9b57ecb9c3a471e939ca359ed0a8d278c0393584daa4339e75d466d3f66b069
-
Filesize
448KB
MD5515015f2146b26dfd70cc0969c403234
SHA1b70dde3d8ce0359d162ff41a394336a4e9e50d13
SHA2564bf86eecc3aaa31883e4fe8737378379492076a5e97309ba56535ee3db27fc69
SHA51250c42686284f6e41b339a93caecd185e3c246e68bb525b46cdff415441c362e977c167dfedf0df9140a53b6ed0664367a5fbe5e4e1cd803e00a46b12fcaf7864
-
Filesize
239KB
MD5059c8f8c6dedc4f03bfa604d63470022
SHA1fff95022b7e52d2400fb2780bd34b7ef62315cbb
SHA2560de8b45a1ff973d28a049e0655717ab010943222488ffefd6419116b78446a1a
SHA512a62e6592aad29e2baccab8976a4cbacf167548b6a6820320022940b06fe143c8e050f62cee7b46ed04bfb5298b4addde4116f2b836c71095c58e1e4a9aee4c6d
-
Filesize
192KB
MD5fbc1c7c361c9ebda5ca11c437f7844bb
SHA1c395a3f08d760fb3f2e7be0ac071202bdbca4eb1
SHA25660d30c4fb5a84ada692d05fc51b092d25fa3fb94329c22aabcae7d89e4c945e6
SHA512c1e047ba452afc0c638c1e0ad494b69f7b774475b5b7d9a33cac24401b6de6738fa9a3b21365c56d8f5ef8b0c635a556c9a5120fbb56bd0547751f71c3eab2aa
-
Filesize
712KB
MD58a9a9b464bfc1f3c8854a309c4e72841
SHA13341d2ad83e0ae8af8c935165e15a7ec88f1f40d
SHA2567c6313f488a035aad5c29537773af52de5027104792173a7604bfacb990b8ece
SHA512c0f15fd23e67f66ee51ff067ba2cade739a84e7a436ee2d9b62ad7c340c7726c07c3e63e5507df91a18056970510bf68d5088ecd55cb2bb58b054d12ad9d5667
-
Filesize
654KB
MD56f6298a47c15bb6c2945214b34d6d8f2
SHA19b3ce76a228d880448fee9d05e86a4841078bbf2
SHA256383f3ab0ecc3d4b7e32edf7188bd347ef448088aeecbdc384e632d4d22380fcc
SHA512e2084feb50c7546d9a8bae1754c3cb3c7cadb08bd16e4d17be466471863cf890604f302a1e4a6d9f73556a7ee7f838a2dfab7e051f0af2db29aaebf273f1a012
-
Filesize
267KB
MD5e3e488562c04578e0a2faed8b0801d9b
SHA169843294ece6a0cbadfb48b912420a2a4a287f6f
SHA2568a06a8b0b83f33d43e64abd2ae1f9f17bd8364750961619169e6de2875e022b5
SHA512e429729cc84fdbd414b8991a8f823721958e6753a66f73c23efdb0dda4695ec7ccb0c3042e27b56974de32ad759f0b5e52da620b8726404a0700bc62d0a3ba64