ramnit | hxxp://103[.]45[.]185[.]68[:]6358/

Analysis

max time kernel
210s
max time network
206s
platform
windows10_x64
resource
win10v20210408
submitted
03-10-2021 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://103.45.185.68:6358/
Sample

211003-qrwgvafegn

Score

10^/10

ramnit xmrig banker miner persistence spyware stealer trojan upx worm

Malware Config

Signatures

MrBlack Trojan 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\cy25.ntk1nbz.partial	family_mrblack

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Downloads MZ/PE file
Executes dropped EXE 9 IoCs

Processes:

shell.exeshellSrv.exeDesktopLayer.exewyq2.exeCYSRDSL.exewyq.exetftj.exetftj (1).exeWkcy.exe

pid process

3568 shell.exe
3380 shellSrv.exe
3288 DesktopLayer.exe
3544 wyq2.exe
3756 CYSRDSL.exe
3484 wyq.exe
1036 tftj.exe
3784 tftj (1).exe
3152 Wkcy.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\shellSrv.exe	upx
C:\Users\Admin\Downloads\shellSrv.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral1/memory/3380-143-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3568-153-0x0000000002460000-0x0000000002472000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

wyq2.exesvchost.exeCYSRDSL.exe

pid process

3544 wyq2.exe
1564 svchost.exe
3756 CYSRDSL.exe

pid	process
3544	wyq2.exe
1564	svchost.exe
3756	CYSRDSL.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

shell.exewyq.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Downloads\\shell.exe"	shell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\Downloads\\wyq.exe"	wyq.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wyq.exeshell.exe

description	ioc	process
File opened (read-only)	\??\F:	wyq.exe
File opened (read-only)	\??\I:	wyq.exe
File opened (read-only)	\??\N:	wyq.exe
File opened (read-only)	\??\U:	wyq.exe
File opened (read-only)	\??\Y:	wyq.exe
File opened (read-only)	\??\M:	shell.exe
File opened (read-only)	\??\X:	shell.exe
File opened (read-only)	\??\B:	wyq.exe
File opened (read-only)	\??\K:	wyq.exe
File opened (read-only)	\??\J:	shell.exe
File opened (read-only)	\??\Y:	shell.exe
File opened (read-only)	\??\Z:	shell.exe
File opened (read-only)	\??\L:	wyq.exe
File opened (read-only)	\??\S:	wyq.exe
File opened (read-only)	\??\V:	wyq.exe
File opened (read-only)	\??\Z:	wyq.exe
File opened (read-only)	\??\N:	shell.exe
File opened (read-only)	\??\W:	shell.exe
File opened (read-only)	\??\J:	wyq.exe
File opened (read-only)	\??\E:	wyq.exe
File opened (read-only)	\??\G:	wyq.exe
File opened (read-only)	\??\M:	wyq.exe
File opened (read-only)	\??\O:	wyq.exe
File opened (read-only)	\??\R:	wyq.exe
File opened (read-only)	\??\K:	shell.exe
File opened (read-only)	\??\O:	shell.exe
File opened (read-only)	\??\P:	shell.exe
File opened (read-only)	\??\X:	wyq.exe
File opened (read-only)	\??\U:	shell.exe
File opened (read-only)	\??\B:	shell.exe
File opened (read-only)	\??\L:	shell.exe
File opened (read-only)	\??\T:	shell.exe
File opened (read-only)	\??\T:	wyq.exe
File opened (read-only)	\??\G:	shell.exe
File opened (read-only)	\??\S:	shell.exe
File opened (read-only)	\??\V:	shell.exe
File opened (read-only)	\??\H:	wyq.exe
File opened (read-only)	\??\P:	wyq.exe
File opened (read-only)	\??\W:	wyq.exe
File opened (read-only)	\??\E:	shell.exe
File opened (read-only)	\??\H:	shell.exe
File opened (read-only)	\??\Q:	shell.exe
File opened (read-only)	\??\Q:	wyq.exe
File opened (read-only)	\??\F:	shell.exe
File opened (read-only)	\??\I:	shell.exe
File opened (read-only)	\??\R:	shell.exe

Drops file in System32 directory 4 IoCs

Processes:

wyq2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\267515.txt	wyq2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	wyq2.exe
File created	C:\Windows\SysWOW64\CYSRDSL.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\CYSRDSL.exe	svchost.exe

Drops file in Program Files directory 3 IoCs

Processes:

shellSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxBF2A.tmp	shellSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	shellSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	shellSrv.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

shell.exeCYSRDSL.exewyq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	shell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	shell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	shell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CYSRDSL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CYSRDSL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wyq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wyq.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6ead5207ab2cd701	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2914914403"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914667"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{59C03FF1-BED1-471D-86BE-552A9C73D766}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005aaf6b3a221a994d9872a0b58c63860e0000000002000000000010660000000100002000000019c6f989f712d8df639796636a41c861f613f521e766f05571bb8381cb348d3b000000000e8000000002000020000000491b035664e4a882bfab8c0124424d5ac97e1d0142ce93ca75f98653cf63556420000000bf58bd9ca239a5aa54f849d3076198bc7179eef78b304dbf28526bf98fcfc70f40000000afa06c7f32917de35306924bc193800a6789620092ef69a84dc4e1d03e8ed3dd24e064120b06539fc94112d30793cbc01c2275997dbc2a3847fe5e928fb018e3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2868351280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30914667"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340056601"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2868351280"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D63CDB4D-245E-11EC-B2DB-E6C57AC66A15} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30914667"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005aaf6b3a221a994d9872a0b58c63860e00000000020000000000106600000001000020000000834f5d830022172706690def6b9ef32d0f4b94e017005ecc5fffdfd1bee7b2cf000000000e8000000002000020000000b166ecec2f759d9c393dda931db9b9eef05d3b780042cb2189da8f66e23a91b2200000005d020edd5c82a26d54e1fb3b9a5e62e9ad7d4a14f267d4ffdb5290805a5aa86240000000a15aefa80da8b82cae2515bb8677c66165f140c9539d9e6abf1f8da6084dd8cc87b7324a783e76a2eebe56a2b54939d1cfc0958b6c5a66667f103b0a3976f11c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340040007"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340088593"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f005f3af6bb8d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e61db06bb8d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

CYSRDSL.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	CYSRDSL.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	CYSRDSL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	CYSRDSL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	CYSRDSL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	CYSRDSL.exe

Modifies registry class 2 IoCs

Processes:

iexplore.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3232 NOTEPAD.EXE

pid	process
3232	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

shell.exeDesktopLayer.exewyq.exe

pid	process
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3288	DesktopLayer.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3568	shell.exe
3484	wyq.exe
3484	wyq.exe
3484	wyq.exe
3484	wyq.exe
3484	wyq.exe
3484	wyq.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

664 iexplore.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

shell.exe

description pid process

Token: SeDebugPrivilege 3568 shell.exe

description	pid	process
Token: SeDebugPrivilege	3568	shell.exe

Suspicious use of FindShellTrayWindow 12 IoCs

Processes:

iexplore.exe

pid	process
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe
664	iexplore.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEOpenWith.exeIEXPLORE.EXEwyq2.exetftj.exetftj (1).exe

pid	process
664	iexplore.exe
664	iexplore.exe
488	IEXPLORE.EXE
488	IEXPLORE.EXE
488	IEXPLORE.EXE
488	IEXPLORE.EXE
488	IEXPLORE.EXE
488	IEXPLORE.EXE
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
1792	OpenWith.exe
664	iexplore.exe
664	iexplore.exe
716	IEXPLORE.EXE
716	IEXPLORE.EXE
3544	wyq2.exe
1036	tftj.exe
3784	tftj (1).exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

iexplore.exeOpenWith.exeshell.exeshellSrv.exeDesktopLayer.exesvchost.exe

description	pid	process	target process
PID 664 wrote to memory of 488	664	iexplore.exe	IEXPLORE.EXE
PID 664 wrote to memory of 488	664	iexplore.exe	IEXPLORE.EXE
PID 664 wrote to memory of 488	664	iexplore.exe	IEXPLORE.EXE
PID 1792 wrote to memory of 3232	1792	OpenWith.exe	NOTEPAD.EXE
PID 1792 wrote to memory of 3232	1792	OpenWith.exe	NOTEPAD.EXE
PID 664 wrote to memory of 3568	664	iexplore.exe	shell.exe
PID 664 wrote to memory of 3568	664	iexplore.exe	shell.exe
PID 664 wrote to memory of 3568	664	iexplore.exe	shell.exe
PID 3568 wrote to memory of 3380	3568	shell.exe	shellSrv.exe
PID 3568 wrote to memory of 3380	3568	shell.exe	shellSrv.exe
PID 3568 wrote to memory of 3380	3568	shell.exe	shellSrv.exe
PID 3380 wrote to memory of 3288	3380	shellSrv.exe	DesktopLayer.exe
PID 3380 wrote to memory of 3288	3380	shellSrv.exe	DesktopLayer.exe
PID 3380 wrote to memory of 3288	3380	shellSrv.exe	DesktopLayer.exe
PID 3288 wrote to memory of 1036	3288	DesktopLayer.exe	iexplore.exe
PID 3288 wrote to memory of 1036	3288	DesktopLayer.exe	iexplore.exe
PID 664 wrote to memory of 716	664	iexplore.exe	IEXPLORE.EXE
PID 664 wrote to memory of 716	664	iexplore.exe	IEXPLORE.EXE
PID 664 wrote to memory of 716	664	iexplore.exe	IEXPLORE.EXE
PID 664 wrote to memory of 3544	664	iexplore.exe	wyq2.exe
PID 664 wrote to memory of 3544	664	iexplore.exe	wyq2.exe
PID 664 wrote to memory of 3544	664	iexplore.exe	wyq2.exe
PID 1564 wrote to memory of 3756	1564	svchost.exe	CYSRDSL.exe
PID 1564 wrote to memory of 3756	1564	svchost.exe	CYSRDSL.exe
PID 1564 wrote to memory of 3756	1564	svchost.exe	CYSRDSL.exe
PID 664 wrote to memory of 3484	664	iexplore.exe	wyq.exe
PID 664 wrote to memory of 3484	664	iexplore.exe	wyq.exe
PID 664 wrote to memory of 3484	664	iexplore.exe	wyq.exe
PID 664 wrote to memory of 1036	664	iexplore.exe	tftj.exe
PID 664 wrote to memory of 1036	664	iexplore.exe	tftj.exe
PID 664 wrote to memory of 1036	664	iexplore.exe	tftj.exe
PID 664 wrote to memory of 3784	664	iexplore.exe	tftj (1).exe
PID 664 wrote to memory of 3784	664	iexplore.exe	tftj (1).exe
PID 664 wrote to memory of 3784	664	iexplore.exe	tftj (1).exe
PID 664 wrote to memory of 3152	664	iexplore.exe	Wkcy.exe
PID 664 wrote to memory of 3152	664	iexplore.exe	Wkcy.exe
PID 664 wrote to memory of 3152	664	iexplore.exe	Wkcy.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://103.45.185.68:6358/
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:664

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:488

C:\Users\Admin\Downloads\shell.exe
"C:\Users\Admin\Downloads\shell.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568

C:\Users\Admin\Downloads\shellSrv.exe
C:\Users\Admin\Downloads\shellSrv.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3380

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
5⤵
- Modifies Internet Explorer settings
PID:1036

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:82998 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:716

C:\Users\Admin\Downloads\wyq2.exe
"C:\Users\Admin\Downloads\wyq2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3544

C:\Users\Admin\Downloads\wyq.exe
"C:\Users\Admin\Downloads\wyq.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3484

C:\Users\Admin\Downloads\tftj.exe
"C:\Users\Admin\Downloads\tftj.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Users\Admin\Downloads\tftj (1).exe
"C:\Users\Admin\Downloads\tftj (1).exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Users\Admin\Downloads\Wkcy.exe
"C:\Users\Admin\Downloads\Wkcy.exe"
2⤵
- Executes dropped EXE
PID:3152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\config.json
2⤵
- Opens file in notepad (likely ransom note)
PID:3232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "CYSRDSL"
1⤵
PID:1820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "CYSRDSL"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\CYSRDSL.exe
C:\Windows\system32\CYSRDSL.exe "c:\windows\system32\267515.txt",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
547731c5056da83a5eea0ebc87a3a7de

SHA1
ee75657c591f3ea12da5b031b0c86c8312be023e

SHA256
d8a31cd05fb00d0b1e163cbd5263aa72d08f4892fad4926c2dc73ca764431004

SHA512
75d19562fc79a1dc2915b0d9b3eb681b1743a540cfe5af68bf170d430c1cd60b0869ddafe4dfd69635fd46d0ce47c421841a1950b39c66d44904ebc7c871aea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
b0fa86f9091a2dd831619c9235a48e5c

SHA1
4c358196936c203afc87d23109883e1bca10a6e3

SHA256
08e68dea157b566d405b49e6be05187063b56f93da09e403842dcc65dfbab1cc

SHA512
aa3891466c3a2a3f4d237d9eaefb12b675fbc2d8a91e4a930f071900e015e6639bdc1df740c1dfb0e3aae934e81baa911516afa00985402777ccc816c5b560d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\6Y0CQJBY.cookie
MD5
7b7720f902e8d2958c4d6904d9a79ba4

SHA1
6433646583b3dbaf9fe50cde2604d9a0e315f706

SHA256
10f53dd31c1b587109b48bf0b9ba343f536fceea1c808f98b95d328110678391

SHA512
c82b1578d076a0ec791564a825e7b4e9ad459586144fecaab2e1c8ac4b426e2951d87ea08c4e85924e7f5c84547c3ff53c7cedaec0c512aeea4fde7c35e53205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZRTIOCGO.cookie
MD5
6eff2ea889b2b18cf5b48c09ef7442f9

SHA1
61d504353252d8d49b9d4814cbfe37e4a6d00f48

SHA256
f5e43855c01fc6ed402f55c506dc2269644982abaebab8c05911c916430d925b

SHA512
e80bbba16d60c6e880f405754b6fd2036cec63428f9e3aa042748f4aef595332fa390523e234f47e1e483a03c85fe8f708c14850ef9d82e08ba2fb0e96e402ca

Download Submit
C:\Users\Admin\Downloads\045.exe.inaqrgq.partial
MD5
d934685c167573905ee8b8464f308210

SHA1
bc1b4f05edf92863206d1dc387fd8990313a20ad

SHA256
6c83c6c27c1effe8afa1a5ffbef95be0f95d9e73b0bf4a31678f5a1286c89303

SHA512
857ee2c273393e76ece1fc6363f234b379d9c0b2c3053a61c84a976206e6924f79580ae2b4f80248bfadecb6ae570040280e1c316f7217fdf1090b22db79046b

Download Submit
C:\Users\Admin\Downloads\Wkcy.exe
MD5
6649cb54516d7a8afe549fb05e47b71b

SHA1
17439eae3f92baca40ca0dec812463628291ac74

SHA256
251b3183605b5d40dbcab5bb9a7df959ceef337ba1af858120cea26806240946

SHA512
4affbf608ab80d6c527e5a701966a8b255e034c6760d99530cc158bf5d6d57352fd94e90e801a6ca7a982d016d232f5bfaec5f4abe430dc484aacbd9c4d1865b

Download Submit
C:\Users\Admin\Downloads\Wkcy.exe.3d2vrjs.partial
MD5
6649cb54516d7a8afe549fb05e47b71b

SHA1
17439eae3f92baca40ca0dec812463628291ac74

SHA256
251b3183605b5d40dbcab5bb9a7df959ceef337ba1af858120cea26806240946

SHA512
4affbf608ab80d6c527e5a701966a8b255e034c6760d99530cc158bf5d6d57352fd94e90e801a6ca7a982d016d232f5bfaec5f4abe430dc484aacbd9c4d1865b

Download Submit
C:\Users\Admin\Downloads\config.json.iryuuxy.partial
MD5
3be68b57b3606431bc8255bbc958739b

SHA1
892ecf7b71f023bd30af80afb8ac96870c179b6d

SHA256
8537c53604f9fbee12bd3bea30282a057f210b34bc4887b4a8af2f16fa8ee2f9

SHA512
9ce393f63e572b460931eadc493598e0d9910ff50b2f0878a0186b705dd67ae3fa2ccc21e59834e63e8dbf8fbf6bf58c33780e7561bfbc603940717ab1982d8f

Download Submit
C:\Users\Admin\Downloads\cy.sh.linxs3g.partial
MD5
c52ef8ab90226a2d8eb1181124faf0f7

SHA1
fdc6351b7623074e93670eeae84a55435f167301

SHA256
79f2dea7ecb0bcb8d58af825dda396221f6d39a58e1e60714bcef14a76b33dce

SHA512
4248eeb8a9949a619b927ccae738ef139e4f5ac5128f123da789ab88c7076674abe38cb20bd5dca2ee999b4cbf25b4cf854009e4c28ed248949bf5aebe376c49

Download Submit
C:\Users\Admin\Downloads\cy25.ntk1nbz.partial
MD5
d5aab96628048266bc8aacbabd0a0876

SHA1
c04067f7ad99d272279a0e60eb6a08cdeb7ebb49

SHA256
1d350024fe02082af1292a08153754e73f9755e0c94790bebed57646e123bba0

SHA512
b0f9d7e0bebe92308b6d0b5fb6b44682a5ada60c80517b1b73b4502f80633f69b699c5fe3893483733d0ee78dc80c40e185c7a47d3f24dd75b6b8c860dd15fc3

Download Submit
C:\Users\Admin\Downloads\cykg.exe.l0hgsyv.partial
MD5
5a9875194e8c7abde058bd58b158704b

SHA1
a257b4455206c7e8bfd2ba05a0952d28b825da50

SHA256
c47248917e17a3ba9cd71fb2dca57b9424ec323d2ac8c361d9cec67588d27f65

SHA512
d0f2a10e8f2f5c288f77af9c6c4d6f7debb141cfbfaea3df8a150f7375043889c8802a17090880bbc5266b1029ee89f9463d1f42c306bf1c7f106066bb411f7b

Download Submit
C:\Users\Admin\Downloads\cyv8.hfhutdx.partial
MD5
6ca336bf59f47fea572076b0af46f6bb

SHA1
78f6bb045c1c4df0682cfbfc8c943cd51aea43c3

SHA256
73f6bce60cb1877f1e7461690539f9e426eb4b37a4d38fe2eec1291cdce71afb

SHA512
0623a7d4a6e67ae698a9443f890f82f95ba30ec539acb72f69443a8dc97be1763f700d40029a43f88d4d68292aaec5d286a12b758bc10fc202b5f308e783e197

Download Submit
C:\Users\Admin\Downloads\mlwk.sh.bvf0gfm.partial
MD5
ea79e6f3a96671aa051f677679c2bda0

SHA1
2e2f085e81e8e750da43d8217541404ab78461e9

SHA256
f60d0a378a482bde674b1e5d610bd8d3926468f59ced75e4d29776d14fa4c543

SHA512
ce1a0f0c3c233a3bfa2724961e9f0f4ae2b061a60560ec37f0acfabad931c6a5a13ae2477d363e855f586fb5e097d5a33c464e57fb8ab06641ac67afcff58fce

Download Submit
C:\Users\Admin\Downloads\shell.exe
MD5
1922c65b2fd664282270dad7c15553dd

SHA1
d8e6779f09cc55c8d46a52e76e6aff66c8f58667

SHA256
3a687615f8aa67865f510509384d264f35041bf0d4291245eb2766ca9d91d301

SHA512
f86cd76a9b0d0b7de9bed0a0305ad691414ef8bc1faa2ac19a40fe7a7fe4d4c5f0039ef18cd0ad97c51d87391b539e8dae01f53bc4d9994b14b7363a22252601

Download Submit
C:\Users\Admin\Downloads\shell.exe.vme7q7i.partial
MD5
1922c65b2fd664282270dad7c15553dd

SHA1
d8e6779f09cc55c8d46a52e76e6aff66c8f58667

SHA256
3a687615f8aa67865f510509384d264f35041bf0d4291245eb2766ca9d91d301

SHA512
f86cd76a9b0d0b7de9bed0a0305ad691414ef8bc1faa2ac19a40fe7a7fe4d4c5f0039ef18cd0ad97c51d87391b539e8dae01f53bc4d9994b14b7363a22252601

Download Submit
C:\Users\Admin\Downloads\shellSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\Downloads\shellSrv.exe
MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\Downloads\tftj (1).exe
MD5
2b9be1d1c46915c3ccb83bf46149cf6d

SHA1
f2408f8bc447043d12a594ce8be2019429d47977

SHA256
8806e699b29c42a813f093b75f28f86f17c79dd537351b18b49d1cbdedc973a3

SHA512
5a347e48406f33c91c959a6218bbaab4366007eee9b681e2256bffa95ea224e23c96ed22a4264f9618f83c2b4cae1dee3be4f41705330e4d9c7ed616abe9447e

Download Submit
C:\Users\Admin\Downloads\tftj (1).exe.fy9dxjs.partial
MD5
2b9be1d1c46915c3ccb83bf46149cf6d

SHA1
f2408f8bc447043d12a594ce8be2019429d47977

SHA256
8806e699b29c42a813f093b75f28f86f17c79dd537351b18b49d1cbdedc973a3

SHA512
5a347e48406f33c91c959a6218bbaab4366007eee9b681e2256bffa95ea224e23c96ed22a4264f9618f83c2b4cae1dee3be4f41705330e4d9c7ed616abe9447e

Download Submit
C:\Users\Admin\Downloads\tftj.exe
MD5
2b9be1d1c46915c3ccb83bf46149cf6d

SHA1
f2408f8bc447043d12a594ce8be2019429d47977

SHA256
8806e699b29c42a813f093b75f28f86f17c79dd537351b18b49d1cbdedc973a3

SHA512
5a347e48406f33c91c959a6218bbaab4366007eee9b681e2256bffa95ea224e23c96ed22a4264f9618f83c2b4cae1dee3be4f41705330e4d9c7ed616abe9447e

Download Submit
C:\Users\Admin\Downloads\tftj.exe.usqegiv.partial
MD5
2b9be1d1c46915c3ccb83bf46149cf6d

SHA1
f2408f8bc447043d12a594ce8be2019429d47977

SHA256
8806e699b29c42a813f093b75f28f86f17c79dd537351b18b49d1cbdedc973a3

SHA512
5a347e48406f33c91c959a6218bbaab4366007eee9b681e2256bffa95ea224e23c96ed22a4264f9618f83c2b4cae1dee3be4f41705330e4d9c7ed616abe9447e

Download Submit
C:\Users\Admin\Downloads\wyq.exe
MD5
c15d3f47becdee41ea83d84e34745a6e

SHA1
620011478cfa8baf23904b9f0854ca13e9ebe2c3

SHA256
db1d0f886da0555f76a5517a56eb83a640158f3d08d995970827dc6c40a2c446

SHA512
9a4ab64fff6981327c2a358ebaf8c95d11fa60910615faae2fb032a31e15b0b69b71d17654eddb9c4601341447efcd27b0e67ad6096c2711635f11b38135997e

Download Submit
C:\Users\Admin\Downloads\wyq.exe.73cgry0.partial
MD5
c15d3f47becdee41ea83d84e34745a6e

SHA1
620011478cfa8baf23904b9f0854ca13e9ebe2c3

SHA256
db1d0f886da0555f76a5517a56eb83a640158f3d08d995970827dc6c40a2c446

SHA512
9a4ab64fff6981327c2a358ebaf8c95d11fa60910615faae2fb032a31e15b0b69b71d17654eddb9c4601341447efcd27b0e67ad6096c2711635f11b38135997e

Download Submit
C:\Users\Admin\Downloads\wyq2.exe
MD5
f54388c14e934e408b778525b17e9e11

SHA1
8d5cfa0a1eb368be6549aeb271b9ac1bf5cbf1fd

SHA256
bdd737092211ba7ed5c86a77a4f58e61543d63d70272cc060080eac34c087021

SHA512
dd5df2b15046a268caa498adc78bab19b13c9e8b9da0558c87c2f2d473461044d53b57a6bd44c1dcecd2bfbbaf2adc2e5f45fc866940edd64e35e84074c3098c

Download Submit
C:\Users\Admin\Downloads\wyq2.exe.3nv0ede.partial
MD5
f54388c14e934e408b778525b17e9e11

SHA1
8d5cfa0a1eb368be6549aeb271b9ac1bf5cbf1fd

SHA256
bdd737092211ba7ed5c86a77a4f58e61543d63d70272cc060080eac34c087021

SHA512
dd5df2b15046a268caa498adc78bab19b13c9e8b9da0558c87c2f2d473461044d53b57a6bd44c1dcecd2bfbbaf2adc2e5f45fc866940edd64e35e84074c3098c

Download Submit
C:\Users\Admin\Downloads\xmrig.8bp3a1q.partial
MD5
40087b74e16ecdf395d8a97fea430f79

SHA1
e11736f470b2d3fb38d3090da4c3740e7ac6f359

SHA256
e3a7193d196cd333f6223474228910f709d8ccc115fe87b6273a6dfc2af2ec42

SHA512
5ae27847d5a3fe4b1889d82d21988ae8cc937b2ab9abf857d5498c335d17b71ae58c3606ee8ad29b44c422b97372039d3c1a5ad04163b150028e4d1efc7b193f

Download Submit
C:\Windows\SysWOW64\CYSRDSL.exe
MD5
f57886ace1ab4972b0308f69b1a0029c

SHA1
519b2a981cb522ed2b0901f9871f9aa9781a6cd5

SHA256
2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

SHA512
c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

Download Submit
C:\Windows\SysWOW64\CYSRDSL.exe
MD5
f57886ace1ab4972b0308f69b1a0029c

SHA1
519b2a981cb522ed2b0901f9871f9aa9781a6cd5

SHA256
2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

SHA512
c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

Download Submit
C:\Windows\SysWOW64\ini.ini
MD5
8f85bc4f0aa3e6ffbf79abc65aa3f4b7

SHA1
c2bb8f1c38a802d7febcbf332a00a782fba9488d

SHA256
7a697d8f258aceb07089659ee060261207126d454a0c15f3ef5007d0197f57de

SHA512
6ebcb91eef25bfd8ba79bdb3ec62108002cb4541b2f3367408ed5c74207a53a21f14514b0f150782f22ce557886f3fc866966d1c7a6248f1cb3bfa012f35c8ef

Download Submit
\??\c:\windows\SysWOW64\267515.txt
MD5
6be38a31509afced78fb00d516a1b220

SHA1
83199667c1a63b4038b8591c71bedb559c6df8c6

SHA256
d6df058a0da58559b65ff268d93a85f01e879497d7a4de1ceeb4667138b8c09d

SHA512
90ff8c99deff82145ac48dd1f23c3eb4913566d4bcf471b047c047d1c6ca8a88275ee8e6e850d7a2f40d0e20c4827b6829b5f4c69154e96200ad16857fbc9a43

Download Submit
\Windows\SysWOW64\267515.txt
MD5
6be38a31509afced78fb00d516a1b220

SHA1
83199667c1a63b4038b8591c71bedb559c6df8c6

SHA256
d6df058a0da58559b65ff268d93a85f01e879497d7a4de1ceeb4667138b8c09d

SHA512
90ff8c99deff82145ac48dd1f23c3eb4913566d4bcf471b047c047d1c6ca8a88275ee8e6e850d7a2f40d0e20c4827b6829b5f4c69154e96200ad16857fbc9a43

Download Submit
\Windows\SysWOW64\267515.txt
MD5
6be38a31509afced78fb00d516a1b220

SHA1
83199667c1a63b4038b8591c71bedb559c6df8c6

SHA256
d6df058a0da58559b65ff268d93a85f01e879497d7a4de1ceeb4667138b8c09d

SHA512
90ff8c99deff82145ac48dd1f23c3eb4913566d4bcf471b047c047d1c6ca8a88275ee8e6e850d7a2f40d0e20c4827b6829b5f4c69154e96200ad16857fbc9a43

Download Submit
\Windows\SysWOW64\267515.txt
MD5
6be38a31509afced78fb00d516a1b220

SHA1
83199667c1a63b4038b8591c71bedb559c6df8c6

SHA256
d6df058a0da58559b65ff268d93a85f01e879497d7a4de1ceeb4667138b8c09d

SHA512
90ff8c99deff82145ac48dd1f23c3eb4913566d4bcf471b047c047d1c6ca8a88275ee8e6e850d7a2f40d0e20c4827b6829b5f4c69154e96200ad16857fbc9a43

Download Submit
memory/488-115-0x0000000000000000-mapping.dmp

Download
memory/664-114-0x00007FFAE36C0000-0x00007FFAE372B000-memory.dmp

Filesize
428KB

Download
memory/716-145-0x0000000000000000-mapping.dmp

Download
memory/1036-142-0x0000000000000000-mapping.dmp

Download
memory/1036-166-0x0000000000000000-mapping.dmp

Download
memory/1036-144-0x00007FFAE36C0000-0x00007FFAE372B000-memory.dmp

Filesize
428KB

Download
memory/3152-171-0x0000000000000000-mapping.dmp

Download
memory/3232-121-0x0000000000000000-mapping.dmp

Download
memory/3288-136-0x0000000000000000-mapping.dmp

Download
memory/3288-140-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3380-141-0x00000000001E0000-0x00000000001EF000-memory.dmp

Filesize
60KB

Download
memory/3380-143-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3380-133-0x0000000000000000-mapping.dmp

Download
memory/3484-162-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/3484-160-0x0000000000000000-mapping.dmp

Download
memory/3544-148-0x0000000000000000-mapping.dmp

Download
memory/3568-138-0x0000000010015000-0x0000000010024000-memory.dmp

Filesize
60KB

Download
memory/3568-131-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/3568-129-0x0000000000000000-mapping.dmp

Download
memory/3568-153-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/3756-154-0x0000000000000000-mapping.dmp

Download
memory/3784-169-0x0000000000000000-mapping.dmp

Download