cerber | 967e7d816b6ec752b3d99256dacc0216af80f63046f36d4db699c90219c17ae5

Analysis

max time kernel
66s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

memorium.exe
Size

1.6MB
MD5

c4ee913e290d76916d7e7658049491a5
SHA1

9e3e83c128e51a3f8b9a044957a390429e6b5e29
SHA256

967e7d816b6ec752b3d99256dacc0216af80f63046f36d4db699c90219c17ae5
SHA512

06aabdc66e26f2c2f66314cbcb7f7ae8735fd57f4b51778d7866a3a5272b58d15e724b2c4f7cced20614edbb056d6fee82a76828288908cffbc772ab95dbb5f1
SSDEEP

24576:vbw+7NLKcPZFML5xxIOUyTyPUz977wsAKaBApkF77RpoCgfdt6on7iuk77DNj:jwuYLZIYyPUzJAKrq6hp+ZDN

Score

10^/10

cerber evasion ransomware

Malware Config

Signatures

Cerber 23 IoCs

Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

ransomware cerber

description	ioc	pid	Process
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
		4676	taskkill.exe
		8	taskkill.exe
		1484	taskkill.exe
		4520	taskkill.exe
		1320	taskkill.exe
		4556	taskkill.exe
		2920	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
		3224	taskkill.exe
		2400	taskkill.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
Mutant created	AFUWIN.{5b5b8120-cd0e-11d9-b61b-0001294c3bd8}		zhjers.exe
		3732	taskkill.exe
		4392	taskkill.exe
		5044	taskkill.exe
		1476	taskkill.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 11 IoCs

pid	Process
2388	zhjers.exe
4676	zhjers.exe
1780	zhjers.exe
3564	zhjers.exe
3812	zhjers.exe
2012	zhjers.exe
4208	zhjers.exe
5100	zhjers.exe
4984	zhjers.exe
3064	zhjers.exe
4476	zhjers.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\zhjers.exe	memorium.exe
File created	C:\Windows\System32\AMIFLDRV64.SYS	memorium.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
368	memorium.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1984	sc.exe
3200	sc.exe
1072	sc.exe

Kills process with taskkill 16 IoCs

evasion

pid	Process
3732	taskkill.exe
2920	taskkill.exe
3928	taskkill.exe
1476	taskkill.exe
4392	taskkill.exe
4520	taskkill.exe
3464	taskkill.exe
3224	taskkill.exe
5044	taskkill.exe
1320	taskkill.exe
1484	taskkill.exe
4676	taskkill.exe
4088	taskkill.exe
2400	taskkill.exe
8	taskkill.exe
4556	taskkill.exe

Modifies registry key 1 TTPs 6 IoCs

Modify Registry

T1112

pid	Process
404	reg.exe
388	reg.exe
4888	reg.exe
4172	reg.exe
3652	reg.exe
1340	reg.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe
368	memorium.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	4676	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2436	WMIC.exe
Token: SeSecurityPrivilege	2436	WMIC.exe
Token: SeTakeOwnershipPrivilege	2436	WMIC.exe
Token: SeLoadDriverPrivilege	2436	WMIC.exe
Token: SeSystemProfilePrivilege	2436	WMIC.exe
Token: SeSystemtimePrivilege	2436	WMIC.exe
Token: SeProfSingleProcessPrivilege	2436	WMIC.exe
Token: SeIncBasePriorityPrivilege	2436	WMIC.exe
Token: SeCreatePagefilePrivilege	2436	WMIC.exe
Token: SeBackupPrivilege	2436	WMIC.exe
Token: SeRestorePrivilege	2436	WMIC.exe
Token: SeShutdownPrivilege	2436	WMIC.exe
Token: SeDebugPrivilege	2436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2436	WMIC.exe
Token: SeRemoteShutdownPrivilege	2436	WMIC.exe
Token: SeUndockPrivilege	2436	WMIC.exe
Token: SeManageVolumePrivilege	2436	WMIC.exe
Token: 33	2436	WMIC.exe
Token: 34	2436	WMIC.exe
Token: 35	2436	WMIC.exe
Token: 36	2436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2436	WMIC.exe
Token: SeSecurityPrivilege	2436	WMIC.exe
Token: SeTakeOwnershipPrivilege	2436	WMIC.exe
Token: SeLoadDriverPrivilege	2436	WMIC.exe
Token: SeSystemProfilePrivilege	2436	WMIC.exe
Token: SeSystemtimePrivilege	2436	WMIC.exe
Token: SeProfSingleProcessPrivilege	2436	WMIC.exe
Token: SeIncBasePriorityPrivilege	2436	WMIC.exe
Token: SeCreatePagefilePrivilege	2436	WMIC.exe
Token: SeBackupPrivilege	2436	WMIC.exe
Token: SeRestorePrivilege	2436	WMIC.exe
Token: SeShutdownPrivilege	2436	WMIC.exe
Token: SeDebugPrivilege	2436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2436	WMIC.exe
Token: SeRemoteShutdownPrivilege	2436	WMIC.exe
Token: SeUndockPrivilege	2436	WMIC.exe
Token: SeManageVolumePrivilege	2436	WMIC.exe
Token: 33	2436	WMIC.exe
Token: 34	2436	WMIC.exe
Token: 35	2436	WMIC.exe
Token: 36	2436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1312	WMIC.exe
Token: SeSecurityPrivilege	1312	WMIC.exe
Token: SeTakeOwnershipPrivilege	1312	WMIC.exe
Token: SeLoadDriverPrivilege	1312	WMIC.exe
Token: SeSystemProfilePrivilege	1312	WMIC.exe
Token: SeSystemtimePrivilege	1312	WMIC.exe
Token: SeProfSingleProcessPrivilege	1312	WMIC.exe
Token: SeIncBasePriorityPrivilege	1312	WMIC.exe
Token: SeCreatePagefilePrivilege	1312	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4696	368	memorium.exe	89
PID 368 wrote to memory of 4696	368	memorium.exe	89
PID 4696 wrote to memory of 3732	4696	cmd.exe	90
PID 4696 wrote to memory of 3732	4696	cmd.exe	90
PID 368 wrote to memory of 5072	368	memorium.exe	93
PID 368 wrote to memory of 5072	368	memorium.exe	93
PID 5072 wrote to memory of 2920	5072	cmd.exe	94
PID 5072 wrote to memory of 2920	5072	cmd.exe	94
PID 368 wrote to memory of 4584	368	memorium.exe	95
PID 368 wrote to memory of 4584	368	memorium.exe	95
PID 4584 wrote to memory of 1984	4584	cmd.exe	96
PID 4584 wrote to memory of 1984	4584	cmd.exe	96
PID 368 wrote to memory of 4652	368	memorium.exe	97
PID 368 wrote to memory of 4652	368	memorium.exe	97
PID 4652 wrote to memory of 4088	4652	cmd.exe	98
PID 4652 wrote to memory of 4088	4652	cmd.exe	98
PID 368 wrote to memory of 836	368	memorium.exe	100
PID 368 wrote to memory of 836	368	memorium.exe	100
PID 836 wrote to memory of 3464	836	cmd.exe	101
PID 836 wrote to memory of 3464	836	cmd.exe	101
PID 368 wrote to memory of 1824	368	memorium.exe	102
PID 368 wrote to memory of 1824	368	memorium.exe	102
PID 1824 wrote to memory of 3928	1824	cmd.exe	103
PID 1824 wrote to memory of 3928	1824	cmd.exe	103
PID 368 wrote to memory of 4844	368	memorium.exe	104
PID 368 wrote to memory of 4844	368	memorium.exe	104
PID 4844 wrote to memory of 1476	4844	cmd.exe	105
PID 4844 wrote to memory of 1476	4844	cmd.exe	105
PID 368 wrote to memory of 220	368	memorium.exe	106
PID 368 wrote to memory of 220	368	memorium.exe	106
PID 220 wrote to memory of 3224	220	cmd.exe	107
PID 220 wrote to memory of 3224	220	cmd.exe	107
PID 368 wrote to memory of 1308	368	memorium.exe	108
PID 368 wrote to memory of 1308	368	memorium.exe	108
PID 1308 wrote to memory of 5044	1308	cmd.exe	109
PID 1308 wrote to memory of 5044	1308	cmd.exe	109
PID 368 wrote to memory of 1316	368	memorium.exe	110
PID 368 wrote to memory of 1316	368	memorium.exe	110
PID 1316 wrote to memory of 4392	1316	cmd.exe	111
PID 1316 wrote to memory of 4392	1316	cmd.exe	111
PID 368 wrote to memory of 4412	368	memorium.exe	112
PID 368 wrote to memory of 4412	368	memorium.exe	112
PID 4412 wrote to memory of 1320	4412	cmd.exe	113
PID 4412 wrote to memory of 1320	4412	cmd.exe	113
PID 368 wrote to memory of 3608	368	memorium.exe	115
PID 368 wrote to memory of 3608	368	memorium.exe	115
PID 3608 wrote to memory of 4520	3608	cmd.exe	116
PID 3608 wrote to memory of 4520	3608	cmd.exe	116
PID 368 wrote to memory of 4996	368	memorium.exe	117
PID 368 wrote to memory of 4996	368	memorium.exe	117
PID 4996 wrote to memory of 2400	4996	cmd.exe	118
PID 4996 wrote to memory of 2400	4996	cmd.exe	118
PID 368 wrote to memory of 4820	368	memorium.exe	119
PID 368 wrote to memory of 4820	368	memorium.exe	119
PID 4820 wrote to memory of 1484	4820	cmd.exe	120
PID 4820 wrote to memory of 1484	4820	cmd.exe	120
PID 368 wrote to memory of 3124	368	memorium.exe	121
PID 368 wrote to memory of 3124	368	memorium.exe	121
PID 3124 wrote to memory of 8	3124	cmd.exe	122
PID 3124 wrote to memory of 8	3124	cmd.exe	122
PID 368 wrote to memory of 1988	368	memorium.exe	123
PID 368 wrote to memory of 1988	368	memorium.exe	123
PID 1988 wrote to memory of 4676	1988	cmd.exe	124
PID 1988 wrote to memory of 4676	1988	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\memorium.exe
"C:\Users\Admin\AppData\Local\Temp\memorium.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im epicgameslauncher.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicWebHelper.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicWebHelper.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient - Win64 - Shipping_EAC.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient - Win64 - Shipping_EAC.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient - Win64 - Shipping_BE.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient - Win64 - Shipping_BE.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteLauncher.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient - Win64 - Shipping.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im FortniteClient - Win64 - Shipping.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im EasyAntiCheat.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BEService.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:8
  - - C:\Windows\system32\reg.exe
      REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d 4359572-4348-17746-12159 /f
      4⤵
      Modifies registry key
      PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BEServices.exe > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im BattleEye.exe > nul
  2⤵
  PID:1264
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - Cerber
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop BattlEye Service
  2⤵
  PID:4488
- - C:\Windows\system32\sc.exe
    sc stop BattlEye Service
    3⤵
    - Launches sc.exe
    PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop EasyAntiCheat
  2⤵
  PID:3620
- - C:\Windows\system32\sc.exe
    sc stop EasyAntiCheat
    3⤵
    - Launches sc.exe
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Volumeid(s):
  2⤵
  PID:3516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol C:
  2⤵
  PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol D:
  2⤵
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Motherboard:
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
  2⤵
  PID:3484
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CHASSIS:
  2⤵
  PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic systemenclosure get serialnumber
  2⤵
  PID:2808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic systemenclosure get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo SMBIOS:
  2⤵
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2844
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_computersystemproduct get uuid
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo BIOS:
  2⤵
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
  2⤵
  PID:4528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CPU:
  2⤵
  PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
  2⤵
  PID:1780
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get serialnumber
    3⤵
    PID:3712
  - - C:\Windows\System32\zhjers.exe
      C:\Windows\System32\zhjers.exe /BS 4288-26251-4552-12641
      4⤵
      Cerber
      Executes dropped EXE
      PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Mac:
  2⤵
  PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac
  2⤵
  PID:3200
- - C:\Windows\system32\getmac.exe
    getmac
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo DISK SERIALS SHOULDN'T CHANGE
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /SU auto
  2⤵
  PID:636
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /SU auto
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /SS %random%-%random%
  2⤵
  PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /BS %random%-%random%-%random%-%random%
  2⤵
  PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /CS %random%-%random%-%random%
  2⤵
  PID:904
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /CS 4291-4232-22416
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /SK "To be filled by O.E.M"
  2⤵
  PID:3908
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /SK "To be filled by O.E.M"
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /SF "To be filled by O.E.M."
  2⤵
  PID:3148
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /SF "To be filled by O.E.M."
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /BT "To be filled by O.E.M."
  2⤵
  PID:3220
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /BT "To be filled by O.E.M."
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /BLC "To be filled by O.E.M."
  2⤵
  PID:4204
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /BLC "To be filled by O.E.M."
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:5100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /CA "To be filled by O.E.M."
  2⤵
  PID:2768
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /CA "To be filled by O.E.M."
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /CSK "To be filled by O.E.M."
  2⤵
  PID:4608
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /CSK "To be filled by O.E.M."
    3⤵
    - Cerber
    - Executes dropped EXE
    PID:3064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /IVN "American Megatrends International, LLC."
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /ID "06/27/23"
  2⤵
  PID:1344
- - C:\Windows\System32\zhjers.exe
    C:\Windows\System32\zhjers.exe /ID "06/27/23"
    3⤵
    PID:600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\zhjers.exe /IV "A.F0"
  2⤵
  PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vdfjdisfudasu.exe C:\ 1C6E-93E4
  2⤵
  PID:1520
- - C:\Windows\System32\vdfjdisfudasu.exe
    C:\Windows\System32\vdfjdisfudasu.exe C:\ 1C6E-93E4
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vdfjdisfudasu.exe E:\ 7CE9-36BC
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\vdfjdisfudasu.exe D:\ 1B9B-2091
  2⤵
  PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d %random%%random%-%random%-%random%-%random% /f
  2⤵
  PID:3056
- - C:\Windows\system32\reg.exe
    REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d 4359572-4348-17746-12159 /f
    3⤵
    - Modifies registry key
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildLabEx /t REG_SZ /d %random% /f
  2⤵
  PID:1036
- - C:\Windows\system32\reg.exe
    REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildLabEx /t REG_SZ /d 4359 /f
    3⤵
    - Modifies registry key
    PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic computersystem where name=%computername% call rename=%random%
  2⤵
  PID:1404
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem where name=EYHRDPTG call rename=4359
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {%random%%random%-%random%-%random%-%random%%random%} /f
  2⤵
  PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_SZ /d %random% /f
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d %random%%random% /f
  2⤵
  PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d %random%%random%-%random%-%random%-%random% /f
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Volumeid(s):
  2⤵
  PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol C:
  2⤵
  PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vol D:
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Motherboard:
  2⤵
  PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber
  2⤵
  PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CHASSIS:
  2⤵
  PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic systemenclosure get serialnumber
  2⤵
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo SMBIOS:
  2⤵
  PID:1344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_computersystemproduct get uuid
  2⤵
  PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo BIOS:
  2⤵
  PID:1004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic bios get serialnumber
  2⤵
  PID:376
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo CPU:
  2⤵
  PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get serialnumber
  2⤵
  PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo Mac:
  2⤵
  PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c getmac
  2⤵
  PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo DISK SERIALS SHOULDN'T CHANGE
  2⤵
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5024

C:\Windows\System32\zhjers.exe
C:\Windows\System32\zhjers.exe /SS 4288-26251
1⤵
- Cerber
- Executes dropped EXE
PID:4676

C:\Windows\System32\zhjers.exe
C:\Windows\System32\zhjers.exe /IVN "American Megatrends International, LLC."
1⤵
- Executes dropped EXE
PID:4476

C:\Windows\System32\zhjers.exe
C:\Windows\System32\zhjers.exe /IV "A.F0"
1⤵
PID:2436

C:\Windows\System32\vdfjdisfudasu.exe
C:\Windows\System32\vdfjdisfudasu.exe D:\ 1B9B-2091
1⤵
PID:952

C:\Windows\System32\vdfjdisfudasu.exe
C:\Windows\System32\vdfjdisfudasu.exe E:\ 7CE9-36BC
1⤵
PID:1292

C:\Windows\system32\reg.exe
REG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {4359572-4348-17746-121598345} /f
1⤵
- Modifies registry key
PID:3652

C:\Windows\system32\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_SZ /d 4359 /f
1⤵
- Modifies registry key
PID:404

C:\Windows\system32\reg.exe
REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 4359572 /f
1⤵
- Modifies registry key
PID:388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4608

C:\Windows\System32\Wbem\WMIC.exe
wmic baseboard get serialnumber
1⤵
PID:3652

C:\Windows\System32\Wbem\WMIC.exe
wmic systemenclosure get serialnumber
1⤵
PID:1460

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_computersystemproduct get uuid
1⤵
PID:2044

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get serialnumber
1⤵
PID:904

C:\Windows\system32\getmac.exe
getmac
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\amifldrv64.sys

Filesize
29KB

MD5
f22740ba54a400fd2be7690bb204aa08

SHA1
5812387783d61c6ab5702213bb968590a18065e3

SHA256
65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9

SHA512
ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500

Download Submit
C:\Windows\System32\vdfjdisfudasu.exe

Filesize
110KB

MD5
bae958a8bc719b40071b326ea518aad1

SHA1
2b569acb88b6d3e7d4c8c4644bb54778c524c48a

SHA256
0142b7fdf0f9f803625aeaadc318971d81b2df4e76e5e17b2914d0959aa2d6ed

SHA512
559eed92dba9cbcc351fafa602daf961a12375b3e52e5920296a6b584b6511c8619deb80c183be58b58157d47c4d9d650b65cd51facffd6fbfcf52a9e42a08fa

Download Submit
C:\Windows\System32\vdfjdisfudasu.exe

Filesize
39KB

MD5
6d92487a3157d27c93102d18d2f7198a

SHA1
166bfe5b85227d24839a7af02d7156009ca086cf

SHA256
5448d31a6c0002b5ab8356bd68c8b40c830f5aa0427b4bbf915b6ba17157b18f

SHA512
e0e34363f488774b92b31ee93d8a1bdeba071b7e2bb014fa4cd17fd69edb5117380b093bee51564f3a50b1086454cc28f2d59c014d24a49fcf67bba858854b53

Download Submit
C:\Windows\System32\vdfjdisfudasu.exe

Filesize
17KB

MD5
6a61203de060723e97ed7b65cd6f7bd0

SHA1
352062a111a3c9bed28282e7e5e6882947f9f73f

SHA256
919887e03592f745870a404056ec41bb1407d8dc5c6cb090ae770fee1acb5bf2

SHA512
469d9ae8596955b00fa9023918f3ffadf5f7405da24ad2f8260f53600bb8b8c18085f11becfe2841a3a932017c8bbd810688ef6240daf9d465bf94bd52aebff4

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
123KB

MD5
cae0abe8f8198fdef791be6212c5b566

SHA1
0b89992ba85621eaab90d63712ff787ea3a0a3f7

SHA256
374da733d89b72354d7a1944bb999648fca230dbf38c333d647906726820922d

SHA512
e3d83a6f41c8769b414401ebcbf9121229bd2781f34b109f860e44cff64090030097aec52d54a0774a98f6446a818701b9ab1d5c105470295e51311863cde5f3

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
102KB

MD5
2cb4f473fed508de278ab428a0658de4

SHA1
6cf30aaf671d4fef24f741698b31e21e8fa281fb

SHA256
4c49f35f9ec023b6f25b53074ee78d0f5ccabb05e245fdd7af90a1251f332343

SHA512
a8b6322a2ab1e554642f9ab8424643d97518f908f89d3bdc4feee970d159c2eb8f70905d9a64c51f027490c51a5da71569bbbfed9bbfc4add9b21223bb5504c9

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
65KB

MD5
443ca362e0e957abb44ec92b14770e7c

SHA1
7a54d8cd640efccdcfcba109dee297da1eda2285

SHA256
64bd1f463b33936241c53d55364b60a9a195e2f9c855548d63a45f61195c9ccc

SHA512
c64e76c5646c5aa3dc142e387a2cf4c85f195a1e6528cd147a96812461f9e082dfc1050b87bf4b36c44ce930e4a96b502fdb79d4b5f734ed09c574684d622f51

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
84KB

MD5
78e144a4a6ba9d850ba132940c1b033b

SHA1
e00623d11c7962e2aa10bcdc6f43116616e86207

SHA256
868d5f9f1e600c342392fee4e9c2572d1f72b1560080c8773a5bd57354c9a8c9

SHA512
82a7df042a2e1065652f968a17414c13a66b2444b0f44cb039ad292604bdcbba28e63bdfb48e2d58cb477f3dedb1e424799f731aaa4ded477f5f5bcd5826d123

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
151KB

MD5
f6eb3a285f71552d284a0e2f353569e8

SHA1
d43dace3217955ce41da9da514d7d299761b9ff1

SHA256
e8b4b811924810beee42f6b8fcb70f3629a1026ac28570837f6ad32232115553

SHA512
df3fac32e80b66e718e636f5f0d81f392efa4773e2686779a3d03e07bf862f982e31702ac9431ac9f4534fb10ce7e11aa978e71c3c323c42a80c8a9813a4d284

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
15KB

MD5
bf0c0278487f4a426305dbd26c072e7a

SHA1
b754f676219d1ec2b155596efefc348fe8ee75a8

SHA256
66f38f8a13a458d3c57b6a4a86a655e896560198d103add897fc29a9c2ef06f0

SHA512
4d08de950827d71b3af3ffdaf1d10ef2dcc1c53458cce5655aa8117ee4d44cb7b063f717fd337db11551fcd340f19171a924f13a30fd190d01440f63de70ce49

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
97KB

MD5
8d9d5100a22eb75a2568c9f2fe09632e

SHA1
54a37edaf8516c50d3bde3991dbabe6d16129c82

SHA256
5cb1bfc78af7114167f9c876f9daafc3e19a6b8342c6f73b2bd94504bb16732d

SHA512
41475d4eab64f822842aae31075a6745b85ca24c9db743ddb30514914feaa0da8b23cad543e6d6f021de6c090f76182e23b89ed6dcaebc5b5a8eeb0e3eb305eb

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
113KB

MD5
7fb129a96ffa7cfdf695ca0193e4a083

SHA1
eae9714df05c2231c145ff31f32cab55500ede7e

SHA256
3d11b807e1547303e0391d8b6458ff67f0ae68615da4162ae04447322ad413f0

SHA512
1966e5667f82b93e47da8690c82672f5262fa6ad1cdcf6f3e54b35ceaab93a517c975d4d53463d73ed43b86c5d2c2d5df3b67e2fd98d29e8e222778870dfdae7

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
327KB

MD5
0019893fc6514821617f901fc6c42945

SHA1
ea98981dcf95f16ed7d4f851ebf171206c573aa5

SHA256
bfc3eb77578987ac85bd6abd27c7c5d33448cbd162cdc045853bbf9ff0d30f84

SHA512
7903e7b4816ba20fff0007cc6fba933f8662d2f1ff5d8ce935a2b34f669c38997baf2ef827e71d74e1e3a27559a601a42aea33a5ea1124e464f39e221f033891

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
230KB

MD5
158f2f592b9a9053e40b71dd31fe6ce9

SHA1
937fa870d2b195604ae77286d0b250d07adf24d0

SHA256
c1f38ef765866022ecfa380f16f75302ecbb4493e92c4ecbe2885e9ee23ad56e

SHA512
c58605984cbd8d717ef99477e5ada320db3380f92bd2fd495949064b23e91fb1e10d17f036cc5349b8993f2ec1ab89909f39efc365558cf2f625b3d92ec25275

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
28KB

MD5
2fc711de74dddfdcb256821cc068b115

SHA1
671968eb1ef61231510ddd748e6f8d0d1cea9c16

SHA256
1595dd9cdb7dabdacac602977f2d639946a9317b4b73092e1acc045f561b39ea

SHA512
90e7f100188ba2d5c3429021523b4157e9f11ea4cf604c2871f719c5b3b6342883b3b8b226868c921246eb84e6d42e83f7f47d866c800a2aad997ed28b5ace74

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
151KB

MD5
85ab74a26bc0cf6b3a36367867d5075d

SHA1
9d43f6048f7ad6b6aa801d4c45d261256cd3ee34

SHA256
7b27b9031eacbdaba479dcc1756a5ba3c9205913ce986c803cfc4505ba25878f

SHA512
640ee57d93ec922aa6ce46ce5ece6f3061c7860885fb2ea3570aac44313fbb5245060895ead24b4de6bd1b90dcd53297357f9accbc6999785eceb40778cfd5d4

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
125KB

MD5
6423fcc249e0e4290d316efc12dd62b5

SHA1
d8cfc9179e0710c32b62199a6ee8b08e194b6468

SHA256
9a23fd374af7d6314e9b6e5992d110694e24710636f66bf951795306cfceb244

SHA512
8228aa16413119b62a69e7eaffbd09a0128df799b442b1762e3291fda63dd2c1c276c97b5ca896f4856515c3d46a6d2d2c60849d7b8a3edc01ec171aef8b38bb

Download Submit
C:\Windows\System32\zhjers.exe

Filesize
58KB

MD5
5244fcb9e640a2394fa5e2fb4d8f2d22

SHA1
f0617b5b2672901556443d1a3da0afa6b15895da

SHA256
b52a5d7746a4fb3fb2d65d9c8ac24ee3fba53203ec064840b0f8030ecbd9862c

SHA512
86c64dfd033b0a7393ae0cb6a63ab4d297286e7cd1f98ee1f7750ba150265d85a37e69c8028e29d3379f27e4ffd0b77746b0a01cbb8a444bf35bc44b3ac45ff0

Download Submit