3c6d5bfca4b3c7c493c25a6ee4821c83ffd8dc30934042c1146df5e334834e33

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4eb26f641938ee339279976307815cd.exe
Size

307KB
MD5

a4eb26f641938ee339279976307815cd
SHA1

ba4eef2b1746427df37dde4c5de1b7b697e0f169
SHA256

3c6d5bfca4b3c7c493c25a6ee4821c83ffd8dc30934042c1146df5e334834e33
SHA512

99df74379b08f1758c01164794046bfc83cf69ba6c98d8cefc1298a2106fa2e617435dae406aa3c230675da377dc607ff95856a6c5b4e6b66b39469d2a5e3221
SSDEEP

3072:Qo6NFU1bWdp91EQoQ9Qg+Q+jS3AvAniOktt61ky/6DiKT:Q1NFwbcz1EQoQ9L+Q+W3LVkO1ktj

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklmgb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnobnmpl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhhadmk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebjglbml.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhacojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egafleqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebjglbml.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baakhm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnmehnan.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnoomqbg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emieil32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Endhhp32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqijej32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cghggc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlkepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekhhadmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fidoim32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgejac32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednpej32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndlim32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a4eb26f641938ee339279976307815cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cghggc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccagcgk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egoife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egoife32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fidoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cklmgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnmehnan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dndlim32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgppi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehgppi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlgpgef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emieil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnoomqbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkcofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ednpej32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egafleqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	a4eb26f641938ee339279976307815cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgejac32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doehqead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doehqead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlkepi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlgpgef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqijej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baakhm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dccagcgk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkcofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enhacojl.exe

Executes dropped EXE 27 IoCs

pid	Process
2296	Baakhm32.exe
2776	Cklmgb32.exe
2796	Cnmehnan.exe
2956	Cgejac32.exe
1660	Cnobnmpl.exe
1480	Cghggc32.exe
2848	Cdlgpgef.exe
2944	Dndlim32.exe
1912	Doehqead.exe
1144	Dhnmij32.exe
528	Dccagcgk.exe
1716	Dlkepi32.exe
2600	Dfdjhndl.exe
2344	Dnoomqbg.exe
2984	Dkcofe32.exe
2264	Ehgppi32.exe
2096	Endhhp32.exe
2356	Ednpej32.exe
1696	Ekhhadmk.exe
1560	Emieil32.exe
1340	Egoife32.exe
1008	Enhacojl.exe
2528	Egafleqm.exe
3020	Eqijej32.exe
1704	Ebjglbml.exe
2208	Fidoim32.exe
1724	Fkckeh32.exe

Loads dropped DLL 58 IoCs

pid	Process
2404	a4eb26f641938ee339279976307815cd.exe
2404	a4eb26f641938ee339279976307815cd.exe
2296	Baakhm32.exe
2296	Baakhm32.exe
2776	Cklmgb32.exe
2776	Cklmgb32.exe
2796	Cnmehnan.exe
2796	Cnmehnan.exe
2956	Cgejac32.exe
2956	Cgejac32.exe
1660	Cnobnmpl.exe
1660	Cnobnmpl.exe
1480	Cghggc32.exe
1480	Cghggc32.exe
2848	Cdlgpgef.exe
2848	Cdlgpgef.exe
2944	Dndlim32.exe
2944	Dndlim32.exe
1912	Doehqead.exe
1912	Doehqead.exe
1144	Dhnmij32.exe
1144	Dhnmij32.exe
528	Dccagcgk.exe
528	Dccagcgk.exe
1716	Dlkepi32.exe
1716	Dlkepi32.exe
2600	Dfdjhndl.exe
2600	Dfdjhndl.exe
2344	Dnoomqbg.exe
2344	Dnoomqbg.exe
2984	Dkcofe32.exe
2984	Dkcofe32.exe
2264	Ehgppi32.exe
2264	Ehgppi32.exe
2096	Endhhp32.exe
2096	Endhhp32.exe
2356	Ednpej32.exe
2356	Ednpej32.exe
1696	Ekhhadmk.exe
1696	Ekhhadmk.exe
1560	Emieil32.exe
1560	Emieil32.exe
1340	Egoife32.exe
1340	Egoife32.exe
1008	Enhacojl.exe
1008	Enhacojl.exe
2528	Egafleqm.exe
2528	Egafleqm.exe
3020	Eqijej32.exe
3020	Eqijej32.exe
1704	Ebjglbml.exe
1704	Ebjglbml.exe
2208	Fidoim32.exe
2208	Fidoim32.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Endhhp32.exe	Ehgppi32.exe
File created	C:\Windows\SysWOW64\Eqijej32.exe	Egafleqm.exe
File opened for modification	C:\Windows\SysWOW64\Fkckeh32.exe	Fidoim32.exe
File opened for modification	C:\Windows\SysWOW64\Cklmgb32.exe	Baakhm32.exe
File opened for modification	C:\Windows\SysWOW64\Dhnmij32.exe	Doehqead.exe
File opened for modification	C:\Windows\SysWOW64\Dfdjhndl.exe	Dlkepi32.exe
File created	C:\Windows\SysWOW64\Mmnclh32.dll	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Cghggc32.exe	Cnobnmpl.exe
File opened for modification	C:\Windows\SysWOW64\Egoife32.exe	Emieil32.exe
File opened for modification	C:\Windows\SysWOW64\Enhacojl.exe	Egoife32.exe
File opened for modification	C:\Windows\SysWOW64\Cgejac32.exe	Cnmehnan.exe
File opened for modification	C:\Windows\SysWOW64\Cghggc32.exe	Cnobnmpl.exe
File opened for modification	C:\Windows\SysWOW64\Emieil32.exe	Ekhhadmk.exe
File created	C:\Windows\SysWOW64\Egoife32.exe	Emieil32.exe
File created	C:\Windows\SysWOW64\Khknah32.dll	Ebjglbml.exe
File created	C:\Windows\SysWOW64\Clkmne32.dll	Fidoim32.exe
File created	C:\Windows\SysWOW64\Cklmgb32.exe	Baakhm32.exe
File created	C:\Windows\SysWOW64\Olkbjhpi.dll	Baakhm32.exe
File created	C:\Windows\SysWOW64\Cdlgpgef.exe	Cghggc32.exe
File created	C:\Windows\SysWOW64\Loinmo32.dll	Cghggc32.exe
File created	C:\Windows\SysWOW64\Ffpncj32.dll	Emieil32.exe
File created	C:\Windows\SysWOW64\Baakhm32.exe	a4eb26f641938ee339279976307815cd.exe
File created	C:\Windows\SysWOW64\Doehqead.exe	Dndlim32.exe
File created	C:\Windows\SysWOW64\Jdjfho32.dll	Dlkepi32.exe
File opened for modification	C:\Windows\SysWOW64\Ehgppi32.exe	Dkcofe32.exe
File created	C:\Windows\SysWOW64\Dmkmmi32.dll	Eqijej32.exe
File created	C:\Windows\SysWOW64\Fidoim32.exe	Ebjglbml.exe
File created	C:\Windows\SysWOW64\Cnobnmpl.exe	Cgejac32.exe
File created	C:\Windows\SysWOW64\Dkcofe32.exe	Dnoomqbg.exe
File opened for modification	C:\Windows\SysWOW64\Ednpej32.exe	Endhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Egafleqm.exe	Enhacojl.exe
File created	C:\Windows\SysWOW64\Amfidj32.dll	Ednpej32.exe
File created	C:\Windows\SysWOW64\Egafleqm.exe	Enhacojl.exe
File created	C:\Windows\SysWOW64\Cnmehnan.exe	Cklmgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cnobnmpl.exe	Cgejac32.exe
File created	C:\Windows\SysWOW64\Dnoomqbg.exe	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Bpbbfi32.dll	Endhhp32.exe
File created	C:\Windows\SysWOW64\Emieil32.exe	Ekhhadmk.exe
File created	C:\Windows\SysWOW64\Gjpmgg32.dll	Cdlgpgef.exe
File opened for modification	C:\Windows\SysWOW64\Doehqead.exe	Dndlim32.exe
File created	C:\Windows\SysWOW64\Fileil32.dll	Doehqead.exe
File created	C:\Windows\SysWOW64\Dlkepi32.exe	Dccagcgk.exe
File created	C:\Windows\SysWOW64\Ebjglbml.exe	Eqijej32.exe
File opened for modification	C:\Windows\SysWOW64\Ebjglbml.exe	Eqijej32.exe
File created	C:\Windows\SysWOW64\Hdjlnm32.dll	Cnmehnan.exe
File created	C:\Windows\SysWOW64\Ajfaqa32.dll	Dccagcgk.exe
File created	C:\Windows\SysWOW64\Ampehe32.dll	Egoife32.exe
File created	C:\Windows\SysWOW64\Pgicjg32.dll	Enhacojl.exe
File opened for modification	C:\Windows\SysWOW64\Cnmehnan.exe	Cklmgb32.exe
File created	C:\Windows\SysWOW64\Opiehf32.dll	Cklmgb32.exe
File opened for modification	C:\Windows\SysWOW64\Eqijej32.exe	Egafleqm.exe
File created	C:\Windows\SysWOW64\Dccagcgk.exe	Dhnmij32.exe
File opened for modification	C:\Windows\SysWOW64\Dnoomqbg.exe	Dfdjhndl.exe
File created	C:\Windows\SysWOW64\Cbcodmih.dll	Dnoomqbg.exe
File created	C:\Windows\SysWOW64\Endhhp32.exe	Ehgppi32.exe
File opened for modification	C:\Windows\SysWOW64\Baakhm32.exe	a4eb26f641938ee339279976307815cd.exe
File created	C:\Windows\SysWOW64\Khjjpi32.dll	a4eb26f641938ee339279976307815cd.exe
File created	C:\Windows\SysWOW64\Cgejac32.exe	Cnmehnan.exe
File created	C:\Windows\SysWOW64\Dndlim32.exe	Cdlgpgef.exe
File created	C:\Windows\SysWOW64\Ednpej32.exe	Endhhp32.exe
File created	C:\Windows\SysWOW64\Klmkof32.dll	Egafleqm.exe
File created	C:\Windows\SysWOW64\Mnghjbjl.dll	Cnobnmpl.exe
File opened for modification	C:\Windows\SysWOW64\Dndlim32.exe	Cdlgpgef.exe
File created	C:\Windows\SysWOW64\Geemiobo.dll	Dkcofe32.exe

Program crash 1 IoCs

pid	pid_target	Process
1532	1724	WerFault.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	a4eb26f641938ee339279976307815cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	a4eb26f641938ee339279976307815cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnclh32.dll"	Dfdjhndl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnoomqbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhnmij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlkepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfidj32.dll"	Ednpej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egafleqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Loinmo32.dll"	Cghggc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plnoej32.dll"	Dndlim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqijej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdlgpgef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhnmij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geemiobo.dll"	Dkcofe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehgppi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aabagnfc.dll"	Ehgppi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enhacojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khknah32.dll"	Ebjglbml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cghggc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fileil32.dll"	Doehqead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doehqead.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkcofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehgppi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ednpej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enhacojl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnmehnan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpmgg32.dll"	Cdlgpgef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iifjjk32.dll"	Dhnmij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emieil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emieil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egoife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fidoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	a4eb26f641938ee339279976307815cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkbjhpi.dll"	Baakhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baakhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cghggc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphdelhp.dll"	Ekhhadmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnghjbjl.dll"	Cnobnmpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdjfho32.dll"	Dlkepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egafleqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fidoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnfhlh32.dll"	Cgejac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgejac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlkepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Endhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpncj32.dll"	Emieil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnmehnan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dndlim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkcofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekhhadmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqijej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clkmne32.dll"	Fidoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opiehf32.dll"	Cklmgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfdjhndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbcodmih.dll"	Dnoomqbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ednpej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampehe32.dll"	Egoife32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebjglbml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egoife32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khjjpi32.dll"	a4eb26f641938ee339279976307815cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	a4eb26f641938ee339279976307815cd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgejac32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2296	2404	a4eb26f641938ee339279976307815cd.exe	28
PID 2404 wrote to memory of 2296	2404	a4eb26f641938ee339279976307815cd.exe	28
PID 2404 wrote to memory of 2296	2404	a4eb26f641938ee339279976307815cd.exe	28
PID 2404 wrote to memory of 2296	2404	a4eb26f641938ee339279976307815cd.exe	28
PID 2296 wrote to memory of 2776	2296	Baakhm32.exe	29
PID 2296 wrote to memory of 2776	2296	Baakhm32.exe	29
PID 2296 wrote to memory of 2776	2296	Baakhm32.exe	29
PID 2296 wrote to memory of 2776	2296	Baakhm32.exe	29
PID 2776 wrote to memory of 2796	2776	Cklmgb32.exe	55
PID 2776 wrote to memory of 2796	2776	Cklmgb32.exe	55
PID 2776 wrote to memory of 2796	2776	Cklmgb32.exe	55
PID 2776 wrote to memory of 2796	2776	Cklmgb32.exe	55
PID 2796 wrote to memory of 2956	2796	Cnmehnan.exe	54
PID 2796 wrote to memory of 2956	2796	Cnmehnan.exe	54
PID 2796 wrote to memory of 2956	2796	Cnmehnan.exe	54
PID 2796 wrote to memory of 2956	2796	Cnmehnan.exe	54
PID 2956 wrote to memory of 1660	2956	Cgejac32.exe	53
PID 2956 wrote to memory of 1660	2956	Cgejac32.exe	53
PID 2956 wrote to memory of 1660	2956	Cgejac32.exe	53
PID 2956 wrote to memory of 1660	2956	Cgejac32.exe	53
PID 1660 wrote to memory of 1480	1660	Cnobnmpl.exe	30
PID 1660 wrote to memory of 1480	1660	Cnobnmpl.exe	30
PID 1660 wrote to memory of 1480	1660	Cnobnmpl.exe	30
PID 1660 wrote to memory of 1480	1660	Cnobnmpl.exe	30
PID 1480 wrote to memory of 2848	1480	Cghggc32.exe	52
PID 1480 wrote to memory of 2848	1480	Cghggc32.exe	52
PID 1480 wrote to memory of 2848	1480	Cghggc32.exe	52
PID 1480 wrote to memory of 2848	1480	Cghggc32.exe	52
PID 2848 wrote to memory of 2944	2848	Cdlgpgef.exe	51
PID 2848 wrote to memory of 2944	2848	Cdlgpgef.exe	51
PID 2848 wrote to memory of 2944	2848	Cdlgpgef.exe	51
PID 2848 wrote to memory of 2944	2848	Cdlgpgef.exe	51
PID 2944 wrote to memory of 1912	2944	Dndlim32.exe	50
PID 2944 wrote to memory of 1912	2944	Dndlim32.exe	50
PID 2944 wrote to memory of 1912	2944	Dndlim32.exe	50
PID 2944 wrote to memory of 1912	2944	Dndlim32.exe	50
PID 1912 wrote to memory of 1144	1912	Doehqead.exe	49
PID 1912 wrote to memory of 1144	1912	Doehqead.exe	49
PID 1912 wrote to memory of 1144	1912	Doehqead.exe	49
PID 1912 wrote to memory of 1144	1912	Doehqead.exe	49
PID 1144 wrote to memory of 528	1144	Dhnmij32.exe	48
PID 1144 wrote to memory of 528	1144	Dhnmij32.exe	48
PID 1144 wrote to memory of 528	1144	Dhnmij32.exe	48
PID 1144 wrote to memory of 528	1144	Dhnmij32.exe	48
PID 528 wrote to memory of 1716	528	Dccagcgk.exe	47
PID 528 wrote to memory of 1716	528	Dccagcgk.exe	47
PID 528 wrote to memory of 1716	528	Dccagcgk.exe	47
PID 528 wrote to memory of 1716	528	Dccagcgk.exe	47
PID 1716 wrote to memory of 2600	1716	Dlkepi32.exe	46
PID 1716 wrote to memory of 2600	1716	Dlkepi32.exe	46
PID 1716 wrote to memory of 2600	1716	Dlkepi32.exe	46
PID 1716 wrote to memory of 2600	1716	Dlkepi32.exe	46
PID 2600 wrote to memory of 2344	2600	Dfdjhndl.exe	45
PID 2600 wrote to memory of 2344	2600	Dfdjhndl.exe	45
PID 2600 wrote to memory of 2344	2600	Dfdjhndl.exe	45
PID 2600 wrote to memory of 2344	2600	Dfdjhndl.exe	45
PID 2344 wrote to memory of 2984	2344	Dnoomqbg.exe	44
PID 2344 wrote to memory of 2984	2344	Dnoomqbg.exe	44
PID 2344 wrote to memory of 2984	2344	Dnoomqbg.exe	44
PID 2344 wrote to memory of 2984	2344	Dnoomqbg.exe	44
PID 2984 wrote to memory of 2264	2984	Dkcofe32.exe	43
PID 2984 wrote to memory of 2264	2984	Dkcofe32.exe	43
PID 2984 wrote to memory of 2264	2984	Dkcofe32.exe	43
PID 2984 wrote to memory of 2264	2984	Dkcofe32.exe	43

C:\Users\Admin\AppData\Local\Temp\a4eb26f641938ee339279976307815cd.exe
"C:\Users\Admin\AppData\Local\Temp\a4eb26f641938ee339279976307815cd.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\Baakhm32.exe
  C:\Windows\system32\Baakhm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\Cklmgb32.exe
    C:\Windows\system32\Cklmgb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\Cnmehnan.exe
      C:\Windows\system32\Cnmehnan.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2796

C:\Windows\SysWOW64\Cghggc32.exe
C:\Windows\system32\Cghggc32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\Cdlgpgef.exe
  C:\Windows\system32\Cdlgpgef.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2848

C:\Windows\SysWOW64\Fidoim32.exe
C:\Windows\system32\Fidoim32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2208
- C:\Windows\SysWOW64\Fkckeh32.exe
  C:\Windows\system32\Fkckeh32.exe
  2⤵
  - Executes dropped EXE
  PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 140
1⤵
- Loads dropped DLL
- Program crash
PID:1532

C:\Windows\SysWOW64\Ebjglbml.exe
C:\Windows\system32\Ebjglbml.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1704

C:\Windows\SysWOW64\Eqijej32.exe
C:\Windows\system32\Eqijej32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:3020

C:\Windows\SysWOW64\Egafleqm.exe
C:\Windows\system32\Egafleqm.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2528

C:\Windows\SysWOW64\Enhacojl.exe
C:\Windows\system32\Enhacojl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1008

C:\Windows\SysWOW64\Egoife32.exe
C:\Windows\system32\Egoife32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1340

C:\Windows\SysWOW64\Emieil32.exe
C:\Windows\system32\Emieil32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1560

C:\Windows\SysWOW64\Ekhhadmk.exe
C:\Windows\system32\Ekhhadmk.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1696

C:\Windows\SysWOW64\Ednpej32.exe
C:\Windows\system32\Ednpej32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2356

C:\Windows\SysWOW64\Endhhp32.exe
C:\Windows\system32\Endhhp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2096

C:\Windows\SysWOW64\Ehgppi32.exe
C:\Windows\system32\Ehgppi32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:2264

C:\Windows\SysWOW64\Dkcofe32.exe
C:\Windows\system32\Dkcofe32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984

C:\Windows\SysWOW64\Dnoomqbg.exe
C:\Windows\system32\Dnoomqbg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\Dfdjhndl.exe
C:\Windows\system32\Dfdjhndl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\SysWOW64\Dlkepi32.exe
C:\Windows\system32\Dlkepi32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\Dccagcgk.exe
C:\Windows\system32\Dccagcgk.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\Dhnmij32.exe
C:\Windows\system32\Dhnmij32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\Doehqead.exe
C:\Windows\system32\Doehqead.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\Dndlim32.exe
C:\Windows\system32\Dndlim32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\Cnobnmpl.exe
C:\Windows\system32\Cnobnmpl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\Cgejac32.exe
C:\Windows\system32\Cgejac32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cgejac32.exe

Filesize
307KB

MD5
9bbc77319d5eff05450911ff7ca326a4

SHA1
c8b66e6c61fd46db366813b2935232a57f4793a9

SHA256
02fcc82b3923ac6152776695b9da20a4c22cfa9ff7b61d44fa9b84c605ec27cb

SHA512
8d73e9a46f4a445fc41521ec2e54d9240445d175c791b4d354762025ea8d45a459b390f7adba961566ff93df263d8242861cd2d8e528587f8322b44ef8bcc856

Download Submit
C:\Windows\SysWOW64\Cghggc32.exe

Filesize
307KB

MD5
d630bdb4af99ae5b0c79fbb48aa807d0

SHA1
8587ace3ba73685361a24a85307662ced371d28d

SHA256
065b4376124f62e5e0f982d01b685958ab4ac61954d2cade42c7dd09d0896818

SHA512
002942b76d847d235d95e29bb111bb0e84bf6b5649fe2a0c7ef979aa13b1f9ca615049e434a046e6088551b169f5c0b4e8be189ce276417cc8d78e0dccb89612

Download Submit
C:\Windows\SysWOW64\Cnmehnan.exe

Filesize
307KB

MD5
c73605e883b46c2c6de82ecd370e7a2a

SHA1
c18d3e9a6e97243bc5f2e082039aba94c4d1d8c5

SHA256
36878834ca26d7af1af5737a189ff3ac803c6f26661db3883cd6c27198e5ecdc

SHA512
40dc6f3e58678f29c8f908b10b57b8abeda43fcd98acc0b9359f85dea644a7ffaf6cb50c520c9d88b01560ce2f1f48cd23c14eae98aaabb470e75b52d2420491

Download Submit
C:\Windows\SysWOW64\Cnobnmpl.exe

Filesize
307KB

MD5
0c5c9ed30d59e333f3b6c3d31d4f0f2c

SHA1
097a3ecad857c4d14790497a845f49740ecd8052

SHA256
4dac11ad75fe0d84ccd620956907e11b9dae854b3983beefaee4b22656d4609b

SHA512
f32b5c4c0c0bd4bdeb088e28cdfa82d997ca21ecbc69516b430abc45dadf01226d8163dbfa5adf1298d910a4009005a479ec0cae2c44a3d0b94cf8e324051eab

Download Submit
C:\Windows\SysWOW64\Dfdjhndl.exe

Filesize
307KB

MD5
b423180482115cdac4dab4ab71a487f6

SHA1
f122a1474a01a04725f8325d2fc3a4f23ba7efd0

SHA256
d4a995875c8804a0e429f36cf0525fc6b61bd01db5d42e61d710f70003873320

SHA512
d5cacb4a540618f2fcf4bef4eefe1a3bbbd10485cde1828b31de5e9561c72904875b3cd397f09bd7234030daac758a0774044e61ba555ec8370b8337aa5af0c1

Download Submit
C:\Windows\SysWOW64\Dhnmij32.exe

Filesize
307KB

MD5
96471b9ef2fe278a4b5efa15abab6aa8

SHA1
b54e49f8259d7e5e297c557b94e2999c85e980ea

SHA256
d1756a976be3664b32c01dbec461c56992a493a77ac864ad58fce2a4a88ffe34

SHA512
1d22c6084387aa92b5d31baccdaf3a876be2c198f7c16d12c3216a8e36ff728113dd1ce6e4050ec381ceea941a8571080e66dbf470455e8601eccb59e382645c

Download Submit
C:\Windows\SysWOW64\Dkcofe32.exe

Filesize
307KB

MD5
804e431c6c1415a7c51d08ca824cb609

SHA1
7a1228faa619e764fef131c4ff53adcf5b27b26c

SHA256
f4a6072e45825fdf9e15d18e01fc767b2b9d10228cca0a8439282e7d44626e6f

SHA512
561ba309962d3dc8f8a1805317d44870a682fd1bb767ee993ddf7f016aa4d4c33f5b57c28315e657667d23365951af202a77c86847354b0227b5aac83b227678

Download Submit
C:\Windows\SysWOW64\Doehqead.exe

Filesize
307KB

MD5
07b3442d32844697c8feb0c8bd2c9c9d

SHA1
75e7f28e77ec2812591857075d05af84e57bdbf9

SHA256
2a1bc4904a39229b39760bf427422fd117caf2a864819df2eb5023b0e8bdb0fc

SHA512
06ad4227c00dc00e51049688f8f62cc7799084079108aa5d5b769ddf133c179b20ca17bc38ab07979e94abce6b8a7178dfee5ea0eb143ba9e47e14765babf07a

Download Submit
C:\Windows\SysWOW64\Ebjglbml.exe

Filesize
307KB

MD5
d59fcd5bb6675f7a7923efdeeee2790c

SHA1
0ea420b7f9083ae33e733953291f3d34b5ba6ea3

SHA256
5c3884fe22d24119d0bea7b802ffd5bfc73271acbdc6494f0a781cd492b27a54

SHA512
0ea099b43548ce2a65f12abafc790da3f29d0c9a65c0c46db3c1fb380ea802127343a7ee8604a4807234c364d56f45df5906f8aa30d5875360d0f82c1c559bab

Download Submit
C:\Windows\SysWOW64\Ednpej32.exe

Filesize
307KB

MD5
dab6bf504d9912736e960900c6068c00

SHA1
7d81ad90e24e6d17e9d01b1746253e33744a6e99

SHA256
f65adfb3f995c9baca9f8c254d054d48b4dc6f6caeb0e98be217e977faf2bf99

SHA512
21908a84f5128e7524413841d1b36da9fc84338a0f7f35ea4e52f4835f701a02617ca8771859a53179f765014851ac1ab876de14c584eb50e0b0a45839ec75e3

Download Submit
C:\Windows\SysWOW64\Egafleqm.exe

Filesize
307KB

MD5
78f539f41d4cf7ea0e40cf2d419d3b2a

SHA1
2a61f672a09b106603cf7ee187cc0305d414622b

SHA256
d8a2e019bd614d761f73ea09a45048f7bc63d4da405535b64151650e90455dac

SHA512
cdbce936c35c17afe3aea042d3ed9b1d2c001722481b3efbb9ae7e207e20723c245e0a89737ec4d1f3c94e2ef95de352d7ab812e8e4743678d7a4acd20db8e27

Download Submit
C:\Windows\SysWOW64\Egoife32.exe

Filesize
307KB

MD5
6c7c81c05ee33e91b1eecd632e53d2ca

SHA1
fe8970cc6f5deda62f9fdb248ce2fe2d15a7de26

SHA256
deba6534d245852006b19c7c20305dda8a76c1c8a2df2a109e9c4bfe7a80f050

SHA512
8b8c7b85030c540dd680bc839f8b568f728906af650c35a055baa6d0dd9eb5ac9caeea3d85114aced22ec61021a9351496a39ae06a4ecce2f3230c4e60784f75

Download Submit
C:\Windows\SysWOW64\Ekhhadmk.exe

Filesize
307KB

MD5
b88145e31f763b68fbffd7f9cc26bf6f

SHA1
9e3bb8d037d6a27df90d2e01da3318c294ca35e5

SHA256
558118a4dc32c6367f967d8460bda78f45b5ea29cfb3d00bd8cdbe617575ff62

SHA512
681a8d5e3f7c9aca41d0365399255eba24a7ba1bde9a28f984769f026dc4fed249707ebb82e0afac7caf150befd06250c89ff695c1959f53091470e2c7614a7c

Download Submit
C:\Windows\SysWOW64\Emieil32.exe

Filesize
307KB

MD5
db3d801a7144a0c252f2f54c7b466253

SHA1
c573ab9f6e7295c359607fcef8bfd55dabe6e666

SHA256
10b78a90ff8bb0bc20ab0eadee6694448dad7a05ff9dd10d026c89d57acb753b

SHA512
b94cc8f0081b3bf72c7760bee996a4c24bb7cfff9210e198f81d8071f04e55db4230fa304a46b12180f4bd136b776b50144edaa499a019d998d2f9b9a4dd593c

Download Submit
C:\Windows\SysWOW64\Endhhp32.exe

Filesize
307KB

MD5
fc12b6264999cc5a9b68628cfd8d95ec

SHA1
fda4161fc95a5bc821d1224b126d3a56b06e5016

SHA256
99f956989f351e7929a531e8c70a763738345dc5b9f2032f784d19f766a388f5

SHA512
ce5d12b5a390308d75f4509af7e944aba28670509071496c7ff7cd372b7a04ce81a0dcb359e31e90ca16afc9726a731e858a2cc6ce7ec62b010cda6a360a8695

Download Submit
C:\Windows\SysWOW64\Enhacojl.exe

Filesize
307KB

MD5
1ef42fb77e3340f36f76fa8e755967d6

SHA1
50601fa453870adabb73996dfc0e6660691780f4

SHA256
91f11170d5eeea66c596cf4a0e95c030b4c279b659d7935f1ab90bcb80725954

SHA512
a61ad43a01e90551aebca2f65e821b9c41c102ffbb4155423caf8841b91cd7976cf49efcbbbca1bf2a14383819b977d194e81f1260391e426e53e6749a8fa7e3

Download Submit
C:\Windows\SysWOW64\Eqijej32.exe

Filesize
307KB

MD5
5308c2b0ac44acdf70b06c39963fc1ac

SHA1
2544f2f6e9575baf36e77d62173f8f9a328f4ba2

SHA256
364e1d61e85420c7944200777d81446f9ed8301907a6b19d49853bdb989db622

SHA512
454e6f5152994a049c29db1ce549359bc1ba68f09354b10621b23122502c7f94f3401d4361a37c6ee225a4203f49824d78578ef5b6cf21e3daea991e48830afa

Download Submit
C:\Windows\SysWOW64\Fidoim32.exe

Filesize
307KB

MD5
3b9c036a9c298fb3f88d694ca2ee5d4c

SHA1
f9a0467613836aa1ae5d99fab573b6f5620bae20

SHA256
48f60f309bbd706dffc0ea11c41404a2dc0bbdca6229536cb8e411bc31a3faae

SHA512
8015fd5b9aa176781f450a0af1d0c6fbbb072fa4aa491d2592e88f751a4a2aea05db5a52dc2e88e00ebd55be968d7a562e351cc3f4a4e5848ce650160246ead5

Download Submit
C:\Windows\SysWOW64\Fkckeh32.exe

Filesize
307KB

MD5
dfafa63116d95c21c714bb6d189769d3

SHA1
40c2bc71286034080226fa96294bfbe461eace6e

SHA256
4319261ef8622de4afb9b19c26d4c24dc21d91b175369c7534a9dc208686b1b4

SHA512
61cf749bdaf36cb1b488c40e6ee44f39ad2260ec299ccae5c5a65be0e247572bf42b614ba1d8db16af5577a796ef3338fbcc4aade8b2b6d40b1e101159fac252

Download Submit
\Windows\SysWOW64\Baakhm32.exe

Filesize
307KB

MD5
e3a518f19a0f4ee1db0bf83d327657e3

SHA1
33490fac6e2c8a0783117f8610dab6c1801077e9

SHA256
ef2357b328b645cb68ee770b0cee619cd68d39200a17121ed8878fbf1e3fc7d3

SHA512
c7ae870d2696ef3d80bd15d0a556a96e6fd6b893108e5ddcd0f42e8ab7e6f9eb282be650da575cd0a4d556584ea72502645d84f69f3afbdb2260dedc19439401

Download Submit
\Windows\SysWOW64\Cdlgpgef.exe

Filesize
307KB

MD5
73d5aba977d477e1945d517da262dea8

SHA1
7a5865b048f7decdd43d0a2f5eedff1a1cbf1522

SHA256
0c63b95273ce4da01d74bc9eec38fc2014d05eef51628bb820c1670e10d25f4e

SHA512
c7ff1721c36e4b2c4a4a5668f72f138666e70d447e9b819d085e1cf824b74964439474d5ebb9ea6ed1e1aa325a4e9cd319a0cf3b8b4abb6101f12e34f9f942ba

Download Submit
\Windows\SysWOW64\Cklmgb32.exe

Filesize
307KB

MD5
dc16f02f06922ff218e8fb8e2c8478fa

SHA1
5d9da754652203903a01c4ea512ebf687a8b0a42

SHA256
0e1171e96cec867ed4605805b1512874800ba127d4401b07e4d0b58115bbb5b5

SHA512
1bf011ccf9a314de51a41aef17834aa652a0964367d19d0fb81040c8fb9f3d2045c9d9f25c6eda7eccbd8d276088c8f34a7112fd8b6618432bb061bb752b1fe1

Download Submit
\Windows\SysWOW64\Dccagcgk.exe

Filesize
307KB

MD5
4ccdfdefa86ff0ce8caaa14a0c98de42

SHA1
4745a13c84a00cb6df0d6cc27598961b8782e536

SHA256
eaa85a03a3a3da0bdc45095781f2beeea27b43b52efaee7db96131c85445700b

SHA512
3dca5cd653e0b38fb1b99926eefa2ce211f367f4903d26e10d0831ea685e5c1ab767b4ddec15bd39d36755e5aad1a18b5f3164dc7d3d8f3b96a9caca05c28e2a

Download Submit
\Windows\SysWOW64\Dlkepi32.exe

Filesize
307KB

MD5
80c95d1c96a470cd61a414fd5665d7d4

SHA1
9e065a45a04d97d1b476b0586b6ffb5fc41d5968

SHA256
d679ffc1180495c70decec41a8dfd696367488c6d5b453b52a0c8358751973bf

SHA512
633b7fbd253c7998eaf44c1d01a94880785bf4b99c34de0f91aa5757f06c79d05ed185748ed8e01873c16f4e1f187a5bb03a62536e704f74f35b6470bc6b30b6

Download Submit
\Windows\SysWOW64\Dndlim32.exe

Filesize
307KB

MD5
032fa27a14d35549271588fbe61b9206

SHA1
a7fcb9250d510d19ae1fe92caec7b408ac7601de

SHA256
b1e43d64a7696641fb5ed35cd7a152a565c0a9ae28a2b3e2ebf4af38614343df

SHA512
769c6c886896199d9eb5fa3208b7ef809d7091fed5722af58dab14fb77031f3a4666e9a6fbd3e3afd6cd03b10cac96952c1dc5fb3906b66dcde491fc830e9e72

Download Submit
\Windows\SysWOW64\Dnoomqbg.exe

Filesize
307KB

MD5
7651766a59ebc872f238fab5aae6a5a9

SHA1
5f271d4ef763569400fc77cb05785844b9629aa3

SHA256
a97694f632ea00a8b41c3149981747791efe964b8e1d5fb65cf4b9a890b13b6a

SHA512
ba9792ea48c693f73a353fcc073cc2b93bf4385c4d59b6a9ae393fe6ac7d2af7239e0c2f8316ca93960796a5e5e67dfbd798420fb64baa3ec7982b6aa1fb52aa

Download Submit
\Windows\SysWOW64\Ehgppi32.exe

Filesize
307KB

MD5
c8f6e622a5b2ffeb9e5cc069cdd2a6c0

SHA1
48fa589f82e4023e5c9116944eddb9cfb10b71a7

SHA256
8d00af9dd6b4f86e365108aa47e5ddce5bf85bba6fc3bff9718c4c1c996787fe

SHA512
0cb2efc1fa315e17289a020479fa52ba269f2541b1c9e29c8ecc53311ed53213b9a561d3fc616c2ea6cf5706fd26ec86d3ceea8fa371443fac59216cda7c9f46

Download Submit
memory/528-157-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/528-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-291-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1008-295-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1144-144-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1144-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1144-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1340-284-0x0000000001B80000-0x0000000001BB3000-memory.dmp

Filesize
204KB

Download
memory/1340-283-0x0000000001B80000-0x0000000001BB3000-memory.dmp

Filesize
204KB

Download
memory/1340-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1340-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-93-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1480-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-273-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1560-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-272-0x00000000002C0000-0x00000000002F3000-memory.dmp

Filesize
204KB

Download
memory/1660-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-67-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1660-79-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1696-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1696-266-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1704-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-327-0x00000000003C0000-0x00000000003F3000-memory.dmp

Filesize
204KB

Download
memory/1704-333-0x00000000003C0000-0x00000000003F3000-memory.dmp

Filesize
204KB

Download
memory/1716-164-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1716-171-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/1716-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-240-0x00000000002B0000-0x00000000002E3000-memory.dmp

Filesize
204KB

Download
memory/2096-244-0x00000000002B0000-0x00000000002E3000-memory.dmp

Filesize
204KB

Download
memory/2096-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-340-0x0000000001B90000-0x0000000001BC3000-memory.dmp

Filesize
204KB

Download
memory/2208-338-0x0000000001B90000-0x0000000001BC3000-memory.dmp

Filesize
204KB

Download
memory/2264-235-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2264-234-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2264-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-25-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2296-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-19-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2344-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-251-0x00000000002B0000-0x00000000002E3000-memory.dmp

Filesize
204KB

Download
memory/2356-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-252-0x00000000002B0000-0x00000000002E3000-memory.dmp

Filesize
204KB

Download
memory/2404-6-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2404-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-305-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2528-310-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2528-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2600-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2600-189-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2600-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2776-34-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2776-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-53-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2848-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-108-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2944-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-123-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/2944-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2956-59-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2984-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2984-217-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2984-212-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2984-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3020-313-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/3020-321-0x0000000000220000-0x0000000000253000-memory.dmp

Filesize
204KB

Download
memory/3020-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads