76c0ce297cada60c06f972b29d15e16befde9c78b9f7ebb925be633a2f1a20da

Analysis

max time kernel
0s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff05d1fdbe4ab19b12591f82f85f6013.exe
Size 243KB
Sample240107-y6jetsdghj
SHA256 76c0ce297cada60c06f972b29d15e16befde9c78b9f7ebb925be633a2f1a20da
MD5 ff05d1fdbe4ab19b12591f82f85f6013
SHA1 0e3384d9e8e6b3ede875fda6cd3acf730d02d4fd
SHA512 281a63b4b3ee9d343f73e9c1bcbb86a65108d241525ecf104d7fb1126c550af0b32734bb360c52dfe9c2d92d1660e8098944f7eb4db1c2cebee489d3f7ddaf17
SSDEEP 6144:lVxtAReaKzwesDzjhZAKqDuvlU2zlNgwTnAWtlhjQ:/+zliol5LhDAalhj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	ff05d1fdbe4ab19b12591f82f85f6013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kagichjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	ff05d1fdbe4ab19b12591f82f85f6013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnlm32.exe

Executes dropped EXE 10 IoCs

pid	Process
764	Kdcijcke.exe
4168	Kgbefoji.exe
2288	Kknafn32.exe
1368	Kipabjil.exe
4976	Kagichjo.exe
516	Kdffocib.exe
4932	Kgdbkohf.exe
3096	Kkpnlm32.exe
4840	Kmnjhioc.exe
1752	Kpmfddnf.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kmnjhioc.exe	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Kmnjhioc.exe	Kkpnlm32.exe
File created	C:\Windows\SysWOW64\Kbmfdgkm.dll	Kknafn32.exe
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnlm32.exe	Kgdbkohf.exe
File opened for modification	C:\Windows\SysWOW64\Kgbefoji.exe	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File opened for modification	C:\Windows\SysWOW64\Kagichjo.exe	Kipabjil.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kipabjil.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Bnjdmn32.dll	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Kdcijcke.exe	ff05d1fdbe4ab19b12591f82f85f6013.exe
File opened for modification	C:\Windows\SysWOW64\Kdcijcke.exe	ff05d1fdbe4ab19b12591f82f85f6013.exe
File created	C:\Windows\SysWOW64\Jcpkbc32.dll	ff05d1fdbe4ab19b12591f82f85f6013.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kgbefoji.exe
File opened for modification	C:\Windows\SysWOW64\Kipabjil.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Kgbefoji.exe	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Ihaoimoh.dll	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Kipabjil.exe	Kknafn32.exe
File created	C:\Windows\SysWOW64\Kkpnlm32.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Eeecjqkd.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Kknafn32.exe	Kgbefoji.exe
File created	C:\Windows\SysWOW64\Akihmf32.dll	Kagichjo.exe
File created	C:\Windows\SysWOW64\Fogjfmfe.dll	Kdffocib.exe
File created	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6052	5972	WerFault.exe	38

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akihmf32.dll"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fogjfmfe.dll"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbmfdgkm.dll"	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeecjqkd.dll"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdmn32.dll"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	ff05d1fdbe4ab19b12591f82f85f6013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	ff05d1fdbe4ab19b12591f82f85f6013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oimhnoch.dll"	Kkpnlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	ff05d1fdbe4ab19b12591f82f85f6013.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	ff05d1fdbe4ab19b12591f82f85f6013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcpkbc32.dll"	ff05d1fdbe4ab19b12591f82f85f6013.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmnjhioc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kagichjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	ff05d1fdbe4ab19b12591f82f85f6013.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihaoimoh.dll"	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kknafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hefffnbk.dll"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 764	3428	ff05d1fdbe4ab19b12591f82f85f6013.exe	106
PID 3428 wrote to memory of 764	3428	ff05d1fdbe4ab19b12591f82f85f6013.exe	106
PID 3428 wrote to memory of 764	3428	ff05d1fdbe4ab19b12591f82f85f6013.exe	106
PID 764 wrote to memory of 4168	764	Kdcijcke.exe	17
PID 764 wrote to memory of 4168	764	Kdcijcke.exe	17
PID 764 wrote to memory of 4168	764	Kdcijcke.exe	17
PID 4168 wrote to memory of 2288	4168	Kgbefoji.exe	105
PID 4168 wrote to memory of 2288	4168	Kgbefoji.exe	105
PID 4168 wrote to memory of 2288	4168	Kgbefoji.exe	105
PID 2288 wrote to memory of 1368	2288	Kknafn32.exe	18
PID 2288 wrote to memory of 1368	2288	Kknafn32.exe	18
PID 2288 wrote to memory of 1368	2288	Kknafn32.exe	18
PID 1368 wrote to memory of 4976	1368	Kipabjil.exe	102
PID 1368 wrote to memory of 4976	1368	Kipabjil.exe	102
PID 1368 wrote to memory of 4976	1368	Kipabjil.exe	102
PID 4976 wrote to memory of 516	4976	Kagichjo.exe	101
PID 4976 wrote to memory of 516	4976	Kagichjo.exe	101
PID 4976 wrote to memory of 516	4976	Kagichjo.exe	101
PID 516 wrote to memory of 4932	516	Kdffocib.exe	100
PID 516 wrote to memory of 4932	516	Kdffocib.exe	100
PID 516 wrote to memory of 4932	516	Kdffocib.exe	100
PID 4932 wrote to memory of 3096	4932	Kgdbkohf.exe	99
PID 4932 wrote to memory of 3096	4932	Kgdbkohf.exe	99
PID 4932 wrote to memory of 3096	4932	Kgdbkohf.exe	99
PID 3096 wrote to memory of 4840	3096	Kkpnlm32.exe	98
PID 3096 wrote to memory of 4840	3096	Kkpnlm32.exe	98
PID 3096 wrote to memory of 4840	3096	Kkpnlm32.exe	98
PID 4840 wrote to memory of 1752	4840	Kmnjhioc.exe	97
PID 4840 wrote to memory of 1752	4840	Kmnjhioc.exe	97
PID 4840 wrote to memory of 1752	4840	Kmnjhioc.exe	97

C:\Users\Admin\AppData\Local\Temp\ff05d1fdbe4ab19b12591f82f85f6013.exe
"C:\Users\Admin\AppData\Local\Temp\ff05d1fdbe4ab19b12591f82f85f6013.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\Kdcijcke.exe
  C:\Windows\system32\Kdcijcke.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:764

C:\Windows\SysWOW64\Kgbefoji.exe
C:\Windows\system32\Kgbefoji.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\Kknafn32.exe
  C:\Windows\system32\Kknafn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2288

C:\Windows\SysWOW64\Kipabjil.exe
C:\Windows\system32\Kipabjil.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\Kagichjo.exe
  C:\Windows\system32\Kagichjo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4976

C:\Windows\SysWOW64\Mnlfigcc.exe
C:\Windows\system32\Mnlfigcc.exe
1⤵
PID:692
- C:\Windows\SysWOW64\Mpkbebbf.exe
  C:\Windows\system32\Mpkbebbf.exe
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\Mciobn32.exe
    C:\Windows\system32\Mciobn32.exe
    3⤵
    PID:3460

C:\Windows\SysWOW64\Mkpgck32.exe
C:\Windows\system32\Mkpgck32.exe
1⤵
PID:1988
- C:\Windows\SysWOW64\Mnocof32.exe
  C:\Windows\system32\Mnocof32.exe
  2⤵
  PID:5096

C:\Windows\SysWOW64\Mdiklqhm.exe
C:\Windows\system32\Mdiklqhm.exe
1⤵
PID:4708
- C:\Windows\SysWOW64\Mgghhlhq.exe
  C:\Windows\system32\Mgghhlhq.exe
  2⤵
  PID:4768

C:\Windows\SysWOW64\Mkbchk32.exe
C:\Windows\system32\Mkbchk32.exe
1⤵
PID:4256
- C:\Windows\SysWOW64\Mnapdf32.exe
  C:\Windows\system32\Mnapdf32.exe
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\Mpolqa32.exe
    C:\Windows\system32\Mpolqa32.exe
    3⤵
    PID:3604

C:\Windows\SysWOW64\Mcnhmm32.exe
C:\Windows\system32\Mcnhmm32.exe
1⤵
PID:436
- C:\Windows\SysWOW64\Mkepnjng.exe
  C:\Windows\system32\Mkepnjng.exe
  2⤵
  PID:2784

C:\Windows\SysWOW64\Mncmjfmk.exe
C:\Windows\system32\Mncmjfmk.exe
1⤵
PID:2760
- C:\Windows\SysWOW64\Mpaifalo.exe
  C:\Windows\system32\Mpaifalo.exe
  2⤵
  PID:2200

C:\Windows\SysWOW64\Mcpebmkb.exe
C:\Windows\system32\Mcpebmkb.exe
1⤵
PID:4556
- C:\Windows\SysWOW64\Mkgmcjld.exe
  C:\Windows\system32\Mkgmcjld.exe
  2⤵
  PID:1920
- - C:\Windows\SysWOW64\Mnfipekh.exe
    C:\Windows\system32\Mnfipekh.exe
    3⤵
    PID:3464

C:\Windows\SysWOW64\Mdpalp32.exe
C:\Windows\system32\Mdpalp32.exe
1⤵
PID:3232
- C:\Windows\SysWOW64\Mcbahlip.exe
  C:\Windows\system32\Mcbahlip.exe
  2⤵
  PID:5128
- - C:\Windows\SysWOW64\Njljefql.exe
    C:\Windows\system32\Njljefql.exe
    3⤵
    PID:5164

C:\Windows\SysWOW64\Ndbnboqb.exe
C:\Windows\system32\Ndbnboqb.exe
1⤵
PID:5252
- C:\Windows\SysWOW64\Nceonl32.exe
  C:\Windows\system32\Nceonl32.exe
  2⤵
  PID:5292

C:\Windows\SysWOW64\Nddkgonp.exe
C:\Windows\system32\Nddkgonp.exe
1⤵
PID:5460
- C:\Windows\SysWOW64\Ncgkcl32.exe
  C:\Windows\system32\Ncgkcl32.exe
  2⤵
  PID:5500

C:\Windows\SysWOW64\Nkncdifl.exe
C:\Windows\system32\Nkncdifl.exe
1⤵
PID:5540
- C:\Windows\SysWOW64\Njacpf32.exe
  C:\Windows\system32\Njacpf32.exe
  2⤵
  PID:5580

C:\Windows\SysWOW64\Nqklmpdd.exe
C:\Windows\system32\Nqklmpdd.exe
1⤵
PID:5656
- C:\Windows\SysWOW64\Ndghmo32.exe
  C:\Windows\system32\Ndghmo32.exe
  2⤵
  PID:5696

C:\Windows\SysWOW64\Ncihikcg.exe
C:\Windows\system32\Ncihikcg.exe
1⤵
PID:5732
- C:\Windows\SysWOW64\Njcpee32.exe
  C:\Windows\system32\Njcpee32.exe
  2⤵
  PID:5776

C:\Windows\SysWOW64\Nnolfdcn.exe
C:\Windows\system32\Nnolfdcn.exe
1⤵
PID:5812
- C:\Windows\SysWOW64\Nqmhbpba.exe
  C:\Windows\system32\Nqmhbpba.exe
  2⤵
  PID:5848
- - C:\Windows\SysWOW64\Ndidbn32.exe
    C:\Windows\system32\Ndidbn32.exe
    3⤵
    PID:5896

C:\Windows\SysWOW64\Nkcmohbg.exe
C:\Windows\system32\Nkcmohbg.exe
1⤵
PID:5972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 416
  2⤵
  - Program crash
  PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5972 -ip 5972
1⤵
PID:6028

C:\Windows\SysWOW64\Nggqoj32.exe
C:\Windows\system32\Nggqoj32.exe
1⤵
PID:5932

C:\Windows\SysWOW64\Nbhkac32.exe
C:\Windows\system32\Nbhkac32.exe
1⤵
PID:5616

C:\Windows\SysWOW64\Nafokcol.exe
C:\Windows\system32\Nafokcol.exe
1⤵
PID:5424

C:\Windows\SysWOW64\Njogjfoj.exe
C:\Windows\system32\Njogjfoj.exe
1⤵
PID:5372

C:\Windows\SysWOW64\Nklfoi32.exe
C:\Windows\system32\Nklfoi32.exe
1⤵
PID:5332

C:\Windows\SysWOW64\Nacbfdao.exe
C:\Windows\system32\Nacbfdao.exe
1⤵
PID:5212

C:\Windows\SysWOW64\Maaepd32.exe
C:\Windows\system32\Maaepd32.exe
1⤵
PID:396

C:\Windows\SysWOW64\Majopeii.exe
C:\Windows\system32\Majopeii.exe
1⤵
PID:3508

C:\Windows\SysWOW64\Mjqjih32.exe
C:\Windows\system32\Mjqjih32.exe
1⤵
PID:876

C:\Windows\SysWOW64\Lknjmkdo.exe
C:\Windows\system32\Lknjmkdo.exe
1⤵
PID:632

C:\Windows\SysWOW64\Lcgblncm.exe
C:\Windows\system32\Lcgblncm.exe
1⤵
PID:1316

C:\Windows\SysWOW64\Lphfpbdi.exe
C:\Windows\system32\Lphfpbdi.exe
1⤵
PID:4532

C:\Windows\SysWOW64\Ljnnch32.exe
C:\Windows\system32\Ljnnch32.exe
1⤵
PID:372

C:\Windows\SysWOW64\Lgpagm32.exe
C:\Windows\system32\Lgpagm32.exe
1⤵
PID:2948

C:\Windows\SysWOW64\Lpfijcfl.exe
C:\Windows\system32\Lpfijcfl.exe
1⤵
PID:2892

C:\Windows\SysWOW64\Lnhmng32.exe
C:\Windows\system32\Lnhmng32.exe
1⤵
PID:4636

C:\Windows\SysWOW64\Lkiqbl32.exe
C:\Windows\system32\Lkiqbl32.exe
1⤵
PID:4184

C:\Windows\SysWOW64\Lgneampk.exe
C:\Windows\system32\Lgneampk.exe
1⤵
PID:2472

C:\Windows\SysWOW64\Ldohebqh.exe
C:\Windows\system32\Ldohebqh.exe
1⤵
PID:1664

C:\Windows\SysWOW64\Laalifad.exe
C:\Windows\system32\Laalifad.exe
1⤵
PID:4912

C:\Windows\SysWOW64\Lijdhiaa.exe
C:\Windows\system32\Lijdhiaa.exe
1⤵
PID:4968

C:\Windows\SysWOW64\Lkgdml32.exe
C:\Windows\system32\Lkgdml32.exe
1⤵
PID:2464

C:\Windows\SysWOW64\Lcpllo32.exe
C:\Windows\system32\Lcpllo32.exe
1⤵
PID:3356

C:\Windows\SysWOW64\Lpappc32.exe
C:\Windows\system32\Lpappc32.exe
1⤵
PID:1048

C:\Windows\SysWOW64\Laopdgcg.exe
C:\Windows\system32\Laopdgcg.exe
1⤵
PID:548

C:\Windows\SysWOW64\Lgikfn32.exe
C:\Windows\system32\Lgikfn32.exe
1⤵
PID:4792

C:\Windows\SysWOW64\Ldkojb32.exe
C:\Windows\system32\Ldkojb32.exe
1⤵
PID:3104

C:\Windows\SysWOW64\Lpocjdld.exe
C:\Windows\system32\Lpocjdld.exe
1⤵
PID:1236

C:\Windows\SysWOW64\Lalcng32.exe
C:\Windows\system32\Lalcng32.exe
1⤵
PID:2168

C:\Windows\SysWOW64\Liekmj32.exe
C:\Windows\system32\Liekmj32.exe
1⤵
PID:2392

C:\Windows\SysWOW64\Kkbkamnl.exe
C:\Windows\system32\Kkbkamnl.exe
1⤵
PID:1584

C:\Windows\SysWOW64\Kgfoan32.exe
C:\Windows\system32\Kgfoan32.exe
1⤵
PID:1644

C:\Windows\SysWOW64\Kdhbec32.exe
C:\Windows\system32\Kdhbec32.exe
1⤵
PID:4808

C:\Windows\SysWOW64\Kpmfddnf.exe
C:\Windows\system32\Kpmfddnf.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\SysWOW64\Kmnjhioc.exe
C:\Windows\system32\Kmnjhioc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\SysWOW64\Kkpnlm32.exe
C:\Windows\system32\Kkpnlm32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\SysWOW64\Kgdbkohf.exe
C:\Windows\system32\Kgdbkohf.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4932

C:\Windows\SysWOW64\Kdffocib.exe
C:\Windows\system32\Kdffocib.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 243KB
SHA256 6a4c594042e0f86eaa9d2638a803034b53b1b4ff2bcadc99c201e07f39421439
MD5 80925030d20ace4bec4b073adadc297f
SHA1 e24d540abcbd8b290e961a02a14af9437991bf03
SHA512 a98347413c2e77fb4523b3d21434dbdb4ce0882e223180d8304969a7e4dae6b58352831aaf9ac49f6ed50af24d6cdac31a5e8fe2ae8fbda1be3c91c68d42f3aa
SSDEEP 6144:Up450avzKzwesDzjhZAKqDuvlU2zlNgwTnAWtlhjQ:Uhahzliol5LhDAalhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgpagm32.exe

Path C:\Windows\SysWOW64\Lgpagm32.exe
Size 67KB
SHA256 ea40193286056fe176a379e52f4387f26095b921d8a1cbcd05ffe860ac89c1c1
MD5 460e512ce55a1455599b9d3edb5273ed
SHA1 e3df477e3a66bd585499b7979a8e7ee36bba6a37
SHA512 92cbf8d6fbcdf0f594d6ac01e55af86c5fde95d4ef6cdf241c2e57e2a0edc688dcc3f2d5d2533d977434cd6d4c2b8a777894d2c11e4b58925e83ee5fcb18a361
SSDEEP 1536:SXSAgwFpqzv5ZoQI8Kq1f1Bxk1RYV62Lz7ez8+WHXuU0:Ibpqj50afnzKz8lHXuU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ljnnch32.exe

Path C:\Windows\SysWOW64\Ljnnch32.exe
Size 237KB
SHA256 8fa4492eb571998663e6d95788ea5544780c314beab85c67c9db3953061c0730
MD5 a4753c86e82ca853714c181d34e30e5c
SHA1 0ff02918181406139c6a9b0937374ed25bf8f59d
SHA512 8235e121cbdbf8328d2f07e3dd634330581e7ec59601f868c5baebc83b5604f2579c69fd0e1832a177575c279c45f090310a92ba7d0eb4b943b1fc89f6ef2dbe
SSDEEP 6144:/OyhDDod6gKzwesDzjhZAKqDuvlU2zlNgwTnAWtlhjQz:/OyhDDohzliol5LhDAalhj2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ljnnch32.exe

Path C:\Windows\SysWOW64\Ljnnch32.exe
Size 220KB
SHA256 7ee719cd70111957752572a16892ef560928c67cd160c942b48c35bbbaf55b07
MD5 fbe5484de5b120f243ea7c8f65fe88d4
SHA1 af92338641b30713be0986b29f8c7c0b33400f8b
SHA512 69f6155a34b91a3b17a3d15ddd5488586ea9155b537a6e641a8c8decab4d58e2e0e339abad41196d9a0ed1589cac1ee8229a3fdd5f15ab396b8b7d5f0b5ae677
SSDEEP 6144:/OyhDDod6gKzwesDzjhZAKqDuvlU2zlNgwTnAWtlhA:/OyhDDohzliol5LhDAalhA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpfijcfl.exe

Path C:\Windows\SysWOW64\Lpfijcfl.exe
Size 243KB
SHA256 f7e4e95575b2caa3f01e25742d1f60c2f9a16fed498ab700a959e13ed9c50599
MD5 041c43c0e81ed475935d16b1a7d6049a
SHA1 8185e5ae1cbf36ce8c2679d351420a2d9d8915e2
SHA512 dc0716b97c70ecfae6164ce0ed592221d589b8d1430b7830258ecff7d3690f94c4717bb725037f4ccb10d35ab48fe284cd993a7e5e130fd473df0ee96d0f39e1
SSDEEP 6144:2I0y5IPfKzwesDzjhZAKqDuvlU2zlNgwTnAWtlhjQ:2C5wzliol5LhDAalhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 88KB
SHA256 cf636383036d5d73f9dda8f45b68cf847fb2efd50a1f62071777befcc775d84c
MD5 dc76caec65050ceabca9f7aaa05ea0de
SHA1 ad102a765c2a5fe039a805992feae1d4fdff4cef
SHA512 42cb87f05bc5a87a57c9d7b8801d66f1a979951ec840ec3ef848555101a9b56e4500a64d9d64b2aee21d6019d0839241692665596359606bf8e727312457f1e4
SSDEEP 1536:S+tUt6J0qbbmGiPiHIR1LTtTuaoUAKVaVhO+LsIqA92Lds7ez8+WHXuU09JdZUzR:xcGHmGWiHIR1LTtBnsDO+LXqpqKz8lHb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lphfpbdi.exe

Path C:\Windows\SysWOW64\Lphfpbdi.exe
Size 153KB
SHA256 fb56464615348493a927d56ee817573f56b04ddaecd54226ae658a2c4db39713
MD5 1f601fd372280f3fc84fe3f08393826b
SHA1 d69989e77d3cf47003a0f57a9bef00af21bed8fd
SHA512 59a7a30e88676de51f628f66588bd840967a534e109703aa8b8cd7d7187b3ded60c145cb750efcfb93e61738e83124f80827b2d30e2c4153959414b3f0f050a8
SSDEEP 3072:xcGHmGWiHIR1LTtBnsDO+LXqpqKz8lHXuU09JdZUDz6qp/ZQMwlGXXw6nYV2euvA:WlUYqKzwesDzjhZAKqDuvlU2zlq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maaepd32.exe

Path C:\Windows\SysWOW64\Maaepd32.exe
Size 103KB
SHA256 5bb80f09b213dac0227e85f94a9cf7b12a46c03bbdd2a622708d5c2535b7c116
MD5 ccaecd03a0ee014cb277ab461bf3f439
SHA1 19ce2076c74d776db7feb1f6f6a4f7fc2efb467a
SHA512 35ad7bfcdf65d0cf35503583bb68fd663c6132ba5c2ec205b39a9527714f0805e7890b8324cbd291f6c3ae5747e7429c879affb65e0d808e8e7165acfcb25346
SSDEEP 3072:hPZvylSMZ9W3Kz8lHXuU09JdZUDz6qp/ZQMwJ:hPZtOI3KzwesDzjhZAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcbahlip.exe

Path C:\Windows\SysWOW64\Mcbahlip.exe
Size 61KB
SHA256 60663503966deb5c68038b9e433456dbac63d7732c74a606a9ddeca03cfe8639
MD5 4098edc030433c5ab63734d4a1869502
SHA1 ceac531d1048b5eb44e5fd263af86077893f66a4
SHA512 22b01fe2ddd13ab9e3248e7da7c3a37a0d641c7e7e588db0a29bce266e0e76cc061c5b9072f9d278bf179d55af0103bd9b4bb483aa73f64358d749fbb28e94b5
SSDEEP 1536:SO18OgZ1Q1BYFPlQOx5QdJ4Cl//hoobuaqM2La7ez8+o:J17gZ1QPIPlQOx5QL4y3uaqFaKz8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mcpebmkb.exe

Path C:\Windows\SysWOW64\Mcpebmkb.exe
Size 106KB
SHA256 d44dc1eaaa45a4723caaf6ef9d38015b47a6ead64742abde4b6dbc658fade443
MD5 d8ee22ef7e304ca464c4b752ac3dffb9
SHA1 9e0cefef46854696ac65f982b29a29d82f06ac3b
SHA512 c7c303b61dbbe60985f583816ca5fed3e94aedb4b876901192e12fbec2fec8df30c9f27fbe39842a3ccb5171d3d36023e85255bc5c0d4df637eae17e91db5d45
SSDEEP 3072:vJf+HS4ZnKz8lHXuU09JdZUDz6qp/ZQMwlGS:vJZ4ZnKzwesDzjhZAF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njogjfoj.exe

Path C:\Windows\SysWOW64\Njogjfoj.exe
Size 92KB
SHA256 55f39d938d3c96bf0486e87b7ba05d2efc1032921473b6307b1ba86b24af4c09
MD5 651598f3e43d59c7d7d05a149fc5491d
SHA1 83ca202456aada47b832987f2951c6fb05b9e74a
SHA512 2dca1461f6d124ff78aacbde692ef62fa26bc757d36a86d737541fe2a69a9630a0d20dc449073417bbae142512ad4302a4909bdcb9303bc19c9a29916380270b
SSDEEP 1536:S+zKRIN3m2nTYeJOmRxQkSHZKbbEoFNEX2LO7ez8+WHXuU09JdZUzfz6RMp/7RrD:kINWAOmRGkS5KsonE8OKz8lHXuU09Jda
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 55KB
SHA256 3002373667a1fc388925ff4ed68e6ebeea747026209fddc173aee1cf2bdc3a9b
MD5 5babe3b72f2e076c3ea624993fcbd1f4
SHA1 c4504354cdbe1b34045011c596baf7061c786c69
SHA512 b1f6e6bc85b7d93ab65a921fe1fa0eb0169508344b32637f87c3d6b48a67bffbb0e33064b6cec50982a7beb2a4fa80f7bc629cdc7206ce4f7d3feb5b5b45e995
SSDEEP 1536:SEFWYGjPqejNFv/+Eji+H5HHOOO1H7R2LzF:xFJmbzni+H5HHOOOFqzF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-249-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/396-389-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/436-347-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/516-49-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/548-153-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/632-269-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/692-281-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/764-9-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/876-279-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1048-161-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1236-133-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1316-263-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1368-33-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1584-105-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1644-97-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1664-201-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1920-381-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/1988-304-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2060-287-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2168-121-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2200-370-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2288-25-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2392-117-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2464-177-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2472-209-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2760-363-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2784-353-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2892-233-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/2948-241-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3096-65-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3104-137-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3232-395-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3356-172-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3428-80-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3428-0-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3428-5-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3460-293-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3464-388-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3508-314-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/3604-341-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4168-21-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4184-217-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4256-329-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4372-340-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4532-261-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4556-371-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4636-225-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4708-321-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4768-323-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4792-149-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4808-90-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4840-75-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4912-193-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4932-61-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4968-185-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4976-41-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5096-305-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5128-405-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5164-407-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5212-417-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5252-424-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5292-425-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5332-435-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/5372-437-0x0000000000400000-0x0000000000467000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads