b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
Size

236KB
MD5

3f14f06d8d7ea787457327417b849b65
SHA1

2fa86deb095661977120379f20c6e15c3a5d8860
SHA256

b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2
SHA512

6c7523acfacc6a406a2460072f26ca4eccfda77ce60ad7702468747001cbc17874132330b15eaceab8ea08860c13cf0f9f9e02a9da7c805739fa7a633028faca
SSDEEP

3072:nzjIHpMI9KAQJ9IDlRxyhTbhgu+tAcrbFAJc+RsUi1aVDkOvhJjvJUp:XYMI0AQsDshsrtMsQB4

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehokgge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllcen32.exe

Executes dropped EXE 64 IoCs

pid	Process
920	Ifgbnlmj.exe
3056	Ippggbck.exe
3376	Iemppiab.exe
2816	Ilghlc32.exe
1192	Ibqpimpl.exe
2000	Icplcpgo.exe
4924	Jeaikh32.exe
4520	Jpgmha32.exe
3640	Jfcbjk32.exe
3816	Jlpkba32.exe
1132	Jehokgge.exe
2572	Jfhlejnh.exe
4604	Jlednamo.exe
3012	Kmdqgd32.exe
2096	Kikame32.exe
4796	Kdqejn32.exe
2780	Kebbafoj.exe
1504	Klljnp32.exe
3140	Kbhoqj32.exe
368	Kplpjn32.exe
452	Lpnlpnih.exe
4204	Lenamdem.exe
4244	Ldoaklml.exe
4032	Lljfpnjg.exe
2348	Lllcen32.exe
224	Mchhggno.exe
3032	Mmnldp32.exe
4412	Meiaib32.exe
2664	Mgimcebb.exe
2876	Mcpnhfhf.exe
3860	Npfkgjdn.exe
4728	Nlmllkja.exe
3868	Npmagine.exe
4496	Njefqo32.exe
3388	Odkjng32.exe
2652	Oflgep32.exe
4492	Odmgcgbi.exe
4888	Oneklm32.exe
4944	Ognpebpj.exe
5044	Ojllan32.exe
3320	Ocdqjceo.exe
3524	Onjegled.exe
2132	Olmeci32.exe
3244	Ojaelm32.exe
2460	Pdfjifjo.exe
3600	Pnonbk32.exe
3980	Pclgkb32.exe
2240	Pfjcgn32.exe
3288	Pqpgdfnp.exe
2788	Pjhlml32.exe
2060	Pqbdjfln.exe
3960	Pgllfp32.exe
4996	Pqdqof32.exe
4452	Pcbmka32.exe
4468	Pjmehkqk.exe
3656	Qceiaa32.exe
5112	Qjoankoi.exe
644	Qqijje32.exe
2968	Anmjcieo.exe
1084	Aqkgpedc.exe
3432	Afhohlbj.exe
2628	Afjlnk32.exe
4424	Amddjegd.exe
1684	Agjhgngj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Abckpb32.dll	Jeaikh32.exe
File created	C:\Windows\SysWOW64\Icpnnd32.dll	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Jfcbjk32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Jjbedgde.dll	Jfcbjk32.exe
File opened for modification	C:\Windows\SysWOW64\Kikame32.exe	Kmdqgd32.exe
File created	C:\Windows\SysWOW64\Cbeedbdm.dll	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Lllcen32.exe	Lljfpnjg.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Kdqejn32.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Icplcpgo.exe	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Nffbangm.dll	Jlpkba32.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Kplpjn32.exe	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Dbagnedl.dll	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Kebbafoj.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Eonefj32.dll	Mchhggno.exe
File created	C:\Windows\SysWOW64\Npfkgjdn.exe	Mcpnhfhf.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pfjcgn32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Lljfpnjg.exe	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Djnkap32.dll	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Ifgbnlmj.exe	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
File opened for modification	C:\Windows\SysWOW64\Kdqejn32.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Agjhgngj.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Bhoilahe.dll	Jfhlejnh.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Pqdqof32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Icplcpgo.exe	Ibqpimpl.exe
File opened for modification	C:\Windows\SysWOW64\Jfhlejnh.exe	Jehokgge.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5672	5604	WerFault.exe	195

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlednamo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlplhfon.dll"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdjinlko.dll"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqbodd32.dll"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icpnnd32.dll"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmblqfc.dll"	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflheb32.dll"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Bjagjhnc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 920	3648	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe	82
PID 3648 wrote to memory of 920	3648	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe	82
PID 3648 wrote to memory of 920	3648	b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe	82
PID 920 wrote to memory of 3056	920	Ifgbnlmj.exe	83
PID 920 wrote to memory of 3056	920	Ifgbnlmj.exe	83
PID 920 wrote to memory of 3056	920	Ifgbnlmj.exe	83
PID 3056 wrote to memory of 3376	3056	Ippggbck.exe	84
PID 3056 wrote to memory of 3376	3056	Ippggbck.exe	84
PID 3056 wrote to memory of 3376	3056	Ippggbck.exe	84
PID 3376 wrote to memory of 2816	3376	Iemppiab.exe	85
PID 3376 wrote to memory of 2816	3376	Iemppiab.exe	85
PID 3376 wrote to memory of 2816	3376	Iemppiab.exe	85
PID 2816 wrote to memory of 1192	2816	Ilghlc32.exe	86
PID 2816 wrote to memory of 1192	2816	Ilghlc32.exe	86
PID 2816 wrote to memory of 1192	2816	Ilghlc32.exe	86
PID 1192 wrote to memory of 2000	1192	Ibqpimpl.exe	88
PID 1192 wrote to memory of 2000	1192	Ibqpimpl.exe	88
PID 1192 wrote to memory of 2000	1192	Ibqpimpl.exe	88
PID 2000 wrote to memory of 4924	2000	Icplcpgo.exe	89
PID 2000 wrote to memory of 4924	2000	Icplcpgo.exe	89
PID 2000 wrote to memory of 4924	2000	Icplcpgo.exe	89
PID 4924 wrote to memory of 4520	4924	Jeaikh32.exe	90
PID 4924 wrote to memory of 4520	4924	Jeaikh32.exe	90
PID 4924 wrote to memory of 4520	4924	Jeaikh32.exe	90
PID 4520 wrote to memory of 3640	4520	Jpgmha32.exe	91
PID 4520 wrote to memory of 3640	4520	Jpgmha32.exe	91
PID 4520 wrote to memory of 3640	4520	Jpgmha32.exe	91
PID 3640 wrote to memory of 3816	3640	Jfcbjk32.exe	93
PID 3640 wrote to memory of 3816	3640	Jfcbjk32.exe	93
PID 3640 wrote to memory of 3816	3640	Jfcbjk32.exe	93
PID 3816 wrote to memory of 1132	3816	Jlpkba32.exe	94
PID 3816 wrote to memory of 1132	3816	Jlpkba32.exe	94
PID 3816 wrote to memory of 1132	3816	Jlpkba32.exe	94
PID 1132 wrote to memory of 2572	1132	Jehokgge.exe	95
PID 1132 wrote to memory of 2572	1132	Jehokgge.exe	95
PID 1132 wrote to memory of 2572	1132	Jehokgge.exe	95
PID 2572 wrote to memory of 4604	2572	Jfhlejnh.exe	96
PID 2572 wrote to memory of 4604	2572	Jfhlejnh.exe	96
PID 2572 wrote to memory of 4604	2572	Jfhlejnh.exe	96
PID 4604 wrote to memory of 3012	4604	Jlednamo.exe	98
PID 4604 wrote to memory of 3012	4604	Jlednamo.exe	98
PID 4604 wrote to memory of 3012	4604	Jlednamo.exe	98
PID 3012 wrote to memory of 2096	3012	Kmdqgd32.exe	100
PID 3012 wrote to memory of 2096	3012	Kmdqgd32.exe	100
PID 3012 wrote to memory of 2096	3012	Kmdqgd32.exe	100
PID 2096 wrote to memory of 4796	2096	Kikame32.exe	101
PID 2096 wrote to memory of 4796	2096	Kikame32.exe	101
PID 2096 wrote to memory of 4796	2096	Kikame32.exe	101
PID 4796 wrote to memory of 2780	4796	Kdqejn32.exe	102
PID 4796 wrote to memory of 2780	4796	Kdqejn32.exe	102
PID 4796 wrote to memory of 2780	4796	Kdqejn32.exe	102
PID 2780 wrote to memory of 1504	2780	Kebbafoj.exe	103
PID 2780 wrote to memory of 1504	2780	Kebbafoj.exe	103
PID 2780 wrote to memory of 1504	2780	Kebbafoj.exe	103
PID 1504 wrote to memory of 3140	1504	Klljnp32.exe	104
PID 1504 wrote to memory of 3140	1504	Klljnp32.exe	104
PID 1504 wrote to memory of 3140	1504	Klljnp32.exe	104
PID 3140 wrote to memory of 368	3140	Kbhoqj32.exe	105
PID 3140 wrote to memory of 368	3140	Kbhoqj32.exe	105
PID 3140 wrote to memory of 368	3140	Kbhoqj32.exe	105
PID 368 wrote to memory of 452	368	Kplpjn32.exe	106
PID 368 wrote to memory of 452	368	Kplpjn32.exe	106
PID 368 wrote to memory of 452	368	Kplpjn32.exe	106
PID 452 wrote to memory of 4204	452	Lpnlpnih.exe	107

C:\Users\Admin\AppData\Local\Temp\b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe
"C:\Users\Admin\AppData\Local\Temp\b668ebaf368848ee9656ff84ed6c38efab8b53b4d5685aabeee797f03c3e9ca2.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\Ifgbnlmj.exe
  C:\Windows\system32\Ifgbnlmj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\SysWOW64\Ippggbck.exe
    C:\Windows\system32\Ippggbck.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\Iemppiab.exe
      C:\Windows\system32\Iemppiab.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:224
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        28⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        29⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2876
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        33⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        34⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        35⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2460
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3980
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2788
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3960
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        55⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        57⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:644
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        62⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        63⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1348
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:752
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        69⤵
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3492
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        82⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        87⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        88⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        90⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        95⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        99⤵
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        102⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        103⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        104⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        106⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5540
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        109⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 396
        110⤵
        Program crash
        
        PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5604 -ip 5604
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
236KB

MD5
507cbfcaa38abdb0fbfa140acc756570

SHA1
a72291a78b74f8ed4d185a2c93139a2bee487d7c

SHA256
77119d8b65ad401d6b010ed312558574c5af7ac1966992899ef77f44ae24cec1

SHA512
fecc7db6be717d17a90c2db9261a89bdd2234caabb5038c3575cec28709aaf94720d27d606c44f414d80304b271393f81fe5cd77c6a921d8dfcfdd6ddca533e9

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
236KB

MD5
9bd916f2475c79dc8baa3945e856a46d

SHA1
19c8757ffa39c572bf1ef124dc093093a25b6901

SHA256
d7cf3972120f399501a9d1b8d5934ff91e8369881431ba6f4d65d6ce8e152d6f

SHA512
0fae053d3565fce1a2a46167214ad910914afba5f73ddfd9ad859b2a9b5393d0035a5487c73ecdb116fa6f7c52fe048b03551db9ca4489aa8163d34501f28260

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
236KB

MD5
fbbb996d45b193e42a892d7e170e7860

SHA1
eed17a5a5fe9b7037b3790669ba6a392a9ed8caa

SHA256
a76512c0f5df36db6861e3eaae23ce1927adaae17aec336f78834f7c5ecd7853

SHA512
6111f931517fcab819b0cf91b5247d828d8a15d404b18dacc7b629deec964fcfb73c21468647c222564bbe0bd4a0f8b89da329f3044e22ffee0a93c2d85e31e3

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
236KB

MD5
fe41472ea96f9cb9ee88e9ecc4958257

SHA1
b3477e8ed04946de4678609f06fca0a6dde7e848

SHA256
2260d8a4de7f85ffd3e654722e27c6bcc303724510f12da5047553673508a020

SHA512
5e8da0f98a2c03b5a832e1ed96b901e9818c464c91885e00ba94885484375bb939742a4bc4e248ddd894fdfb5ed03ac27ddcb586665b442d1d29e309a28608a8

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
236KB

MD5
99bab025bbaf6d4c2ed5bcaf207ccefb

SHA1
88306415821ef0fb2cb17c3a54e0e5b0cc09432f

SHA256
2687ff7bb29c184487268ef8aad34bca0d0fe8a42dad618869706433a9e80990

SHA512
20c4037436a35a8733c5a03c5dc45ae3f58ffa8459f852178160b740eddcf307998fae7c7fee74df17b15f8aa7613e47aaec90d2d0a417ff3c0160569dc520ec

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
236KB

MD5
d7fb5142faa5679c61fe9dcd85cd8493

SHA1
283c96c4486a3bfc1a6c82500840ddc907f10a3c

SHA256
5ac0dcdbd8743fd529b78fc0073c9672a27c8247141a6b537330dcf5cdfe9bfe

SHA512
f37b053d67ad23ea56c2c5d9807678483b39cb6febb7b991b9b0900a65142b65d7d443262c987480458bc078d07d1b702429ba310321d8d6fc710ac382ec8538

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
236KB

MD5
b73aa336f53d66c12e0fe0ab0d38d0e3

SHA1
1cf3db57eb5e6e84664abe4bbfb911e551f4ad3f

SHA256
22ff3b309b97201b286ca2ec292d97637ce86cba43c1bd80b4c74971249cef30

SHA512
bf8a0ad28dc164239d66420f2af608b23bda6c47c746dbab581f6a973f7e8819a5b958a380cda4e6d5a63cf970caa7ab615ca668fdbc1689c10d3f535c34a74a

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
236KB

MD5
ade9a3de464b0b943966377282cca2d7

SHA1
c0db35f62b1b58e4881c4821af5c737956e373c0

SHA256
3a06d29acb4c8031be8060048c3dc0c68cef40237559983fea472894c337aea4

SHA512
31441f31a561dbd853ebb76e395d5c52bd32f80ca0fdfc5039fceaa9b58ba336b2582adee36e882707dba2687cf13841daad79a3b8e1cc9e63331313eaa23818

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
236KB

MD5
50f8f34816660ea7527fa6bb549095f6

SHA1
ed45beebbbf6cc42efd539b2fb82fe8dd26c15df

SHA256
c263a48d74753d777da3e24b3bafc6376b06b72dd4768d65cf024d87740202ad

SHA512
536ef6466d1f0367944e5fd95b58ee46d77ca15a8f10f26fa41c39208ccdb7d0589a599a73ac49e4f2bdacfde811401d10747679bfa813800d3a00f13b6f7a09

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
236KB

MD5
0fc57dd627d95b3ea3cef6437a1063fc

SHA1
a9926626e4df5c28734f738617393cdd8e4c7a69

SHA256
4d01c576933b20976f43e9be04899c08a228f4e8b0f6adea26dea0e454918e1b

SHA512
26b2ca03889c2cc917ef137552de725dc0b3e5bcbae1b8a582909bcc70e5e30ec7a11c1ea6115e701d0b27309797a6bd1e0a1bad94b79d942680a3a59db0cd1f

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
236KB

MD5
1766b4cbf005d451f729d7cdf95cb495

SHA1
0eebac774aecb37f9a23a3505f63891059736cfb

SHA256
e1cf59df5d51841d84f665ff7405612fe3d2afd45eaabb948ed3e0f8b2bbf2ae

SHA512
0be70a798dcad1e4f2c9bb126b2716e3ca71fb86ab3b4d69bb2e7a80165795cd49212ab9145fd5a176061b9f8f37d27817970501977a7c901fe56023ae4c21ec

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
236KB

MD5
104926e1df6c4aee09315e9b60f66c05

SHA1
4b6bf64846f436799e45c9ffd724a42d0e00caa2

SHA256
8ff518e6a5d64382e68cb54cb19e31f93d3e1d25cf2de80f42e8127ff79c5ed1

SHA512
e0750320bb5e0d4b93c1871201c4bc535b61ce28182237904effee359d1cba4a063e0ead1fb25fc7d7bee0ef97471e997026d06dbe855ca0f9ad979f016f0ff3

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
236KB

MD5
ccba8213873b4768fcb3da19a0834f23

SHA1
253fa26c8d8a4f91aacef00dae0ae1c3b2ebe2e7

SHA256
b2487eee1bde66f6285998e76497747758f0fd39e03dcc7e1cbb765f731967bc

SHA512
4d0ff3cb50625f63613dbdd768755c858c276eb74e037904ff1c0dcb7afc7200e72c271bd33229495708fb898b07ffe483b910288e87cb7a68f3feb8d16f1a00

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
236KB

MD5
190836e51df3838ba1403f17627135b5

SHA1
390c6c20438036fea67f8c80145f2de82c03394f

SHA256
5351ef04bdb3caa68a8003a2ffbb7078bbc08b473c1bbc812d130351199b7244

SHA512
b530f50169431eccde34eca6817fdc9b419cafe5c9ffa6a91ccf494ecf650815e57af6c4c9c9123db0fb0fb1c8f5f5e0afcd949aff43ac3aeecd88d8693fc454

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
236KB

MD5
8ea5f60ed039ac11341511e1b1eb43fb

SHA1
bc8ca582374b05678dc1bb65c6b7c54eb98ca076

SHA256
fc799ed96efff5cb45ece1a305748d636061a1f314a65e2a90e373e6dc5eb25e

SHA512
15965589cc4a16c0bf9422919e395155dfb0273bdff20468d56916eb657a10e47302a74352ac4b8802d9deb00670d4c83aad984fe5fb2a2b1bc2c54b25dfa09b

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
236KB

MD5
30b4b5b191dd648b3b5369d05ed89e14

SHA1
810b9044663201c53f69863590020136a710502a

SHA256
cc6cdbfae8ed11791d61650e2808c4594e321903a4ff0607b054e12bd204af4b

SHA512
6d0c5cf2b03c97f261b3df17924bec929226f30857657d9344d681a03a92dda99bfa193ad63dc1f86459010181a58ac7615e76ca9874dbfe22e8d86b9dfa207d

Download Submit
C:\Windows\SysWOW64\Jpgmha32.exe

Filesize
236KB

MD5
43d9acbde1baf25d04d114569947e4df

SHA1
fa838067b0173f6806a48bbb042aff5bdd8a209f

SHA256
5695510a2d1251ebfba85775437cb869c2620d7aa450f35fc4b937a89ae47cfb

SHA512
4b15ae9ceceae74d958b042bfd3c5b6e398082f4d0c4f224ca9bf2e1ef7be612d02d46c00fe806728619777994fea69d9e037f5475897f7e56e09b08d4e8785c

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
236KB

MD5
bef03311569db853e6daca66e850d36f

SHA1
92efdb96bad4cef2ccdcd7bcd3358a03ee7ba8df

SHA256
76e6cbe8655acf4b89a61e1227000ad6a8b6db2cf5f8f486abe83a3e1a972657

SHA512
48ad18825170682c40cb3cbe5657b3ee418fc3f4bfe6fe67b60fb14109fccb47a9dde02b508c606cc3bffe64a2bb8855322420309b797778b6f5b1c9840330fa

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
236KB

MD5
becbdd3ef6d061885719b0eef117ef0a

SHA1
5f5af9c7ccd6460a35de0b4036117f1ecca1d9ce

SHA256
df68e5051e1faf79245f77f181b4d67b37ca87618eb372782aef816e88f7df93

SHA512
eaf6b81eb8e6799601c91aa8590e13486a931804684bc03e24243e6101cb6e34b605d492b3dbb601d0af408dc58b1cdb59afc9d9f2ddfd1bb11c4f740e5b6f41

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
236KB

MD5
bafd173cbddd9fea9633b32ede1913eb

SHA1
45a501abcda45d7bf4e7ca6f694623a4d0112c5c

SHA256
0b4998cfbb9d0409d4abc3ef1272f05f6896099fff5078ba4943edf49fa1027e

SHA512
01418c3b599f918fe748250787e5c9faf458e74c455939e25ea1b0421d7d84851ee872927d5656c7ccdb8ae727bd51f8d2a4aa3b59f0f647e9095446f0f1a7a9

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
236KB

MD5
5afa068ddb45af12108ebc8a927e550c

SHA1
a9b65bcd3f38acc96fced0dc517c0e34d67af4c5

SHA256
f79d875e8631f8750cc901830efdece762631deffec6dead5b25cee0006f7e17

SHA512
113b7420427789734a2625e2f69a71cb8c359b49d197afc199aa4e158a7a75da2f74a20dcfc9805c2acd5373b56c4fcbadfd59ca0f6ba57ce4358e2392725a0d

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
236KB

MD5
258a73f02eaa51f06a4745f3b9dd3212

SHA1
f47b14b8b9a9cf88ce82efdb766a987c78aeb792

SHA256
952f5af6c453202f3d2bb775ac10cf41f70c07ed8c621e45437011d5318ef3b7

SHA512
4938b4f379e18dea0992601b202920c10765aeb6ebdec8d58d43877c65fcc516f9c64e3c8352292415910bd2c447f98d08ee2a692cfab75073d53e0a02b1ea1c

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
236KB

MD5
1afa7c6d91e315560bc32c2debe4ddba

SHA1
5f38758922c63951f8a292f94e63a262da93ba92

SHA256
85549063019dfb2467ef0a839d52e01df49e78c7fdfbbcf7e0b329b8c45ad189

SHA512
f4d3d9c963d6387193f92eef98ba4de945d7336f8037f53df526e7f2ae8912d18bc88747c43035f166361d464e3fc3fca5730fe56173b180537fe90ccc54ceb7

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
236KB

MD5
3d7a740b944124adb6085404d43c66cf

SHA1
418e715c6baf9a8eeca5910b54fd2691e2022fd7

SHA256
7ec83f44b2301fa0ff966ce8871560e67cf4ab12f257285f9d67fcccc5bd8c2e

SHA512
73af495ab8b6c3e451fb5250fcdc2d29bfce868fe94d934853a52ddc574dd17b217d9b5029756f8db8db87c8f5ba3925870321fa040d1d5f5480110c83f7ea51

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
236KB

MD5
bc3bbbce1877c0b2d71b759c92199437

SHA1
dad7233b8d8158dc7c2f942403fb42fd67dab0f1

SHA256
7295c3883ff13e9a630a985830cd14d0e4549c283e6eebef18f49a083ac5b0bb

SHA512
1f1f9a069b091537417220abf3a5a7f05d44bcb988cdd3fd5dad9d39f9401912b45676b664bc9e8c51d7f52facda153a0d714adb6a35810e6af13d0366c4a336

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
236KB

MD5
be08dad9a86e21b7f894eb44d0979a36

SHA1
9bf20f8a64b4bd497859f874b926750c3f5f4765

SHA256
e919d3d5cd3111d1628e7d55764b66d861e798f06f26d5b02a37bd4e96841e7c

SHA512
298dd0fba8f3c424d94c7d4935e7e7eb4791d34f5db05c3881d0685f4af3d543c86ea7b1fb23e9e40297838eec391bc87bf4dfce6974ab4cf0b25a2c1cd58d2f

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
236KB

MD5
146108f297c0bb51a4aa472ac912f2b6

SHA1
deae1a2b06fcc445f7c18eee19d14de216735005

SHA256
4bd7a6cf7336ace356e4ed7e8943165d38eb9cd77a9572527fb432653f9735fd

SHA512
93dc8cc462109b2dfcfd19ac4f29e93af9527061e44ccf9a919b75223b55164a608d756172f5261564f6f1dce5a5ea5e303d94afa5724417e84c14d20d2fecd8

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
236KB

MD5
b106ea5045519aa01f909dc88237dd86

SHA1
e1c93afc2a38156c7b2536e6db9f6f92cdc1471f

SHA256
ffc27c8cbc13e6b22c89df2abf23d131d716fb09452b651cba3a1031464e12cb

SHA512
64acc54a070f00a1eb6764eb6239f6b2966f7f25e015fc17ecf2588a3fcd06b4ad37f5776956a42c370e26c2b5b152e3637b7047fc06ad01e9559c94eb128dbd

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
236KB

MD5
970e5b47916c55dc6c2729ab99132f21

SHA1
aab6df13dc246e36a6c8e70ef3f6ddd660f32a71

SHA256
6553540b28c18db1e56bc55d3ff2e978830a338cfee7ea0fa3d7561abb7e7d9d

SHA512
fd732042a8689ffc634e7a28d6ed08f5db59737d6f2eb4c1aa65e7be27bdb1845ac5c30e95f31172226beea92d7839474e79b23d0ca9c3b931a23cde1acc2bed

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
236KB

MD5
2409ae42891faa866467896dcc482737

SHA1
568cf3ed73abe4910a5062549d0b8e66a27f91fd

SHA256
c252776115ab3569b887c36a86e2855217397536b48aac9cc150c36c9314d57c

SHA512
03103e0e39f43b28a84d14b80a1c01820754684409ced52e6392594c0fc7feeb626f069af5d563b4c460ae6364fd1afc95ad7e78bc6a1ff78e25f880604396ad

Download Submit
C:\Windows\SysWOW64\Mcpnhfhf.exe

Filesize
236KB

MD5
d8f44c30b938ea8d0dbac1176add7fb6

SHA1
1f02fc2f294eceef7a6455d9f9b734bec90441ea

SHA256
10b97d0456c0290bcf56c8ad952ec0809404b391f0bd4b6dfe258e43a42d9807

SHA512
a049da47c7ac0b6efe384fb1d780f062e816e46d1d427c1a70782e14bb105d5ca701672a4f0009dfb5c54147273e132a3457781ffccc08cef5ecff69d9cdda06

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
236KB

MD5
6aa25bd3451a8c51b674e6b2d8a067e5

SHA1
b180d2bcaca805c3598508f6cecbf8cbd1d84577

SHA256
6b5c6ee8c0def5c23271c800a1da432f21cbf6d3d591f9c1694e6a2e1443eaef

SHA512
4a20e927f80b69e7e58e66b121f5291dca0af787aeffd9fd3db2bf441bafd9b11289dcde63bff3299689897fe334743abc598a92c16c9819826b157def84b677

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
236KB

MD5
3130f6d400dbe764522c07fc062bc1f7

SHA1
28fc77db0aa38991d65b55502acd29782e37af0d

SHA256
098f19642fec0571d945a44347d9ceb4819e443f2a4d997011fc61050220fc02

SHA512
eddbf0dde6c1478f370b8676a922cda2ec6bdfc54a3e938981ae7555e3dbc90b9ae05f77840aaa49671f7075c6082c5d96f70902c1cb243931e7d4acb46af12c

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
236KB

MD5
03680c1034970f76d9ee0ce6ef11b10b

SHA1
0e4525dcf3b79233502254eb8bdc88c4639645a7

SHA256
6c7d3976f62eaaad50905135612b2e71f82b63e8662674c9d3f3c66f69e88e04

SHA512
c0d61f462dad66e1d1596657a7b637ef2a33edf7e331011b5d22df5461151e43f4f6d21408b8855d1647ecb47cf7a10d691ede00770868b31c6a0e1892e35e2d

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
236KB

MD5
ec48cc0ed6d0c9cd1ac0b32340247af5

SHA1
934e61e1dcdfa5b44e8335956e76f11e708613fa

SHA256
1ca3d2116ee676b425d2d898f8ffbee4355d9f622e0f03986381a2f82860f63e

SHA512
aab546c80ed982fbc9b961a705ae35aaa8df42584bb5192e3ada77d1081812513adbc2b6f6893515b299a29369f300251f6ccf69289c60178d04b693b220501e

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
236KB

MD5
4a507b07fe2979d6c8e1d17621b58981

SHA1
ea1e97e0ad44c6a5823dfd058873e3b380264593

SHA256
98cd1e60043b73dcfc508886505bbe0be974e09247efd0bb6983c29363152303

SHA512
a4fc8884f3b7c4e34c52a86d32c34f3de48b24efe400e49e53779d4eb3e1943b297412901f8c252f28d1e01b1d2113f5b9f3b188f6bbe1f5d06deca92be5a99b

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
236KB

MD5
05229da86b72f3c5f822319860d03ce2

SHA1
53a4c5bebe0a748e517577fcef34a5c00e35f2c8

SHA256
bba723c6fbf05bb8e6d3b7f5042e3e838a251a89e833f4973322921780bf4ae1

SHA512
9b639fb0283e010d26e525d73a1d36516ad6c94c60bd20ae67a9a4dfdd54679db52971e53dc8af7d6528a81d35a4bfd65d1d83f607ddd8453452fef6ed9d2fe3

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
236KB

MD5
c164ec1c6d7aba03a358324f95ce44b0

SHA1
06c838e90710cdd197ca776a7ec479ee6d380088

SHA256
535bdef71585aa3e30bec9705c7799c4db0c15cc47238a02bf5914e6263c663d

SHA512
a041cef29e640afd77845f2f2e22592d36b84638c4d04445ef90e8290731f653999a6f438edaeb7db58c5a2278efa577872eb499af0a2845b62868e20188c3d6

Download Submit
memory/224-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/368-162-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/452-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/644-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/920-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1132-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1192-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1504-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2000-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2060-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2096-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2132-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2240-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2348-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2460-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2664-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2788-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2816-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2876-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2968-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3012-114-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-218-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3056-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3140-154-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3244-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3288-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3320-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3376-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3388-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3432-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3524-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3600-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3640-76-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3816-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3860-250-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3868-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3960-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3980-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4032-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-186-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4412-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4452-391-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4468-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4496-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4604-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4728-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4796-131-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4924-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4944-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4996-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads