547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe
Size 128KB
Sample240611-1ynexstcpg
SHA256 547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6
MD5 46364029eba8672db723bfeeabcbbc08
SHA1 c7cf3021501df20fac5b20549823b483e9383c6a
SHA512 8bf76cae6879fbd47dc260316a20d3173be1cf635b08727909339c679cfd5649ace4bc9b688c7263d01a31151a9d2dac0b87edf5cb87414623cade4b98def252
SSDEEP 3072:IYymXEqXmy3YLUWg67IaLFhwQ9bGCmBJFWpoPSkGF:IYuQI+6DLFhN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdffocib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgekbljc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgghhlhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laalifad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldkojb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaemnhla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpepcedo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffocib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maaepd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmegbjgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdpalp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqfbaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liekmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmegbjgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpepcedo.exe

Executes dropped EXE 64 IoCs

pid	Process
2920	Kmegbjgn.exe
5044	Kpccnefa.exe
3988	Kbapjafe.exe
960	Kkihknfg.exe
2656	Kmgdgjek.exe
4612	Kpepcedo.exe
1144	Kbdmpqcb.exe
5108	Kkkdan32.exe
3656	Kaemnhla.exe
1604	Kdcijcke.exe
2984	Kknafn32.exe
3876	Kdffocib.exe
3304	Kgdbkohf.exe
2440	Kibnhjgj.exe
436	Kajfig32.exe
784	Kckbqpnj.exe
972	Liekmj32.exe
4924	Lalcng32.exe
1916	Ldkojb32.exe
440	Liggbi32.exe
2088	Lpappc32.exe
1116	Lgkhlnbn.exe
4788	Lkgdml32.exe
3084	Laalifad.exe
4944	Ldohebqh.exe
3564	Lgneampk.exe
4284	Lnhmng32.exe
8	Lcdegnep.exe
3672	Lnjjdgee.exe
4000	Laefdf32.exe
5072	Lgbnmm32.exe
2972	Mjqjih32.exe
4408	Mahbje32.exe
3080	Mdfofakp.exe
1268	Mgekbljc.exe
3924	Mkpgck32.exe
3484	Mnocof32.exe
5068	Mpmokb32.exe
4580	Mdiklqhm.exe
2248	Mgghhlhq.exe
944	Mjeddggd.exe
2648	Mamleegg.exe
3448	Mdkhapfj.exe
1124	Mgidml32.exe
1564	Mncmjfmk.exe
3608	Mpaifalo.exe
976	Mcpebmkb.exe
1136	Mkgmcjld.exe
4652	Mnfipekh.exe
2160	Maaepd32.exe
2240	Mdpalp32.exe
1396	Mgnnhk32.exe
4076	Nnhfee32.exe
4548	Nqfbaq32.exe
3116	Nceonl32.exe
3508	Ngpjnkpf.exe
3292	Nnjbke32.exe
4696	Nqiogp32.exe
4448	Ncgkcl32.exe
2216	Njacpf32.exe
3932	Nqklmpdd.exe
716	Ngedij32.exe
2872	Nnolfdcn.exe
2728	Ndidbn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kdffocib.exe	Kknafn32.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Mdfofakp.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Jjblifaf.dll	Mgghhlhq.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Hlmobp32.dll	Mgnnhk32.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Kaemnhla.exe	Kkkdan32.exe
File opened for modification	C:\Windows\SysWOW64\Kknafn32.exe	Kdcijcke.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lalcng32.exe
File created	C:\Windows\SysWOW64\Bpcbnd32.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Liekmj32.exe	Kckbqpnj.exe
File created	C:\Windows\SysWOW64\Jfbhfihj.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Ockcknah.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Kkihknfg.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Cqncfneo.dll	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Efhikhod.dll	Liekmj32.exe
File created	C:\Windows\SysWOW64\Lppbjjia.dll	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Kmalco32.dll	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Nqklmpdd.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Mdpalp32.exe	Maaepd32.exe
File created	C:\Windows\SysWOW64\Fhpdhp32.dll	Maaepd32.exe
File created	C:\Windows\SysWOW64\Laalifad.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Mecaoggc.dll	Laefdf32.exe
File opened for modification	C:\Windows\SysWOW64\Kaemnhla.exe	Kkkdan32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Kpepcedo.exe	Kmgdgjek.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Kbapjafe.exe	Kpccnefa.exe
File created	C:\Windows\SysWOW64\Kmgdgjek.exe	Kkihknfg.exe
File created	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kpepcedo.exe
File opened for modification	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Mahbje32.exe	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Liekmj32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mnocof32.exe
File opened for modification	C:\Windows\SysWOW64\Mdkhapfj.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mnfipekh.exe
File created	C:\Windows\SysWOW64\Enbofg32.dll	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Gncoccha.dll	Kkkdan32.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Lalcng32.exe	Liekmj32.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Lpappc32.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File opened for modification	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Agbnmibj.dll	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Hnfmbf32.dll	Mdpalp32.exe
File created	C:\Windows\SysWOW64\Ljfemn32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Mkpgck32.exe	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Flfmin32.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Kkkdan32.exe	Kbdmpqcb.exe
File opened for modification	C:\Windows\SysWOW64\Ldohebqh.exe	Laalifad.exe
File created	C:\Windows\SysWOW64\Ebaqkk32.dll	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Akihmf32.dll	Kknafn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	5064	WerFault.exe	151

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jifkeoll.dll"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmegbjgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpccnefa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnocof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdjjo32.dll"	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmmkpmf.dll"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibhblqpo.dll"	Mjqjih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmmcfa32.dll"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqncfneo.dll"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdffocib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjqjih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogndib32.dll"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lppbjjia.dll"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codhke32.dll"	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flfmin32.dll"	Mahbje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkgdml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kckbqpnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkpgck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpdhp32.dll"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdegnep.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2920	4296	547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe	84
PID 4296 wrote to memory of 2920	4296	547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe	84
PID 4296 wrote to memory of 2920	4296	547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe	84
PID 2920 wrote to memory of 5044	2920	Kmegbjgn.exe	85
PID 2920 wrote to memory of 5044	2920	Kmegbjgn.exe	85
PID 2920 wrote to memory of 5044	2920	Kmegbjgn.exe	85
PID 5044 wrote to memory of 3988	5044	Kpccnefa.exe	86
PID 5044 wrote to memory of 3988	5044	Kpccnefa.exe	86
PID 5044 wrote to memory of 3988	5044	Kpccnefa.exe	86
PID 3988 wrote to memory of 960	3988	Kbapjafe.exe	87
PID 3988 wrote to memory of 960	3988	Kbapjafe.exe	87
PID 3988 wrote to memory of 960	3988	Kbapjafe.exe	87
PID 960 wrote to memory of 2656	960	Kkihknfg.exe	88
PID 960 wrote to memory of 2656	960	Kkihknfg.exe	88
PID 960 wrote to memory of 2656	960	Kkihknfg.exe	88
PID 2656 wrote to memory of 4612	2656	Kmgdgjek.exe	90
PID 2656 wrote to memory of 4612	2656	Kmgdgjek.exe	90
PID 2656 wrote to memory of 4612	2656	Kmgdgjek.exe	90
PID 4612 wrote to memory of 1144	4612	Kpepcedo.exe	91
PID 4612 wrote to memory of 1144	4612	Kpepcedo.exe	91
PID 4612 wrote to memory of 1144	4612	Kpepcedo.exe	91
PID 1144 wrote to memory of 5108	1144	Kbdmpqcb.exe	92
PID 1144 wrote to memory of 5108	1144	Kbdmpqcb.exe	92
PID 1144 wrote to memory of 5108	1144	Kbdmpqcb.exe	92
PID 5108 wrote to memory of 3656	5108	Kkkdan32.exe	94
PID 5108 wrote to memory of 3656	5108	Kkkdan32.exe	94
PID 5108 wrote to memory of 3656	5108	Kkkdan32.exe	94
PID 3656 wrote to memory of 1604	3656	Kaemnhla.exe	95
PID 3656 wrote to memory of 1604	3656	Kaemnhla.exe	95
PID 3656 wrote to memory of 1604	3656	Kaemnhla.exe	95
PID 1604 wrote to memory of 2984	1604	Kdcijcke.exe	96
PID 1604 wrote to memory of 2984	1604	Kdcijcke.exe	96
PID 1604 wrote to memory of 2984	1604	Kdcijcke.exe	96
PID 2984 wrote to memory of 3876	2984	Kknafn32.exe	98
PID 2984 wrote to memory of 3876	2984	Kknafn32.exe	98
PID 2984 wrote to memory of 3876	2984	Kknafn32.exe	98
PID 3876 wrote to memory of 3304	3876	Kdffocib.exe	99
PID 3876 wrote to memory of 3304	3876	Kdffocib.exe	99
PID 3876 wrote to memory of 3304	3876	Kdffocib.exe	99
PID 3304 wrote to memory of 2440	3304	Kgdbkohf.exe	100
PID 3304 wrote to memory of 2440	3304	Kgdbkohf.exe	100
PID 3304 wrote to memory of 2440	3304	Kgdbkohf.exe	100
PID 2440 wrote to memory of 436	2440	Kibnhjgj.exe	101
PID 2440 wrote to memory of 436	2440	Kibnhjgj.exe	101
PID 2440 wrote to memory of 436	2440	Kibnhjgj.exe	101
PID 436 wrote to memory of 784	436	Kajfig32.exe	102
PID 436 wrote to memory of 784	436	Kajfig32.exe	102
PID 436 wrote to memory of 784	436	Kajfig32.exe	102
PID 784 wrote to memory of 972	784	Kckbqpnj.exe	103
PID 784 wrote to memory of 972	784	Kckbqpnj.exe	103
PID 784 wrote to memory of 972	784	Kckbqpnj.exe	103
PID 972 wrote to memory of 4924	972	Liekmj32.exe	104
PID 972 wrote to memory of 4924	972	Liekmj32.exe	104
PID 972 wrote to memory of 4924	972	Liekmj32.exe	104
PID 4924 wrote to memory of 1916	4924	Lalcng32.exe	105
PID 4924 wrote to memory of 1916	4924	Lalcng32.exe	105
PID 4924 wrote to memory of 1916	4924	Lalcng32.exe	105
PID 1916 wrote to memory of 440	1916	Ldkojb32.exe	106
PID 1916 wrote to memory of 440	1916	Ldkojb32.exe	106
PID 1916 wrote to memory of 440	1916	Ldkojb32.exe	106
PID 440 wrote to memory of 2088	440	Liggbi32.exe	107
PID 440 wrote to memory of 2088	440	Liggbi32.exe	107
PID 440 wrote to memory of 2088	440	Liggbi32.exe	107
PID 2088 wrote to memory of 1116	2088	Lpappc32.exe	108

C:\Users\Admin\AppData\Local\Temp\547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe
"C:\Users\Admin\AppData\Local\Temp\547d391006c6b4290662ee4bb60c17ba8cfa86b0333050c7e3e0fa9a904147c6.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\Kmegbjgn.exe
  C:\Windows\system32\Kmegbjgn.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\Kpccnefa.exe
    C:\Windows\system32\Kpccnefa.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\SysWOW64\Kbapjafe.exe
      C:\Windows\system32\Kbapjafe.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
      - C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:972
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4284
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1268
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3484
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2248
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:944
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2648
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        44⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4652
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1396
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4076
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        66⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 400
        67⤵
        Program crash
        
        PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5064 -ip 5064
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kaemnhla.exe

Path C:\Windows\SysWOW64\Kaemnhla.exe
Size 128KB
SHA256 643755ff155cf1bfffe46e96d33b974439abd35fbcfd1725a47e36eaa803ab48
MD5 cb2ecb316686b110a1f68e4624a24ea7
SHA1 29ab284200d3eab804bfa79781c457b1ed09fd2f
SHA512 e8f9d68202783056c8998707214cfab655f282442e3293652167db6ae9633405651e6c86064da9fe3a2bfc136cea5f54599540e3b022e41df0c2acd013749eec
SSDEEP 3072:Ohzp9quwYh/g0D1G2usGfq1OFIwQ9bGCmBJFWpoPSkGF:E9GCAFIN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kajfig32.exe

Path C:\Windows\SysWOW64\Kajfig32.exe
Size 128KB
SHA256 2526c3b10c5641b231468bec1b652c6508d1c01b3d945f3c160162e66578d4b7
MD5 171522215644ca2a6068e8e32ab25ea4
SHA1 411e0aef20852e90b8690947ae17b8bbe8a2c08f
SHA512 83a55dedf4bee8cbd602daf678047382765cb2a906d236fc24a23eb82c527b9e5b061b8c0f8f6784c9ab2f76b54bfe5199afe980780e8aaf4359a130589e6e22
SSDEEP 1536:KuomIz6u83SUGHwwtR2LFJHWN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:KLn8iUSwwUFEwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbapjafe.exe

Path C:\Windows\SysWOW64\Kbapjafe.exe
Size 128KB
SHA256 24cc15972c97c063b1bc330254fccbf2752024e11fdc2c3a580ae36ff38b44ed
MD5 d6c793107fca7c3c8bbb2937e8778276
SHA1 84f81fcc7869fdc0ad6253a2b5027279a8efb5c5
SHA512 612a2ab5b3119dcb52cd38bbc99142dddb7c8784530e97b04902ab25421e17bcfb50babb354fa74675c66a4848f6a62bda1f54cf8e9e339ea6d73d86f35c74e4
SSDEEP 1536:RvYRu40wNK0BxYeaZyIjG5VysQy5I5RVPMf392LFJqBN7DqQfV5I+GCmBhjFW+Jm:On0wxyVwvPeFIwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbdmpqcb.exe

Path C:\Windows\SysWOW64\Kbdmpqcb.exe
Size 128KB
SHA256 cacf5526f94ecd138d686a0ff922f26a494a242dcc36d64791e753849a6d9681
MD5 eff63fcde1d0cfcebbab80ac623b4052
SHA1 5e4389b2876a0b61c26b36c26a6efc000c743120
SHA512 802707dfb2b3a3602e933cbedb524f9dbcea4a84cf92b342173c94bdcf079a377c4172dcbc5a4c2c215d6398cc57fa5e93da04130d0f80f685a11fedbc5c10bc
SSDEEP 1536:89sZ8XJJ+8E9vGbaMGq8V15nTZK42LFJUN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:8+sr/k15nTeF+wQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kckbqpnj.exe

Path C:\Windows\SysWOW64\Kckbqpnj.exe
Size 128KB
SHA256 3c98260059e9a2236318b53d423d775bd79c1c257727f2abb80dfcc41436df86
MD5 e9f965165e2fd3309d0686ef1f5d109b
SHA1 e742ddcc2e79c8216e2a584f9c7bb4d153d37b12
SHA512 4719e7910779d48e455542acb6f6dcbd820da368a32ae64e87e6fdfc7403adf8408e48fecd7d72aba172e4f0cebdb4c8d3e7b6ae8674da25ce47a516d589a72d
SSDEEP 1536:OoYpe/tYvfO16DTwFkIFup2LFvN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:5164FkIBFvwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdcijcke.exe

Path C:\Windows\SysWOW64\Kdcijcke.exe
Size 128KB
SHA256 aa5480e16dac13d4bf63e1003a7affeafddae373dde41b97085e2721a8cee6c4
MD5 679f868d464513e61f2dce05889ad743
SHA1 c9efbc5b4f56b8d17635cd90b1b30d19d1105a18
SHA512 04fc3eb6f0b5626741eedbd79a1fc22c9672db205e285d6c7892449a8e3e39d37440024cd7a636a686945448c98c282dd316599a2ba879fca3bc95f1ac6c1ee6
SSDEEP 3072:yqa6NZC9AG8FwDwQ9bGCmBJFWpoPSkGF:y4C9AG8FwDN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdffocib.exe

Path C:\Windows\SysWOW64\Kdffocib.exe
Size 128KB
SHA256 b43b3a27b0f9e71f1913faeb91edb548ec9d0821c0cc42c1bb0155404adfd2cb
MD5 e82be16d758c92afd3ceba682a3e0d1a
SHA1 c6ad92e73a292c75bc239c337e16a7bdc9f1bdfb
SHA512 bad9aa13249a8bbd3feb43b3272bb712a75c2f54c3b0e2de04d6735112abb1cc8b1b918ba2eadfb0a08a9d7dc740230b4e6d5026e372c910e6c9b292bcb29855
SSDEEP 3072:ZnvqKIqPadsr+pxUK0P3JOFswQ9bGCmBJFWpoPSkGF:5/qxD0MFsN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgdbkohf.exe

Path C:\Windows\SysWOW64\Kgdbkohf.exe
Size 128KB
SHA256 16334e1ea578957bdbc551762d5db1318f351ed9a0b212d93cf46dfd16f93ecb
MD5 fc6cacef5e8cea5af95c793dd5c542a0
SHA1 0870a4ae77f7d1c7128ae6af6924824754ced375
SHA512 538f45ae59dcfdea67bea4989f1944afe0affdfc5dd6f756e7900b9b574e933c75a89525a203f73521811503bfc3d611ca2f8c86887e64b54b1b07d031663c68
SSDEEP 1536:Q0LNP0Drhw1XqWPxMtl0V1FrLg72LFJ7N7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:pqk+t8FHzFxwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kibnhjgj.exe

Path C:\Windows\SysWOW64\Kibnhjgj.exe
Size 128KB
SHA256 501a6b9a1c8050f74f751053a377ae5f11f0f7cd8b74a0fadc90de8f7d1db73e
MD5 08570011a19b684bc70cae57c22a2179
SHA1 e80e89dfd1efcec5cf5801b097a9ca7e1c4e4d23
SHA512 13cffa9b4b2ed48e0522179f2fa465875d3efdfb70b03885a74567df45c3c2df24a805da6bc645d323c3b46f5800728dd969057c6678b710c4252f8958e57120
SSDEEP 3072:pDIkw+9QfUpfFPfFUwQ9bGCmBJFWpoPSkGF:pDi+9QfUvFUN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkihknfg.exe

Path C:\Windows\SysWOW64\Kkihknfg.exe
Size 128KB
SHA256 7be22ab7115fbd80cabe1253c366baf3709227863d22f59222613ceb20e13e78
MD5 100a8d53d0ecf811d9eab247c6adefd2
SHA1 f6cc54d3d627d6538a5cc322988931af9505eec5
SHA512 452fa1614e806e2532ea7676a340bbbd6f8301c5be0d315f23eb900e07e6fc01757d965b0b683f037be7fa248de5415aa9a4bfc9c1109240b5b1449af6c66a6a
SSDEEP 3072:ckBtj2LEyiZmF9wQ9bGCmBJFWpoPSkGF:dXNTZmF9N9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kkkdan32.exe

Path C:\Windows\SysWOW64\Kkkdan32.exe
Size 128KB
SHA256 32572ea187bd1b35cf7a59238968cf9c1dbf8ef67703269e9ddce2c8e8893d10
MD5 c636eb1a418217659b71b7da0aa0f12d
SHA1 3c7fab20dc5c08d371f5d82743c0959df90c3c6d
SHA512 e6edffdf52ca9866f74892c8017fe271a517c090d0aa89de4089390a79307de19c2882e870d1efbca4c15480bff771eca632b20c9ff157037619d6783eec7e50
SSDEEP 3072:0L2Ctfld2vCeC2d/FRwQ9bGCmBJFWpoPSkGF:0KCLm1C0FRN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kknafn32.exe

Path C:\Windows\SysWOW64\Kknafn32.exe
Size 128KB
SHA256 8f855d49ba9dbcd371bfd4a9ce2d771fddecc4004790f976c9c25060ed183ab0
MD5 0055da0897463c1fe44065363677924a
SHA1 6fd62307181fd3e1f977a35bc2591161b1c34a0a
SHA512 6880bf5e0be862b0d54f6574c193a3a5467904ea5422ea4d3737f324c58a5e98bd25a088e1b4e1cc41656a4964f1709778ef8c77639fc8f6354a760de36193b4
SSDEEP 1536:R2G3QUGpUhoWnw4wzXttHAD2LFJaN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:YG3ISd47zhFkwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmegbjgn.exe

Path C:\Windows\SysWOW64\Kmegbjgn.exe
Size 128KB
SHA256 80c439bb65d19b3a6f193c6e6360a30c42ae66e3a99281ed47ce5626ce61abf7
MD5 d69b97973e78a6bc2da495844a228279
SHA1 5a7b6d9037feee287491ba5bd5d19e2cff5adb3b
SHA512 1789e98b47b0b7e09868fb9cad324d0e07888c82125f2c6c8d98c23daf8b378aef0c0148493554ffe6773756886797c7a12121ac3137524cc447f215f50799e3
SSDEEP 3072:JB9G8jfX2Pa4y33F7wQ9bGCmBJFWpoPSkGF:JB9G87aC3F7N9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmgdgjek.exe

Path C:\Windows\SysWOW64\Kmgdgjek.exe
Size 128KB
SHA256 67050cecf1179c524a73ab14a7b1b1b50fe8678ecbcfe45614c56100e694e7e1
MD5 cc78ef10fb3378ff26553b702e96aef9
SHA1 12ff53cc8025e135883a4ada497ecf9ba8757d07
SHA512 7700ed458a3cb606f1e9a1767390950a4afeaeb6bcdec6a2ebb04a41c586e946a2cc538d8c041b9091c05d5df596fffc66346091a268dece086a3d791f33cfec
SSDEEP 3072:ZCr+ccD+KZkW+2FQwQ9bGCmBJFWpoPSkGF:Zaq+6N+2FQN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpccnefa.exe

Path C:\Windows\SysWOW64\Kpccnefa.exe
Size 128KB
SHA256 5e455cb287523760ab63ec567e05397a60d695b1e0be3dd56e4752e593fe2247
MD5 f1c03ea7b28737c216f621fa0ad8f400
SHA1 ecdf3e0299f8475262f4ab1d29355663d903dd87
SHA512 e045d1fa80a086dabc1854d95ff4200919b5df68907a9b81c43060b267c8c517fdcc226d0de23df1f225a5d01e6fdbddf86af39056a360794d8bc51ab57388ad
SSDEEP 1536:Bbz2iTlbCHGNZPyzP+QzsxN32LFJZN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:lvlmHWZ6zQoFTwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpepcedo.exe

Path C:\Windows\SysWOW64\Kpepcedo.exe
Size 128KB
SHA256 ed67da8e4bba6183a70d887f7d8dc662522f020ff5b5db768764477850cb55ab
MD5 bb3821fade4fe3c5be65f473ac3666d3
SHA1 045a8cb40ff4396f758f281c76acfed7e05c3fdd
SHA512 680bf31495877795a066b42f79c763fcab387b10cb1b5edf649ac8ac7aa83408cce7dab57c1e9e56f68f4e7aa18a8fa6b7c852831c62d25ee2241733d1c477d8
SSDEEP 3072:ZqqSE3xMc9VksEJFUwQ9bGCmBJFWpoPSkGF:ZFXKFUN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laalifad.exe

Path C:\Windows\SysWOW64\Laalifad.exe
Size 128KB
SHA256 dac4a79a9045bbad3a11693d7a85ba925ce64935b7e9e0f10339cbecd091277f
MD5 63f63d25e6d2e3efcd0e176f32bd018e
SHA1 c5b8ade22a44d100485d5d60cd8a68121bb7fb37
SHA512 87b22a01af4cc31ace15101ae272b3aa75eae88773b7180e0fbcc7d75cc7f78d30fbca73a852fbddc252f65210637d12c880f7fa2714ad9bf4f12ba831430aa2
SSDEEP 3072:dCMB+5oogffLPL/LULPLflLILYLhGHB9recVFHwQ9bGCmBJFWpoPSkGF:dCMB1BfLPL/LULPLflLILYLhGh9rNFHS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Laefdf32.exe

Path C:\Windows\SysWOW64\Laefdf32.exe
Size 128KB
SHA256 d0945413072c43170e8633ff58e61d3c33e6c9be9c0a985af4b359c3a717e0a7
MD5 b754767f36d1f74b6c62c0c1ca7f34b9
SHA1 ad2e95fd18a60c85b0610d9fda3cf731c390d0fd
SHA512 706ba4372b55b76ffbdfd6370000a1b553e14ff091ddcd2e1d6b75d3308fbb8a9f2b8d91285140f6a0be5b8cd31cd93663741426894cc45a1802f1a105e81e2f
SSDEEP 3072:LXqgsgrsIQrhFJwQ9bGCmBJFWpoPSkGF:NfrsIQrhFJN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lalcng32.exe

Path C:\Windows\SysWOW64\Lalcng32.exe
Size 128KB
SHA256 90ae63e3d00c30d83a9db36b891900e1039d891e9f0cb43cc28b3d03c1be4331
MD5 4a9a69a87a23bd6f1e5f24b4cf501c65
SHA1 c0d59d4fa631fbf221e19f9a038198a1d822c278
SHA512 9b1a73a4f9aa8bc403fd2acf9ef4b9805f5f54c5ff888f2f367604ee9f8790a15952ef2878f50b9850428c5d6e2ed32d0c00c2fa980113bff515054c21feeed1
SSDEEP 1536:7u7jhjVPwADcGt3q2LFxN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:EjhBYycGt33FxwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lcdegnep.exe

Path C:\Windows\SysWOW64\Lcdegnep.exe
Size 128KB
SHA256 c8412aea468166e452cecd8f034142f42d3a26db12b1d279330484761f1a9d1b
MD5 a97da51d5f09ba96892f2c364d22dfaf
SHA1 8cf388b8c9efaa7438435491fe796c0bbd09f2b3
SHA512 b3bf0f9d8a4fc3a43bdbf510646fb5199ca2936ef65bcfdd530761d4959b489880272157f382f722cf6afdb09eb72600fb43272572cec52f0dfeb70f48e788ba
SSDEEP 3072:A4Z6PCZVfnE1tMTTQrF7wQ9bGCmBJFWpoPSkGF:A4Z6aZVfotOQrF7N9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldkojb32.exe

Path C:\Windows\SysWOW64\Ldkojb32.exe
Size 128KB
SHA256 cacda464a4345ee45e3ea1e62eb8f193ee643a1b8e4428eb27fbad70ffa33603
MD5 19d1bb30ac041584e0c13ca61f30d5ce
SHA1 6edecfea6e2de925ba78693147ea3fa3bbef40a7
SHA512 029a92eb716036cff035586944d00aa873b79d587464e19ae28ed27f592fa251b0f623b6c266becf9babb35a1ece3c1b60a535edaf0a1ecc33150e63f32ecd16
SSDEEP 1536:nOu00LYlZGCLp3ne2LFJdN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:OlPt3jFfwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldohebqh.exe

Path C:\Windows\SysWOW64\Ldohebqh.exe
Size 128KB
SHA256 50856f44f3a3c6caf40c10619caacc0af5d3d68c7302e25219a440ffc32a824a
MD5 419813974028c212de3b9c498ab80f18
SHA1 a0f657be7dca2cb9ce7b99d8c1c27958b07276fd
SHA512 e34c3d3c2c809d1e7612e67f9841c21d672c68159f59e5d8ed5d6c3b7fb88ff2267f191d7d971c62686b8346dcd98e3dd4de8d05548c5d7c75ca86b6e1b4485e
SSDEEP 3072:jTHtboXFyqzcxFXwQ9bGCmBJFWpoPSkGF:jTHtbYIkcxFXN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgbnmm32.exe

Path C:\Windows\SysWOW64\Lgbnmm32.exe
Size 128KB
SHA256 2a70fc6a5854d084d1fd125a10d5287157d8e2b844862554a64160655456a786
MD5 456deb3c9e5f389700b062df8607e93e
SHA1 2f4f7afe8c81215656891d0dc2d42c191d330ade
SHA512 3d671bb991f57cd5bd03dfc55dd72a9940570091c43d8e2808f5392a76332b0430eb1fc741b85bbe0471f96373e7ffd247ff32492792dd8ef0c3e777d160c3f5
SSDEEP 1536:mMzNr5nzG5dzsP98qJOYTK6Wph2LFJcQN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:mARzGS8upRFfwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgkhlnbn.exe

Path C:\Windows\SysWOW64\Lgkhlnbn.exe
Size 128KB
SHA256 f339c3cc52783331b0a482ef478ad0f3210515a15ad94f80af68556c65253630
MD5 39fe50df6988f0eb6546fbb65c40a586
SHA1 8901a09ebb9fc779fa5cac1269be8239ba092e47
SHA512 b9614a63b782ebeaeda421782b22346bb19714d73618cf579bb4bf66fafafce5c5b2a997d3fd2f5662cdc2af0df8a25ec39645d8d6a028d7af2c18ac60a71bd7
SSDEEP 1536:jeDMhBuhVxyFOy5rFfFsonMXq2LFoN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:jCAux0xU3FowQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lgneampk.exe

Path C:\Windows\SysWOW64\Lgneampk.exe
Size 128KB
SHA256 85a9dba25cee8b8be7a092e05534016e1f250c42d863f66f4050361e057646ea
MD5 e74ce55abbcd221380f8be556f69f36a
SHA1 c78d616214dffdace0cfd5cae555cfdc066528e0
SHA512 3b07225e4cd806b3ac2b7c482c606a446bb13f711d38bf839a36cdd39a05ea43b7d41fe741322cae685c1ce2e59f998323c178f72869c969e3bf0c09a238778e
SSDEEP 1536:aoLpzw6CaPUvXtCiyde2LFgwN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:JpP/Mvoi2FzwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liekmj32.exe

Path C:\Windows\SysWOW64\Liekmj32.exe
Size 128KB
SHA256 aed1e82403d3bf6f8e31d750e72dcae0da63f0eb709f473fa3c906905afbf9ec
MD5 60e1b9fcbe562e9185b485b383d34606
SHA1 73e0f7dff29db06dd66f2720771f5d320597b4de
SHA512 48c39f74060755d3d4e885bef7b3992525754931bd03c965df2731182b7fbd95bf793fd1a3f02bed79657c73a40d07d606f3830d392a07af488bc8d4c9594900
SSDEEP 3072:VqRX62pvUcuB9FqvwQ9bGCmBJFWpoPSkGF:gRzp9m9FwN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Liggbi32.exe

Path C:\Windows\SysWOW64\Liggbi32.exe
Size 128KB
SHA256 308df0b7c0f3205c266dda5f282caa04f2b74355d2dba176975db9bf1c3820e4
MD5 5ad9c0fc478a52713ff1445c03221514
SHA1 9895253a7acd28ff6498de52af4c6e3a83783c60
SHA512 7a3e7cb1573e5682e64a17edc14f3bab48e8148d593f4197ebc8dbc2d554ae68ef7e2fb0ebee15ad24f0e80e75d6d0475f88acb3bcf5c9945b282df25776fca2
SSDEEP 1536:fTmUv+rscLFRpaWzneA5G2LF4N7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:iUvO3a+F4wQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lkgdml32.exe

Path C:\Windows\SysWOW64\Lkgdml32.exe
Size 128KB
SHA256 68ab53b1464144a0409aef8b15d6fb58ab77e0132015d708115daf45874155d5
MD5 d3926379e9d8b5c8991e283c808ccf33
SHA1 555e2bbe4f0aebff50baaa075190e6657065b1b5
SHA512 989bec9085c1e27ff80466c9cd07db0be617c7c08185a0c3f9c8ca38ca1ff4f227946667aba18a3b708555a64bbabeb4a0083a382400de15bb285fdcc50c7db0
SSDEEP 1536:cpO3RCZjgjcCbVZnjgbv12LFJ+XN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:cMEZfubFMXwQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnhmng32.exe

Path C:\Windows\SysWOW64\Lnhmng32.exe
Size 128KB
SHA256 99e4b3c24a5c3fc1590088e42b2e12751f698f300bb1239d764f6f9d8b7c3636
MD5 b5abaedbd725e77d1d28fc32ccb4e75a
SHA1 204f184b447f50d73d9ab5cb5b44a9edbe6adb60
SHA512 97cf219a32fb1412fa40566c3f6e33b558f907c74ad201e4f06290411f47134f236b4f477d49e5018ee3ced39fa03895aabfa2d090e979c77c89d78ae09dc1a6
SSDEEP 1536:RLK+z0GhpijVolNQB2LFeN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:RLK+NhKV6QaFewQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnjjdgee.exe

Path C:\Windows\SysWOW64\Lnjjdgee.exe
Size 128KB
SHA256 c8dfaaa5b7e6629d4a5a860f0a842b59e173ec0d02c82056cf3e4647c30eed3b
MD5 cd0342a6b85f4e1cbc1a46388a5c4a7d
SHA1 c97f8558e66fdc33a7c2fa10ce56431aeaa3b077
SHA512 2bd5ab52a454a903015f8b8e6997e954098f5978204068b68c43c425ce693d676ce6b6a805e8b7ad593aebf33b2120eb6a6f26a5ed22f61329176506c30b2215
SSDEEP 3072:Td/COkP54dqPTEztFHwQ9bGCmBJFWpoPSkGF:Td6OkP5zQFHN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpappc32.exe

Path C:\Windows\SysWOW64\Lpappc32.exe
Size 128KB
SHA256 61fe3d4468f4bc7d52757129da6298e294b607b525f578fbf6202033bf68d68a
MD5 831c34daa4fd18b2472d1eb363e7eab6
SHA1 957b50ce03f22b997759ec388a3a7d389d9ef175
SHA512 4cc6a96f57ecdf68b34f153ede958c9916b6cf8df1eab7b2b643c28bfe8090a240d05ef4149e2e4add2fcf4ab2dab96218722a438d9dd0569e658f3df027eafa
SSDEEP 1536:Z84w4mFdxn2yhvQ2LF2N7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:3YnxxhJF2wQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjqjih32.exe

Path C:\Windows\SysWOW64\Mjqjih32.exe
Size 128KB
SHA256 77f5c7b19c71a8da0d0f8769b8d1dfedc83918b9e97f1bc8669ac2a73386b2d1
MD5 5801f7fbfda0f9e9f5027782ad047c5b
SHA1 aa8e4c42c5d2906e66cdf24056fc2f0d6505f316
SHA512 c959dc2e15a67dda04b633586b3722bdb2f9bf3cfba6f945342964c15708f74a955ccffa3137655c3b4ee8b6cacfd76d6a160285d76d3bbb00f854038f204e0b
SSDEEP 3072:ptzaV6IUQhH2SflHFJwQ9bGCmBJFWpoPSkGF:plaV6IUQhH2S5FJN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 128KB
SHA256 412902ec85559bbf33354b2bcdabdb8eb23dd18a8492bf9576a8f3211e07aa96
MD5 152252425c0680843c5d02dd54b0d5cf
SHA1 4f84c55c30be30283cf58ca41b51c43b7937b231
SHA512 0c7680353a39b4cf1606239ad116eb1158d18c0f7fb13b948a397dee40397a429a19fbed8b8d52ca2a779305d52c7d60b432b1a2111156c566075b56228c619a
SSDEEP 3072:DFJmbzni+H5HHOOOF4FYwQ9bGCmBJFWpoPSkGF:ZUfpH5HHOOOeFYN9bGCKJFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 128KB
SHA256 3ed8abc1cdc39a17ba8efbee98176485817be27cff77d485504ba37d5db4a9e9
MD5 bf91afc3a03f3fc25c8e3cad75b9e8fb
SHA1 c92c46f30279d13e23be17f5aa9d811098a20d2c
SHA512 6076def67d1a253685c1b5733872a0e5d46e40823b737fd5136122dc0aa78b60c37b515d91e76946b9e42c015571542cb3fb93fd5806e87b9df74d7e90e5440e
SSDEEP 1536:4El7tODOEJtnyV5+azutt2LFJYN7DqQfV5I+GCmBhjFW+JCYTDPSkGF9:4El5ODrtnF+FywQ9bGCmBJFWpoPSkGF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-483-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/8-224-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/436-121-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/440-160-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/716-437-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/716-457-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/784-129-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/944-311-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/944-473-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/960-33-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/972-137-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/976-468-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/976-347-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1116-177-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1124-470-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1124-329-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1136-357-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1144-57-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1268-279-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1268-477-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1396-377-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1396-466-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1564-339-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1604-81-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1916-152-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2088-168-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2160-369-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2216-425-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2216-460-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2240-375-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2248-305-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2248-474-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2440-113-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2648-472-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2648-317-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2656-41-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2728-453-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2872-443-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2872-458-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2920-9-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2972-261-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2984-89-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3080-271-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3080-478-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3084-197-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3116-400-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3292-409-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3292-462-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3304-104-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3448-323-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3448-471-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3484-287-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3484-476-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3508-463-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3508-401-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3564-208-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3608-341-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3608-469-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3656-73-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3672-233-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3672-482-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3876-101-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3924-285-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3932-431-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3932-459-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3988-29-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4000-241-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4000-481-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4076-387-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4076-465-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4284-217-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4284-484-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4296-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4296-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4408-263-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4408-479-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4448-423-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4548-393-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4548-464-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4580-475-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4580-301-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4612-49-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4652-467-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4652-359-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4696-415-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4696-461-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4788-185-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4924-145-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4944-205-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5044-17-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5064-456-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5064-455-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5068-297-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5072-480-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5072-249-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5108-65-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads