f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1

Analysis

max time kernel
136s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Size

111KB
MD5

8f2985103fa5aac7c83aa994f92e728b
SHA1

e7c07e92bca630f8516eeba71b56d38f61003614
SHA256

f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1
SHA512

ece6929363d4f4ba6df2d5530aa81e6e68f5914128991699210d54b5995e86fbb180f653d550e378aa0cc19fe57b34d9813a986a63f6b1932f24e56c3499e1d9
SSDEEP

3072:UiglNva8DOe9AE0M4/EWjurUJ2an0edpw0v0wnJcefSXQHPTTAkvB5Ddj:/glnOe9AECEWjuro2aPFtnJfKXqPTX7V

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mbibfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njedbjej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfccogfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofgdcipq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqjbddpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbnlaldg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njedbjej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqmhqapg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pblajhje.exe

Executes dropped EXE 29 IoCs

pid	Process
3412	Mbibfm32.exe
3724	Mqjbddpl.exe
4940	Nciopppp.exe
2848	Njbgmjgl.exe
3380	Nqmojd32.exe
3120	Nbnlaldg.exe
3948	Njedbjej.exe
1800	Nmcpoedn.exe
3632	Njgqhicg.exe
4340	Nodiqp32.exe
544	Nbbeml32.exe
464	Oqklkbbi.exe
1476	Ofgdcipq.exe
4472	Oqmhqapg.exe
3872	Obnehj32.exe
2636	Oihmedma.exe
4208	Ocnabm32.exe
2748	Ojhiogdd.exe
4972	Pcpnhl32.exe
4196	Pjjfdfbb.exe
4392	Ppgomnai.exe
4904	Pfagighf.exe
4296	Pmkofa32.exe
2952	Pfccogfc.exe
3988	Piapkbeg.exe
4116	Pbjddh32.exe
5104	Pidlqb32.exe
1108	Pblajhje.exe
3620	Pififb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nbnlaldg.exe	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Debcil32.dll	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Nmcpoedn.exe	Njedbjej.exe
File created	C:\Windows\SysWOW64\Njgqhicg.exe	Nmcpoedn.exe
File opened for modification	C:\Windows\SysWOW64\Pfagighf.exe	Ppgomnai.exe
File opened for modification	C:\Windows\SysWOW64\Pfccogfc.exe	Pmkofa32.exe
File opened for modification	C:\Windows\SysWOW64\Pblajhje.exe	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Imqpnq32.dll	Mbibfm32.exe
File opened for modification	C:\Windows\SysWOW64\Nciopppp.exe	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Nbbeml32.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Qckcba32.dll	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pjjfdfbb.exe
File opened for modification	C:\Windows\SysWOW64\Ppgomnai.exe	Pjjfdfbb.exe
File created	C:\Windows\SysWOW64\Piapkbeg.exe	Pfccogfc.exe
File opened for modification	C:\Windows\SysWOW64\Njedbjej.exe	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Oajgdm32.dll	Pfagighf.exe
File created	C:\Windows\SysWOW64\Pfccogfc.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Naagioah.dll	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Fpenlneh.dll	Nmcpoedn.exe
File created	C:\Windows\SysWOW64\Ildolk32.dll	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Obnehj32.exe	Oqmhqapg.exe
File opened for modification	C:\Windows\SysWOW64\Ocnabm32.exe	Oihmedma.exe
File created	C:\Windows\SysWOW64\Mpiedk32.dll	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Mqjbddpl.exe	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Njedbjej.exe	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Oqmhqapg.exe	Ofgdcipq.exe
File opened for modification	C:\Windows\SysWOW64\Oihmedma.exe	Obnehj32.exe
File opened for modification	C:\Windows\SysWOW64\Pmkofa32.exe	Pfagighf.exe
File created	C:\Windows\SysWOW64\Pblajhje.exe	Pidlqb32.exe
File opened for modification	C:\Windows\SysWOW64\Nqmojd32.exe	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Nodiqp32.exe	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Oqklkbbi.exe	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Gejimf32.dll	Oqklkbbi.exe
File opened for modification	C:\Windows\SysWOW64\Oqmhqapg.exe	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Hlhmjl32.dll	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Fjoiip32.dll	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
File created	C:\Windows\SysWOW64\Alapqh32.dll	Nciopppp.exe
File created	C:\Windows\SysWOW64\Bepjbf32.dll	Njedbjej.exe
File opened for modification	C:\Windows\SysWOW64\Ojhiogdd.exe	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Pjjfdfbb.exe	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Eapjpi32.dll	Piapkbeg.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pbjddh32.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pblajhje.exe
File created	C:\Windows\SysWOW64\Nnndji32.dll	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Ofgdcipq.exe	Oqklkbbi.exe
File opened for modification	C:\Windows\SysWOW64\Pbjddh32.exe	Piapkbeg.exe
File created	C:\Windows\SysWOW64\Ajhapb32.dll	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Pcpnhl32.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Kqkplq32.dll	Pcpnhl32.exe
File created	C:\Windows\SysWOW64\Nffaen32.dll	Ppgomnai.exe
File created	C:\Windows\SysWOW64\Nciopppp.exe	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Nqobhgmh.dll	Mqjbddpl.exe
File opened for modification	C:\Windows\SysWOW64\Nbbeml32.exe	Nodiqp32.exe
File opened for modification	C:\Windows\SysWOW64\Oqklkbbi.exe	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Obnehj32.exe
File created	C:\Windows\SysWOW64\Kpikki32.dll	Oihmedma.exe
File created	C:\Windows\SysWOW64\Ojhiogdd.exe	Ocnabm32.exe
File opened for modification	C:\Windows\SysWOW64\Piapkbeg.exe	Pfccogfc.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pblajhje.exe
File opened for modification	C:\Windows\SysWOW64\Mqjbddpl.exe	Mbibfm32.exe
File opened for modification	C:\Windows\SysWOW64\Obnehj32.exe	Oqmhqapg.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Pjjfdfbb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	3620	WerFault.exe	121

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofgdcipq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qckcba32.dll"	Ojhiogdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhapb32.dll"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njedbjej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpenhh32.dll"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjoiip32.dll"	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllhjc32.dll"	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejimf32.dll"	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjjfdfbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdpoomj.dll"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnndji32.dll"	Nbbeml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajgdm32.dll"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pblajhje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpenlneh.dll"	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mbibfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alapqh32.dll"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njgqhicg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nffaen32.dll"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naagioah.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ildolk32.dll"	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oihmedma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjjfdfbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfccogfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpikki32.dll"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbjddh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njedbjej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agolng32.dll"	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhibfek.dll"	Pbjddh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imqpnq32.dll"	Mbibfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oqklkbbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mqjbddpl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3412	1816	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe	93
PID 1816 wrote to memory of 3412	1816	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe	93
PID 1816 wrote to memory of 3412	1816	f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe	93
PID 3412 wrote to memory of 3724	3412	Mbibfm32.exe	94
PID 3412 wrote to memory of 3724	3412	Mbibfm32.exe	94
PID 3412 wrote to memory of 3724	3412	Mbibfm32.exe	94
PID 3724 wrote to memory of 4940	3724	Mqjbddpl.exe	95
PID 3724 wrote to memory of 4940	3724	Mqjbddpl.exe	95
PID 3724 wrote to memory of 4940	3724	Mqjbddpl.exe	95
PID 4940 wrote to memory of 2848	4940	Nciopppp.exe	96
PID 4940 wrote to memory of 2848	4940	Nciopppp.exe	96
PID 4940 wrote to memory of 2848	4940	Nciopppp.exe	96
PID 2848 wrote to memory of 3380	2848	Njbgmjgl.exe	97
PID 2848 wrote to memory of 3380	2848	Njbgmjgl.exe	97
PID 2848 wrote to memory of 3380	2848	Njbgmjgl.exe	97
PID 3380 wrote to memory of 3120	3380	Nqmojd32.exe	98
PID 3380 wrote to memory of 3120	3380	Nqmojd32.exe	98
PID 3380 wrote to memory of 3120	3380	Nqmojd32.exe	98
PID 3120 wrote to memory of 3948	3120	Nbnlaldg.exe	99
PID 3120 wrote to memory of 3948	3120	Nbnlaldg.exe	99
PID 3120 wrote to memory of 3948	3120	Nbnlaldg.exe	99
PID 3948 wrote to memory of 1800	3948	Njedbjej.exe	100
PID 3948 wrote to memory of 1800	3948	Njedbjej.exe	100
PID 3948 wrote to memory of 1800	3948	Njedbjej.exe	100
PID 1800 wrote to memory of 3632	1800	Nmcpoedn.exe	101
PID 1800 wrote to memory of 3632	1800	Nmcpoedn.exe	101
PID 1800 wrote to memory of 3632	1800	Nmcpoedn.exe	101
PID 3632 wrote to memory of 4340	3632	Njgqhicg.exe	102
PID 3632 wrote to memory of 4340	3632	Njgqhicg.exe	102
PID 3632 wrote to memory of 4340	3632	Njgqhicg.exe	102
PID 4340 wrote to memory of 544	4340	Nodiqp32.exe	103
PID 4340 wrote to memory of 544	4340	Nodiqp32.exe	103
PID 4340 wrote to memory of 544	4340	Nodiqp32.exe	103
PID 544 wrote to memory of 464	544	Nbbeml32.exe	104
PID 544 wrote to memory of 464	544	Nbbeml32.exe	104
PID 544 wrote to memory of 464	544	Nbbeml32.exe	104
PID 464 wrote to memory of 1476	464	Oqklkbbi.exe	105
PID 464 wrote to memory of 1476	464	Oqklkbbi.exe	105
PID 464 wrote to memory of 1476	464	Oqklkbbi.exe	105
PID 1476 wrote to memory of 4472	1476	Ofgdcipq.exe	106
PID 1476 wrote to memory of 4472	1476	Ofgdcipq.exe	106
PID 1476 wrote to memory of 4472	1476	Ofgdcipq.exe	106
PID 4472 wrote to memory of 3872	4472	Oqmhqapg.exe	107
PID 4472 wrote to memory of 3872	4472	Oqmhqapg.exe	107
PID 4472 wrote to memory of 3872	4472	Oqmhqapg.exe	107
PID 3872 wrote to memory of 2636	3872	Obnehj32.exe	108
PID 3872 wrote to memory of 2636	3872	Obnehj32.exe	108
PID 3872 wrote to memory of 2636	3872	Obnehj32.exe	108
PID 2636 wrote to memory of 4208	2636	Oihmedma.exe	109
PID 2636 wrote to memory of 4208	2636	Oihmedma.exe	109
PID 2636 wrote to memory of 4208	2636	Oihmedma.exe	109
PID 4208 wrote to memory of 2748	4208	Ocnabm32.exe	110
PID 4208 wrote to memory of 2748	4208	Ocnabm32.exe	110
PID 4208 wrote to memory of 2748	4208	Ocnabm32.exe	110
PID 2748 wrote to memory of 4972	2748	Ojhiogdd.exe	111
PID 2748 wrote to memory of 4972	2748	Ojhiogdd.exe	111
PID 2748 wrote to memory of 4972	2748	Ojhiogdd.exe	111
PID 4972 wrote to memory of 4196	4972	Pcpnhl32.exe	112
PID 4972 wrote to memory of 4196	4972	Pcpnhl32.exe	112
PID 4972 wrote to memory of 4196	4972	Pcpnhl32.exe	112
PID 4196 wrote to memory of 4392	4196	Pjjfdfbb.exe	113
PID 4196 wrote to memory of 4392	4196	Pjjfdfbb.exe	113
PID 4196 wrote to memory of 4392	4196	Pjjfdfbb.exe	113
PID 4392 wrote to memory of 4904	4392	Ppgomnai.exe	114

C:\Users\Admin\AppData\Local\Temp\f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe
"C:\Users\Admin\AppData\Local\Temp\f655d5b7a92ba431988ea62f0280082e62eb8d7740d7cf83dddd4abc3cd1b6a1.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\Mbibfm32.exe
  C:\Windows\system32\Mbibfm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\Mqjbddpl.exe
    C:\Windows\system32\Mqjbddpl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\SysWOW64\Nciopppp.exe
      C:\Windows\system32\Nciopppp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4940
    - - C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
      - C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4296
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2952
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1108
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        30⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 220
        31⤵
        Program crash
        
        PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3620 -ip 3620
1⤵
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1304,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajhapb32.dll

Filesize
7KB

MD5
0d8b9bf625bc46aa03633b314c21782b

SHA1
5a1620392db187558fedfae5a3f877b6c630ed9f

SHA256
81138d196c49262ea89b6cc243a4d14f9d1dc89fc9106ad5cf9e29f197cdcc1b

SHA512
39c36ec9f107f19851cf464ce1d591a9423e201b900815e3cfc9f43d0a4130d8bb10d411fb656600cbfb3ac1ded484b55bbed691abd928567211cedf752bfbdf

Download Submit
C:\Windows\SysWOW64\Mbibfm32.exe

Filesize
111KB

MD5
780e29b6b5d9b34625008662c93d5c91

SHA1
d9d4acd1629794cb201a68b85b7101e2b23b9919

SHA256
207809969c007522550d978e91b0a749cfcf235de832a4b03d3d3cf71be61ae5

SHA512
6ed0c1f74bc10efe99050c51ed2447f7cd372c0a7dd16b457fe592442649e24e823c1995663177d8c836c3ecdd63bc1c6f38a857dccc8548389fe3cbde904e29

Download Submit
C:\Windows\SysWOW64\Mqjbddpl.exe

Filesize
111KB

MD5
abdd48807e9e4bdddc962ee124056836

SHA1
22b0f1ddd34b992cc8d1eef2fe8c4601c5046a23

SHA256
631ce5b51fbe2d903c630bd4b77316e3591dba796a35e470ed1b06934d115157

SHA512
4126f45bb9741e12d67334301c20cf71fb13c9354431f6f797beea2163a58ab9513f62a7b07d7a1475bd8d01fadf056fbb17a778690f1b27a139478355194b6c

Download Submit
C:\Windows\SysWOW64\Nbbeml32.exe

Filesize
111KB

MD5
620c4ce5b2b4fe39ac9800693c3acd2b

SHA1
f87ce4ef5b3eca7f2a94bcc9235a0762b0eb9460

SHA256
515efbcd1de9684a8a271951511367c6189296a669bc083ad111a8c04359f9db

SHA512
7c227186fa7328c150f60f46d56a27699d13c3279e0491a8e3cb8493be21e5748ed9c3df8f6770ae24f9571bbaea9b655f33c5cf284dc702e3ec7e999cc98224

Download Submit
C:\Windows\SysWOW64\Nbnlaldg.exe

Filesize
111KB

MD5
bdd0ce15ca3e94d136c596bbcefe7ff0

SHA1
2fe33c0cde9c6ed9925ae27f789769ce2e66dc23

SHA256
67f55963e3c56171356b818c676b7ad9430106bcfaa177793f7334e93b776446

SHA512
25e82bb2b120b1f698455d71cc50678b1e5fbd9902ba5281b9c753746f38dee5c1af32673a08b8bc8abf2fee027896e1c0e09bca74628f59feb70d8f2aa9c94b

Download Submit
C:\Windows\SysWOW64\Nciopppp.exe

Filesize
111KB

MD5
2adac709d3f32aa83104c54b953291c2

SHA1
06d9386e75d9aca8f7b201975b36baa8d7fb4682

SHA256
8d0efe99fc8ea51f384b1445551ca5cc443d41339841ca396dd0c15c6730dcd7

SHA512
b87fb16b31a8f9338c010b0424f635479eac1d6c8ad549eee7c9ce964d9002170d884e8ff35e6b0c9925b3577972eab570e94bf809808940ea07234f10cc6f8e

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
111KB

MD5
2898ef5ccddfb37c6b5c9ba2f241446a

SHA1
67084c161ffb2be68da657eb900d5a6491926207

SHA256
99f0d87d3a40e80a616bbcb357bf938d324d836ecd92b0edc33d217c184f7eac

SHA512
12559f3d9d6d18a6487c4649132a88e26ddf3d79d691f6a1c0bb91a12b16190adc9ad550585fd2908898c051a97e1889e2186fcda0e0831da765e7995060162e

Download Submit
C:\Windows\SysWOW64\Njedbjej.exe

Filesize
111KB

MD5
b94e69877914b3e406d23625f7596507

SHA1
96b0d796297acc7833599c265d1a092578a117d4

SHA256
f6e7753e99d96c3b9e0d1784caef09fa5392a5a4d21f43d1e3706c04cd31af54

SHA512
d89c1f2c0a602622fd2d0254223a55f5d9027797d0abb0efb351611e094312c7aab42913dfa185c045f7454cdb0379edaf6a854e822f1e761cafc0595f4c4828

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
111KB

MD5
8119d0aed0068f29f7dee98bcd91637c

SHA1
428975cbe60a2bf858339f253def740eedebbf57

SHA256
5b63cc234795078f3c47c7cc0898ad3e53bbf5c8e4491863f1bb5d1dc972c4d2

SHA512
89d716dda470d89850c3a83cdaef5f48ebee5288e53c1fddfe3deec39004658368c75694e6ed029992d9bc95a22e2b4acc6dc8e0ef6c4121752785adb76ced29

Download Submit
C:\Windows\SysWOW64\Nmcpoedn.exe

Filesize
111KB

MD5
749169c1c61217ade8b54eb6ec188adf

SHA1
59a8255450de2de97f7d9fdb3c0ed90e1a1e3c53

SHA256
936270525cfb486f43325bd163ca308f8efffee6b533a311e534ac8f3d46f81e

SHA512
d2b4660aac21d344e8c1111c6f5a9cfd83002e704985648aa1afd92fe5a66a01e44e630358fe948add419e8b13dcf0ce6c35dc4045fa53a9bbeeed191575bd88

Download Submit
C:\Windows\SysWOW64\Nodiqp32.exe

Filesize
111KB

MD5
6368c173baca11ad56152f3877b49dc1

SHA1
1f6ad4a2a78868ba5af34aac8564eeb22a9ffcae

SHA256
2d4393eeb57e34a7b4cf54a5f19003696b2bc3874922797b81f061adc0d2342b

SHA512
4cf1ddb9a36171b07fa2254c695f48bccce5d0fb7855165aaa03e7e9370654446e8cb9493ebe1b6f44b5933c539e015bbbdd4dde342fcf7978dfdf34ea11571a

Download Submit
C:\Windows\SysWOW64\Nqmojd32.exe

Filesize
111KB

MD5
a9a1e323d548d1d8303f6fce3f4da770

SHA1
fad7cb450c86d5eeddba3d0f4292dcd75b62f5f3

SHA256
10c4f74f6b0b86aabb61c5c430b32fa9e8d0ef2d58aae82b1f29b1003581ec7d

SHA512
13cddcc66d7e32d6a987a7c8882cd428c68150ba73b47b95e3453d38093c7a23ab2ced489f336ccc18f3d8ad95d8c9b791519dff943fe9ef3de9cb498181e8b7

Download Submit
C:\Windows\SysWOW64\Obnehj32.exe

Filesize
111KB

MD5
c0dbd95faaed555635b69223df48de17

SHA1
97fbeae00cb6387a55eda158ffbbfffa64a113f8

SHA256
921767f8c9fdd94dbfb2bcfebb1f4b5d75de7625f1226fd6b7bc8e2ff91a9820

SHA512
b25127405648f8d89fb6b4f8f714635c65e3df275b0da27cd49712c36a924363639ddb13b9a9bb20f6210efacb575480e06556a111079c4b045397bc2af30e5f

Download Submit
C:\Windows\SysWOW64\Ocnabm32.exe

Filesize
111KB

MD5
cb3e3cd48a4e5a2efa572bbcff8b620d

SHA1
48be5629db0b9f2af2ba4ba4efe6406017371407

SHA256
50486f6319654c79cd8484e17002f43e9f52a8a760bb205b7f29571753b30645

SHA512
5425f4fe9dd11b3d6af6706398254d051596d90d3b4032f740cb19a284ef47d1651a3bec135a29567a3fb818fa5b07f8b651039f11a106fd2a04c1b7b59029bc

Download Submit
C:\Windows\SysWOW64\Ofgdcipq.exe

Filesize
111KB

MD5
8c16a335f50d4ab897c995b0bcfe8460

SHA1
3eec42ee878a922b3bb41ffdc952157a79497100

SHA256
d8e47d7da57dcdd47d45c553ae4c188662427218907fb07ec80272cdc0511e05

SHA512
da5da45f372f12a7ea398cb5020ad356e599fd45ff30474653a9e09179b1152d97e1f81730e61e552613acb07f2a8daf7ee6d7aaaea2516efe564703137e18ad

Download Submit
C:\Windows\SysWOW64\Oihmedma.exe

Filesize
111KB

MD5
a245cba9411c523d263f707a12eec507

SHA1
ee9c768de82f7978224ff3106f7cb2e3e0008a6b

SHA256
2f09d5162fd8c52c6359b38b0600d4eb5b00a85f3743446aba4510efc4424f6e

SHA512
25034cb86f5fda671e3a06d0be6b67d3f744a833f2c9a6686a10a020660bc0665848d4c5a2693d939ce6478837f822ab82572b19ebf173ee2736ef0bee0608db

Download Submit
C:\Windows\SysWOW64\Ojhiogdd.exe

Filesize
111KB

MD5
a2b74d4a03ee2affa8784f8a3cd4975d

SHA1
9a865f49917d13acb91170cfa2cb910411487f41

SHA256
7260ad207aa739c084d80e9e8df1662afccabc778ba5a975f1d358bebb8f3eb4

SHA512
e68ed8207fcf3167eb065ce5c784e57b05add631da5dafe78acc26455c2cbbd46fe5660f7246b6952bbe9d4f3c2fbd6ff82807b03f57ab50f01d2c5e10229c5a

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
111KB

MD5
bd8d7d424382e81bed7a07cb06b7034a

SHA1
ee97c5d63185dc5d0206b41125ddd6209de160d2

SHA256
3f6acdf21b0768248a2ab0198ed17042ebbc748a455c52f68eb1693e1ad7e2fa

SHA512
d87560d525ade7646195bc93fa29c9a5d95e4332ef76c16e9630cc64fa96c771dd08e6513a76c39669ff0ddb8416b886fdc42c9fc99cd7a9de14c90d0f4f0f7e

Download Submit
C:\Windows\SysWOW64\Oqmhqapg.exe

Filesize
111KB

MD5
4321f5aa963df00899ec652350580bee

SHA1
48854cf3c2b649f4e195411e2f19be42aa807403

SHA256
ca7b33d341c59ad7fb92c6a525013657b66b9d578d3228e43d0802b03a1352da

SHA512
b6dd08bca32be13fe44a0c95ecc5c55251620c99e337d64165dc5e63bd420c8d46003818b83e25cd53b8e7b5790e69c46800a3284f83ac17a3b6fa32922554bc

Download Submit
C:\Windows\SysWOW64\Pbjddh32.exe

Filesize
111KB

MD5
13e72ce9f8a1b642950dae379db5bce8

SHA1
a27dc3090daa1a737fde80060fdc1cf2f0422e33

SHA256
2f8e02398eecbca776d278f0093a0709f1999c2ddcf0729b8e41f2e8d7b4e2c9

SHA512
299f155f5d2ac41caa2b78f63015c8ce7d39781d2d66a0f93171d1929c531ca805dea449033a1e2ce0e2206645ad94af08d82c81384db62880a112904b448fe9

Download Submit
C:\Windows\SysWOW64\Pblajhje.exe

Filesize
111KB

MD5
dd84b68a7c0e19458f6e29527bed60d9

SHA1
5cef87079b58d06a84e9e626f2c70d293b19dc30

SHA256
c45089cf60bf3418d37afdf5619f12c00662cb005383b698ed524ddfd56d77c1

SHA512
b3cc8834d4d1de1b5a5094ba24b04a583936d25a61c88ed9e3b91a65f5ed6727edad9bf386bbd7f502e7e98befc25ee92267e6795bde9773d9ff09f884799a00

Download Submit
C:\Windows\SysWOW64\Pcpnhl32.exe

Filesize
111KB

MD5
19b75639e5b461f8034723523598bd3d

SHA1
16e169c5136d6e14b283cb8dcf2c1ab11195fa0b

SHA256
ce8f062966d0401c8be09d3ba94ece1adba035ee61b4b6c487c9dad4bdb8562e

SHA512
c5df63291c027d806e985343a13d8adb2981972bbcee3783ec434e4aba83147579641e132a586faba59cd9244b0306b0919b7fa5ee22b24523f62e5b8d15e39d

Download Submit
C:\Windows\SysWOW64\Pfagighf.exe

Filesize
111KB

MD5
d6f3a7cecd9cf3d3c6671ba949852c71

SHA1
7240034dcefc2f3228764740541afe3ceb9cd7f8

SHA256
a3a260050b2fea47faef32d47c426fa87586fb83b3f7d0b1a1432849572960b4

SHA512
9c96eab06b142734145722d43adade062cef2b5d1d3191af1cfeb9b6887673fb74ff7547db8abf4dae5d2ee9dbaf437a28102d1fbdd56cf3f7497f23d63f39a8

Download Submit
C:\Windows\SysWOW64\Pfccogfc.exe

Filesize
111KB

MD5
91e241ae04b0fb7ec304946a499cfd5b

SHA1
9c981c9ec85e0d98a4c830fe0414669a8ab6d1a2

SHA256
af0d173c6127187d438b987f919d0f4ccf02c6fc2216f473d0d332adc2101035

SHA512
aa1cc57b3b270f618fd1f62baf91bf49d95397958dc8274f500d6a6f77d8f5c88b72580cfbba097248d2aaa684af6d427baa8e0db4f823928082effe88eeaa7b

Download Submit
C:\Windows\SysWOW64\Piapkbeg.exe

Filesize
111KB

MD5
723db608c07994c6279c03ae19b24763

SHA1
a65d41ee3903e9cd5e51c1271ded9b8afb779f4c

SHA256
ee37756a55308687b96bbcd0670c423d0eed49e54f13f8a9c680ccc3be585296

SHA512
27906e6287f7f28b23676bfcc499608d96520c5df36b3eaeaa12cad119ceabcc558e537015940ba614ee3d40f9e9b5d029fb420b15879de25689f518f27b6fa0

Download Submit
C:\Windows\SysWOW64\Pidlqb32.exe

Filesize
111KB

MD5
0ab41a194711b52f64c65cf3aad56309

SHA1
3552f13a952be54f4203930bd425c60651a1e24a

SHA256
1dc2c856357430d2a6a1db9a1272e34a8e7f9c75526664aef826c9c9a7cf0af8

SHA512
5c975b5f115179e760913f8bcc46a607b5492e11cfbac8e3b515e5b6f4c2eeb7c517d64bfad47980d76284a6f39697e597e65053be12a13aa5a7754aa4e6c962

Download Submit
C:\Windows\SysWOW64\Pififb32.exe

Filesize
111KB

MD5
7c7bc690b18d3e80cde8314a5bd640c1

SHA1
8399c97150768bbcb3c724a3de96e1881be0b3fc

SHA256
718b022d4b95f53fbaac38e84538c09b38eef1cf09bcf9227d65eeac7fb1ebb8

SHA512
f5a706bfc0b64c035e2b9848debd7337a5d49bfa9e6327fcdbc39fbd669c312e7303106cbef05a7c3632c60e52616fff68b7abd6d72665e05070af7733979d15

Download Submit
C:\Windows\SysWOW64\Pjjfdfbb.exe

Filesize
111KB

MD5
b7949eca6356c2537989a89e236f53bf

SHA1
90d1f8f0a9896b3c83f6feb4716cdb3eec3a66ca

SHA256
74a7073f2e8cbd607ab48f2e44011236d926e8e6e5ad45c672ddbffeff1f4064

SHA512
9b55407429780a7121998d01170b39b7d20376b513bc25d758d81332cee912a0e83f13cba4cafa84959f017d03c3f95a1d77c8eceb690379453c4b85de500ece

Download Submit
C:\Windows\SysWOW64\Pmkofa32.exe

Filesize
111KB

MD5
ea7b28f253782f9bf22abfeb9887f414

SHA1
4f602ad7b1b1fb4b75d684542ffae8b3b9b1f5b9

SHA256
98908bde5df450c777b8e71f5cf8c635d24317be61f5fe007ab670ae94126930

SHA512
9f301f77437c3883b8c0e2810b4dc180cefce4e849013b9b12c31f1d09796b82b8e69d34e12b07728cbbe4bd2c142fae4f184db1e3ea27aec30d4623802445d8

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
111KB

MD5
a90e0868c7e0a23894e5dd7a2ce1ca39

SHA1
7d57183c317ff7dfd1abb0d1db1b05f411d751d7

SHA256
058105ba3f365ed8d73e0e172ac2b407f8eeea63fa71a225a1f19d74bd619dad

SHA512
3e906d0c01061cdefd89ea59e236a595618b952a4fe2e75cd6b76cb41de669b81f5ca1e529c2a8daefc222c5822e8afaed228ad00db1fe9041bdca0fd1e05cca

Download Submit
memory/464-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/464-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/544-249-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/544-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1108-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1108-234-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1476-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1476-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1800-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1800-251-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1816-257-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1816-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2748-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2748-242-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2848-253-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2848-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2952-196-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-52-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3380-252-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3380-44-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3412-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3412-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3620-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3620-233-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3632-250-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3632-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3724-255-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3724-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3872-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3872-245-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3948-62-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3988-236-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3988-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-212-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4196-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4196-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4208-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4208-243-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4296-237-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4296-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4340-84-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4392-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4392-239-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-246-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4904-238-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4940-254-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4940-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4972-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4972-241-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5104-215-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5104-235-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads