5c1e607804d9c645ab0349a081f998ccaeacbdd9af05f05dba3dcee8623cc298

Analysis

max time kernel
104s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ae1b425bc7858ca412176fe753c4ca0N.exe
Size

128KB
MD5

7ae1b425bc7858ca412176fe753c4ca0
SHA1

d05a3891935acc151da85345a675004aa8dd9ae9
SHA256

5c1e607804d9c645ab0349a081f998ccaeacbdd9af05f05dba3dcee8623cc298
SHA512

e56224843efe877567cee573bf2617d3f7c4bfd1b6106223fba466764824ff8ac048f0b5db8a3f55a3a558da93329805489ff99f1a334d17c4e03c4eb713acfb
SSDEEP

3072:sGm+oAyfsue50x7cEGrhkngpDvchkqbAIQxgFM9MD:sGmAF50x4brq2Ah1FM6D

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7ae1b425bc7858ca412176fe753c4ca0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	7ae1b425bc7858ca412176fe753c4ca0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe

Executes dropped EXE 57 IoCs

pid	Process
1244	Ajhddjfn.exe
2868	Amgapeea.exe
1272	Aeniabfd.exe
1480	Aglemn32.exe
2948	Anfmjhmd.exe
3740	Aepefb32.exe
4816	Accfbokl.exe
1072	Bfabnjjp.exe
4068	Bmkjkd32.exe
3916	Bebblb32.exe
2700	Bganhm32.exe
3520	Bnkgeg32.exe
2604	Bmngqdpj.exe
2476	Bchomn32.exe
2316	Bffkij32.exe
3384	Bnmcjg32.exe
224	Beglgani.exe
4468	Bjddphlq.exe
64	Banllbdn.exe
1360	Bfkedibe.exe
4020	Bnbmefbg.exe
3604	Belebq32.exe
1744	Bcoenmao.exe
3688	Cjinkg32.exe
3668	Cabfga32.exe
208	Cdabcm32.exe
4380	Cjkjpgfi.exe
1248	Cmiflbel.exe
2172	Cdcoim32.exe
4152	Cfbkeh32.exe
3620	Cmlcbbcj.exe
3452	Ceckcp32.exe
1684	Cfdhkhjj.exe
4716	Cnkplejl.exe
3120	Ceehho32.exe
1532	Cjbpaf32.exe
2636	Cnnlaehj.exe
3560	Calhnpgn.exe
2468	Cegdnopg.exe
1920	Dhfajjoj.exe
3780	Djdmffnn.exe
4652	Danecp32.exe
4024	Ddmaok32.exe
1352	Dhhnpjmh.exe
3232	Dfknkg32.exe
4008	Dobfld32.exe
4956	Daqbip32.exe
3580	Ddonekbl.exe
232	Dkifae32.exe
1524	Dodbbdbb.exe
3040	Deokon32.exe
1084	Dhmgki32.exe
2364	Dkkcge32.exe
2516	Daekdooc.exe
1056	Deagdn32.exe
548	Dgbdlf32.exe
2708	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mgcail32.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	7ae1b425bc7858ca412176fe753c4ca0N.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Bcoenmao.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	7ae1b425bc7858ca412176fe753c4ca0N.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Aglemn32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bjddphlq.exe
File opened for modification	C:\Windows\SysWOW64\Aeniabfd.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Hhqeiena.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bnbmefbg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
864	2708	WerFault.exe	143

System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ae1b425bc7858ca412176fe753c4ca0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljbncc32.dll"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Calhnpgn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1244	1328	7ae1b425bc7858ca412176fe753c4ca0N.exe	84
PID 1328 wrote to memory of 1244	1328	7ae1b425bc7858ca412176fe753c4ca0N.exe	84
PID 1328 wrote to memory of 1244	1328	7ae1b425bc7858ca412176fe753c4ca0N.exe	84
PID 1244 wrote to memory of 2868	1244	Ajhddjfn.exe	85
PID 1244 wrote to memory of 2868	1244	Ajhddjfn.exe	85
PID 1244 wrote to memory of 2868	1244	Ajhddjfn.exe	85
PID 2868 wrote to memory of 1272	2868	Amgapeea.exe	86
PID 2868 wrote to memory of 1272	2868	Amgapeea.exe	86
PID 2868 wrote to memory of 1272	2868	Amgapeea.exe	86
PID 1272 wrote to memory of 1480	1272	Aeniabfd.exe	87
PID 1272 wrote to memory of 1480	1272	Aeniabfd.exe	87
PID 1272 wrote to memory of 1480	1272	Aeniabfd.exe	87
PID 1480 wrote to memory of 2948	1480	Aglemn32.exe	88
PID 1480 wrote to memory of 2948	1480	Aglemn32.exe	88
PID 1480 wrote to memory of 2948	1480	Aglemn32.exe	88
PID 2948 wrote to memory of 3740	2948	Anfmjhmd.exe	89
PID 2948 wrote to memory of 3740	2948	Anfmjhmd.exe	89
PID 2948 wrote to memory of 3740	2948	Anfmjhmd.exe	89
PID 3740 wrote to memory of 4816	3740	Aepefb32.exe	90
PID 3740 wrote to memory of 4816	3740	Aepefb32.exe	90
PID 3740 wrote to memory of 4816	3740	Aepefb32.exe	90
PID 4816 wrote to memory of 1072	4816	Accfbokl.exe	91
PID 4816 wrote to memory of 1072	4816	Accfbokl.exe	91
PID 4816 wrote to memory of 1072	4816	Accfbokl.exe	91
PID 1072 wrote to memory of 4068	1072	Bfabnjjp.exe	92
PID 1072 wrote to memory of 4068	1072	Bfabnjjp.exe	92
PID 1072 wrote to memory of 4068	1072	Bfabnjjp.exe	92
PID 4068 wrote to memory of 3916	4068	Bmkjkd32.exe	93
PID 4068 wrote to memory of 3916	4068	Bmkjkd32.exe	93
PID 4068 wrote to memory of 3916	4068	Bmkjkd32.exe	93
PID 3916 wrote to memory of 2700	3916	Bebblb32.exe	94
PID 3916 wrote to memory of 2700	3916	Bebblb32.exe	94
PID 3916 wrote to memory of 2700	3916	Bebblb32.exe	94
PID 2700 wrote to memory of 3520	2700	Bganhm32.exe	95
PID 2700 wrote to memory of 3520	2700	Bganhm32.exe	95
PID 2700 wrote to memory of 3520	2700	Bganhm32.exe	95
PID 3520 wrote to memory of 2604	3520	Bnkgeg32.exe	96
PID 3520 wrote to memory of 2604	3520	Bnkgeg32.exe	96
PID 3520 wrote to memory of 2604	3520	Bnkgeg32.exe	96
PID 2604 wrote to memory of 2476	2604	Bmngqdpj.exe	98
PID 2604 wrote to memory of 2476	2604	Bmngqdpj.exe	98
PID 2604 wrote to memory of 2476	2604	Bmngqdpj.exe	98
PID 2476 wrote to memory of 2316	2476	Bchomn32.exe	99
PID 2476 wrote to memory of 2316	2476	Bchomn32.exe	99
PID 2476 wrote to memory of 2316	2476	Bchomn32.exe	99
PID 2316 wrote to memory of 3384	2316	Bffkij32.exe	100
PID 2316 wrote to memory of 3384	2316	Bffkij32.exe	100
PID 2316 wrote to memory of 3384	2316	Bffkij32.exe	100
PID 3384 wrote to memory of 224	3384	Bnmcjg32.exe	101
PID 3384 wrote to memory of 224	3384	Bnmcjg32.exe	101
PID 3384 wrote to memory of 224	3384	Bnmcjg32.exe	101
PID 224 wrote to memory of 4468	224	Beglgani.exe	103
PID 224 wrote to memory of 4468	224	Beglgani.exe	103
PID 224 wrote to memory of 4468	224	Beglgani.exe	103
PID 4468 wrote to memory of 64	4468	Bjddphlq.exe	104
PID 4468 wrote to memory of 64	4468	Bjddphlq.exe	104
PID 4468 wrote to memory of 64	4468	Bjddphlq.exe	104
PID 64 wrote to memory of 1360	64	Banllbdn.exe	105
PID 64 wrote to memory of 1360	64	Banllbdn.exe	105
PID 64 wrote to memory of 1360	64	Banllbdn.exe	105
PID 1360 wrote to memory of 4020	1360	Bfkedibe.exe	107
PID 1360 wrote to memory of 4020	1360	Bfkedibe.exe	107
PID 1360 wrote to memory of 4020	1360	Bfkedibe.exe	107
PID 4020 wrote to memory of 3604	4020	Bnbmefbg.exe	108

C:\Users\Admin\AppData\Local\Temp\7ae1b425bc7858ca412176fe753c4ca0N.exe
"C:\Users\Admin\AppData\Local\Temp\7ae1b425bc7858ca412176fe753c4ca0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\Ajhddjfn.exe
  C:\Windows\system32\Ajhddjfn.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\Amgapeea.exe
    C:\Windows\system32\Amgapeea.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\Aeniabfd.exe
      C:\Windows\system32\Aeniabfd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3604
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3688
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:208
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4152
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3120
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4652
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4024
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3580
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1084
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:548
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 408
        59⤵
        Program crash
        
        PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2708 -ip 2708
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
128KB

MD5
a902fb38857a4493fdfc4452c8900fc8

SHA1
560497c06abf059481bce267398ece58d08b59a1

SHA256
77302868000d8e8b4737edee5912505b9edae683727d6cf1521db64d5cafec71

SHA512
6d48f6a82a840d3c0a43e82e2bfe0249182aab5388f1279ef7e1a75e5e953593d60dda8960a13e2b62ef3474b3e13fc1dab79b099a7e4804e80ec803eceea455

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
128KB

MD5
08bd30f7a35b12c04a0ac400fd9d14ce

SHA1
c7eed81f52714801fffd09507734bd3434dd7b28

SHA256
9ec2676dca4955fc52025d34c349fa9d00ec7d2b5fa1215354b71c1877edff88

SHA512
6bfbe149ec986b29cd0af8504e4a56b18ba37eec4cc2db4cee04f114ff1393dbd3439c02c2866a31050bfd8d9afb3f337679eb9a41ee0eb0cae8d1f96b0f7387

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
128KB

MD5
af899f85b12c6ff53be8a8da5fbfad2e

SHA1
661f4d8a5731e4ec75605ac0533f641c57d45710

SHA256
bc807a4c9fe686892eb289840b384313f6fa296d7c5d028fa94218be45e16359

SHA512
d0d5abf8b8d78e701ea49dc8fff458e00537eda0bed0fa8c999819f5e2e2ff0f13bc01122560ee321bd5c85663511711a3abca080de0c2ebf358b4e01f96172e

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
128KB

MD5
6acda3ade0441dd1f3c4eb932aa9a7fc

SHA1
345e933bfc96ae446b7e3393ada909ccaa79f5c3

SHA256
62ae82888fe57d7734b3933741a80ceaa37f7e487d36b5880cbe4c1b00832e5b

SHA512
34ca8a1bc3b3c72c175624846feffdbbba97d5e7fa56541774029e19b7be2eedaf9b823864f8666921092c4700294095df6fad19c6700aad5c5096aec77b5d62

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
128KB

MD5
732b83478e369b8a846c10fbd3d29335

SHA1
fc4e87f3e9dd10badfb4ddb681038fe9e342514e

SHA256
e4f30b8876065ab39e48ffe829a4016760dd3bb9bc44fdecfba302fe97e22f76

SHA512
32e1550172b19a90a87c2813c7453cb8baf8256f72167b93e6db3458547b0de0dd97f7193d1b53c9e5dd78edd8b9078093984d474a7f8d6248f85b8c0a6c2987

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
128KB

MD5
9dbb3383153d6d797403cc6b5d690c98

SHA1
eb9b54dfb0cc0d6e84796127e2b3c1d7f1792b22

SHA256
74bd61838379d0ff0ec394e56c9e567541818153c1e92c2465bbe8858c460d50

SHA512
3056964aafbbf36f0d00200718aed46e7fc7d2a3cb798ed3016cae9311284b96e471a1cd423cc6ff6df138ebbd1c0d8bd56b33b708f224620cbb449cc74f587e

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
128KB

MD5
46ea27b78cad71714fa46c7aef227d2f

SHA1
27c195148ea73c94ebbdcb27b85889806a500cf3

SHA256
d99ab02b7bc9e08942865639fc2e270c82a8e22e4e12061d8a5759a589a8f0af

SHA512
849beb089ebf096ed2de592e492628e6d004d506d30fd253da312f1838b107cc0469d0bffaed66abe458655221c06bad9ea3140b4bc61305c66be31974a81d8b

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
128KB

MD5
53df8fca707359ed556d0dac8a7e233b

SHA1
4b9f7c0935d6278a8a44af6290205c77e51a42d2

SHA256
03d667a094b70d817843dcec23184040223f0b70763f412b83bc3289b898561e

SHA512
e1a83ceb62035799a0f2036778988a95bb8dd5ff6f86161e3883c3665cef557be7e9fae2d71484428cd071352cca0e2aaab116624211cec16b929a90b1847dd9

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
128KB

MD5
bb93701d78086808b2229937607ffcf6

SHA1
40b365420457e9b40081efeecad1f966f02e12da

SHA256
57c4dffefcc7555217f8c045bf162fc7bde2f252dacb5025de4f8bbda41fa7e7

SHA512
cb560fea7ea4af3fc123e0e514ffe5841dc603d66da15581a41f94896785227e90985f8d6c11a47d1109dc780b2e7442b4b68c30c4b8d7c9e5ddf8769f8f0049

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
128KB

MD5
ca13d2cba3e97e091d39137cab58fd19

SHA1
d7d37de1eb54f8e6572486f98c6dc0415d7ba683

SHA256
8aeb12358cd6d97a985469043c2000be261860293b6a64efee97d23293d2a7b8

SHA512
bd98bcf6903ad244bc9ad10810458711e85f0e349c43e53fdbec6d296d133dcc84fbec80fce8282f0c52ddc22bc1eb415dcb681ec19ac15ba555dd6913edb3d8

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
128KB

MD5
5da5d9eff30f65c29706187428e6d5d3

SHA1
2e559ac91b7a18203a10da1193677661067de83d

SHA256
268823bb74b25cc8fa2fcaf9e57282660bbe2fb8d84661c2922d12a4aabb05b1

SHA512
ba9c0b1676b9c5936865f1e0f89aec9c9e1de7840d48f859c6f0560626c8bb23d474e60016bd2f990753023b4aec100e7b1971265f0dc35159b6cf6f3710a26c

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
128KB

MD5
12a4cf83ce820625d2e799731deaea0e

SHA1
500d78be585ac2982b82291e94b7e45e3c478d01

SHA256
cc436cbf4794359ad94b6e2f90c6f62541eddd5f16f341f7bd2b2546fe11fc2d

SHA512
c1b6500c191cd6c1cf654ba287d38860a0833cfefd533d5dc56f14e07185f91f92600755003fca2ef27e681f627f13e85f63f5f3b01ade658587c244c9230145

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
128KB

MD5
25b946c39d268b71699ed900c2fa78e1

SHA1
476660d8271aa99f4b79349190757e66d1948b39

SHA256
dcf4ae052f14294f20995bc8fafe5e391e6bbfc5485aa2e31d1a511d0f1b2509

SHA512
8648ba5b51214d068c67867a5de10f7ea4798feb685bc0cb2d0e82fda889e036b3c97f353fcb3ed18cfa9e17f9d209dc1ddc87f38176c72f72592f041888c70d

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
128KB

MD5
969259d4155d0d08e2032f8d88562fd1

SHA1
26f064eafd53ac8df3ffda8b3b6d75a765926795

SHA256
75f9067aaac6d785d0f295914b5691890b888c3fbe85df9020e502ffdaae1ccd

SHA512
5d0f5bdec4fce32e9f2900045b194eafecf3137cd63d2c5416c79c97b6cd674bff8699e23dd93f574249bbaf6f21753d6b3270adb56536dde298becb94515b8c

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
128KB

MD5
c5a20e2848b5017197220ef4b21341ff

SHA1
5cd5849ebf328645c26710e6ffe8a51517c28242

SHA256
358e424b22cc8ffda47415b0fd2906daab5ec33a77ccdb92ae3c1ce1aaa2a474

SHA512
93539babc4a6eca0cf7c625741db1517750391c0c8d6ca211b46b46ab6bcd353d0ab9c93f3369a6745ce5fa6e6c8df3570d71d55ed92a7e57148fc4c6dac8423

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
128KB

MD5
e1192daf5515307254afbfa7a581319b

SHA1
3c164a474dc76738b6e5dea8ac387f7aee565117

SHA256
80ee26831c9ade0c75cc00de0f005a221992528544f2dad2d1ebc06d5b7f7d3e

SHA512
aab4dd577359cfea08171e9a6efc1bb59dce0c5fddc858626558f7def4ea4a1248dc02737ec1e9e3e1ef7e31f2c89e9f22e49d8d2ed13262c8c5de39fda24dbd

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
128KB

MD5
500cadce3acbcb9fc771d16702f3793f

SHA1
4756f2850f8b5f6315672d243f4a609aaa5247f3

SHA256
6ac0af6d38b1c297e7e2234bbc40b4dc77369cb2127c7801fa2bc4d5650cabfd

SHA512
53fab3671541c646a6a019f48bba2f92b94a93f8f9c06ac54b49610be035b15cb2a2229255193bf565250eab0012d843bbd7c56c1fb047c611518f102c5203a6

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
128KB

MD5
5d69dfeaa5d0bdc5f37ee99b125ed0e8

SHA1
07e4a048dbad3048d2cd81b8097a660d851d3335

SHA256
ce68213066c0db6620921dd499922a1c736c6c699cedf51063e01ad200acfb02

SHA512
c092e0b9ed9bf92b8bd69ad61d63d5f3edf0c4931e39661cd42653209c7f9fa58c78bcecb55718ca2496ee06c4db7f9ca4d929a18c63d4c10be52c1cf55c5200

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
128KB

MD5
33ea34de2db040768503038d1fcf5b71

SHA1
1521c0ff25c288193265e436860b90676b4f1bd1

SHA256
1f478f7327ebc289304db06ce33865031273a2130d5988e09fded9975cf91a8a

SHA512
92c713ccd797e6904b60e1574b4a3a3d5e5c79c0ccb026ac074bfb881d108b880b464f59e57ca7eb1a25b9c3dbed7858092392a95c0531f04885a61708f039e0

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
128KB

MD5
733cb18fcd1d37b5bcb984fd7ded4a83

SHA1
c9da32b2ddb7b9802f1e5b54777768f8f02f3da4

SHA256
e16e7556fd9289858fc81c4b5c67180f855e69966785491ed5ca2a1415392329

SHA512
33542d28f354154cfb78d389d3763ee972c422074c9aff9fde18e5a16fe73882e92543e492d102bf71f12f20f8a82ab7a28097dd5a781412a3e8643c9267b07f

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
128KB

MD5
74a5584e0c316eb0afde1d15620f5d23

SHA1
dba7bfb76bfead52dc2ed3b60a5694dc4e9bc31e

SHA256
7dba55a3e25398f18f37d01a88d8d88677521308a9de7b0b56970ae8a744e131

SHA512
9adde769d2ec65f45503848f1c31d62a67a8f0dabd9eb4ad8273c245788474911060e98ae8fbab1c9b3f9aad2754602ab5174861da66c74be14fc9ae398351e0

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
128KB

MD5
a93ae4c34e149ca8ce685410850640bf

SHA1
2b0909e88cdaa042530d641eeba16b3426b81b7d

SHA256
c45a43e773033d0fa6aab3c06e76e563c1271db48a49e304a7e1a6a161fe49fd

SHA512
49da46ef585f5b5cf01c6f4cf4c0e04359906aab76f69ced98cd1810c81be038bc6ecfe8e61a7ba377425e80bd073b8b1d061fcf33bf6767a359a7c769d2b428

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
128KB

MD5
72d5920c9e7a2ad4ad9d5fc503b802b0

SHA1
0e5bb8e43d9ac6cab753275f17c950916051a8ac

SHA256
504870f320dfc9877f7d58faaca87e192b991ed19963305c3b1284ecd56a62c0

SHA512
9b838d288299c3c9c6530677e05dd6092468faa4924adb3a1b7c0067ef85e62aaf83d0a5d2a7ccfe987dfca018d73d04669b47ccb38135d734d8b019e72693ad

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
128KB

MD5
0f2eb5f17dd580b7ffe6ccb25d45d07f

SHA1
5990fd0584600e54030581211f3c7285b597d159

SHA256
53bee3d98100fc1bfd47bf7ccc95a87c245d58e89ab7d5d26f3d9f69eb41fc3d

SHA512
780f9f43b4955be16cedddf8a5a82b6b3c15750c5e753ba29263c8b453d7b1394673fae3d79e24df02915078be2414216591e112113fac881a93a202ca68cb58

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
128KB

MD5
d6d6891aabb8782f1af0e384a799c9f2

SHA1
ae9c23900080c7f3d0f419fe99cebe99263dd158

SHA256
685987500a5d1352d094074fa4e09fd72a04522f0b2b0f7b6fec6f93b075d58c

SHA512
1f04471b8629d8c4b50114bc62681e2cf958f09d9ec75dde0835c84d9d7cc4b8ddf4e290136b401a41623ae613f55b13316a29a982ef33dc0e5416d7e77e4dca

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
128KB

MD5
f00400fcd555acf3934ae07e15b4b31d

SHA1
1555372e3aabcce9f8d5453ca91e78e75d8819b1

SHA256
bee5c51359becc113923c4241593255156b1c67f1c05a6194f70d7fdd18854be

SHA512
443c45ab6c75651067a1a7fcb8345f031be90ada8fa2030d7ce1fb21e594a52184f9a86202782d6955c5b5975d561620a675d12e5cbd29bd9825a971b736a968

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
128KB

MD5
5e31e5d276718d4b3f93dbd77ac1a0f2

SHA1
6cc8a0af0f39e1dfb308de1696425a8705b679e4

SHA256
dda84f4d8dbef0376476cc8929cb382150d21fcc4d59a473933e3e5731e15c44

SHA512
8a710d2c3ef330c5138576748ad7c8256df19ca43be165fcef368a48b4c655cebc612427bfe59c339b7ccf20c7503832bd28b5cfc4857ac42aecd34e90b821c5

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
128KB

MD5
2dcea28537a413dbe8cae5ee3ab61bd2

SHA1
e7f8ad4bc14b536ae86916c17b7604e6cd1f0eb1

SHA256
0b6f1d70bace4f4a65e71e4233ebe88c01fbcc2bd7493cff645b7183abaa1859

SHA512
0aca6a111e105214a8ec270100b2f0b81d9827d8244eafb56d8b86b32619da93889063a5482dce2ec14c4824ac529f59ef5268717db6ab5be62723371701aca5

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
128KB

MD5
a8141d21b10eb130ef7f456cad743768

SHA1
749234aa749ac5c37763b6e679f95543b8ec69ac

SHA256
44c7c032b4ff379c14f23ca94006826d3df0442b78162876572482dc2b671271

SHA512
483210b229a2ddce06b42c31f8854248c75b6a66f919757dfbf3c16f72e59cf35378ad3bc17d0938268c6054f2e98b2cf578f8c801518edc5cdc3275e032ac31

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
128KB

MD5
73286371a3d663ff3f9969eea85a15b7

SHA1
c9608a81c696b335f0f0915301c1b58fbea05b0a

SHA256
c41d114dcb1c8d9c252b98fbbbc6c4f68ef67442b8e339a693773100069b65be

SHA512
4050a1150944a7cfe2e29b3ab96df4b3bd8a3b6d54bfec37befe0f58d4c30e69d8007c45b5fe5c6ff9f8be3df13e397eb4736b9b00eb5d2ffba2fa687fe83d04

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
128KB

MD5
49ddab9a495eeffd5b1d059ed333d4b0

SHA1
b76b0e22077a5e03ade178e896825551d156b50f

SHA256
c03c7ce152e326f2a8fb6ba522c4b22f009571c33522ee8e1470354c742bb726

SHA512
485b742a6bcd6ae2ed393ffa0478da4c087fba1874c444ed904b00a8a0ca9c887cf92fa68af254e2b581a91e7264827a38e853cdcbe7e02d8b6774f6dbff1063

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
128KB

MD5
b624b8a6ef522eb0093dc1a4b712ed62

SHA1
69d418c02de6acb34797f0a3e9d5235629f39fa5

SHA256
12a3f4aa20985cf0145900374b0730f3a41f8ca9c419d6aa43ce5df551bbe591

SHA512
ad5976ef0167524d3811e62f6b1c161efc93b48e43f471ae18e00c1620e6f4a694ebf90a1c62ff468bfe2d439d42a736b363c55c3cda26c17807ad55a5324ab4

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
128KB

MD5
6f98e54cb2b7daac4a1ec0413c8e74c2

SHA1
c346adff9631e18ccef6efe0452d2e69091f83f6

SHA256
0b2cb51d22dc41dbea1becbc3742c8264c569361e14c564623e3743a05398359

SHA512
a9976c268a700f4ae8e845c3d2405e09e7c4aa4613c99101e41581f27b6992bb9c9932bfb0d458081d993cbe318eae0d20f0c33ac32ca231d834aa0698c0df3b

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
128KB

MD5
d4e411dad53ac662913c968aece8eb37

SHA1
6e7d90e47c405f7591cdb16be932b7bcad5f917f

SHA256
9679671925672dd4eae69f0ca4a0f342b1ae9f8fa13298e15dfb2d22a89024de

SHA512
6e5b15149eb8eefa1543c73a1a1f0e8925c1ea4fb57d58edf306597153f63c9aeac879c6e60b85fcf03082782ef6288df42e27152e61b574b80d616521368834

Download Submit
C:\Windows\SysWOW64\Ljbncc32.dll

Filesize
7KB

MD5
7ed2d4f5ed754580b6c5295fc8abd4f1

SHA1
19a03763f8c530cb3c1fc90b75c2646782299ed0

SHA256
93cef6c375a8ed4f7713d2269e51ed966c5c94c4719f1b49815c5603c6a3af2d

SHA512
0ce7391994667ca76c27340cac7acb3838b8aea034aeb41b5bd86f9f7c6a6da2ee30220b1f952c81f2b9780839544666132806c4486f62fa328fbf0f60e3239c

Download Submit
memory/64-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/64-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/208-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/208-207-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/232-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/232-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/548-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/548-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1056-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1056-409-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1072-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1084-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1084-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1244-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1248-434-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1248-223-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1272-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1352-332-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1360-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1360-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1480-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1524-419-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1524-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-426-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1684-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1684-429-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1744-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1744-439-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1920-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1920-423-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2172-433-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2172-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2316-119-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2364-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2364-411-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2468-302-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2476-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2516-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2516-410-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2604-104-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2700-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2708-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2708-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2868-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3040-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-427-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3232-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3232-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3384-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3452-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3452-255-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3560-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3560-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-415-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3604-440-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3604-175-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3620-247-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3620-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3668-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3668-199-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3688-438-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3688-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3740-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3780-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3780-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3916-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4008-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4008-417-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4020-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4020-441-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4024-325-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4024-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4068-71-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4152-432-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4152-239-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4380-215-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4380-435-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4468-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4468-444-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4652-421-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4652-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4716-428-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4716-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4816-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4956-416-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4956-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads