40cb2ff8f9d5249486869238ac2860864d42e7450dc591a543fa49918e5e80dc

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7c7d3b3e4de1094a0c1b363deea3210N.exe
Size

96KB
MD5

d7c7d3b3e4de1094a0c1b363deea3210
SHA1

8c9fcc0e2781d4d1f79cbd6b72785c79caac0bb5
SHA256

40cb2ff8f9d5249486869238ac2860864d42e7450dc591a543fa49918e5e80dc
SHA512

f4d349d49110a7dc294673798ea0fb3bbb523e0a7219faaf38b48040bd17354aa2835efe0015eb86c89425dcd3beb97b060586607f0109aa2a0d0064e27b4bbc
SSDEEP

1536:K42cJC9gsEs36ArI7fSTc8y+VlG8Boy6FHChVHCJCCCCrOTrBzzFFfUN1Avhw6Jr:K42jgur/TcGXzVHCJCCCCrOTrBzzFFfF

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilhkigcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Infhebbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdffjgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hqghqpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inkaqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjihfbno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhmafcnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabglnco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacijjgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgocgjgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbknebqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khfkfedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laffpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lolcnman.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hqghqpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hchqbkkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjaioe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnhkdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbeibo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hejjanpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnjkbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lolcnman.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igjbci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inkaqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inidkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijbbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lkiamp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icfmci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbknebqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibnjkbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbbkocid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kejloi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hnhkdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hchqbkkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldkeeig.exe

Executes dropped EXE 64 IoCs

pid	Process
1408	Gbbkocid.exe
1416	Hgocgjgk.exe
3688	Hnhkdd32.exe
4616	Hqghqpnl.exe
5076	Hjolie32.exe
3544	Hbfdjc32.exe
1864	Hchqbkkm.exe
736	Hjaioe32.exe
3208	Halaloif.exe
3808	Hgeihiac.exe
4252	Hbknebqi.exe
940	Hejjanpm.exe
540	Hghfnioq.exe
216	Ibnjkbog.exe
4408	Igjbci32.exe
3980	Iabglnco.exe
4100	Icachjbb.exe
4608	Ilhkigcd.exe
2136	Infhebbh.exe
4680	Iccpniqp.exe
2840	Inidkb32.exe
3232	Icfmci32.exe
2348	Inkaqb32.exe
4800	Ieeimlep.exe
4528	Ijbbfc32.exe
2060	Jnnnfalp.exe
3480	Jehfcl32.exe
2732	Jnpjlajn.exe
4068	Jejbhk32.exe
4648	Jldkeeig.exe
5004	Jbncbpqd.exe
820	Jhkljfok.exe
2008	Jjihfbno.exe
4912	Jacpcl32.exe
3188	Jdalog32.exe
2512	Jlidpe32.exe
4548	Jbbmmo32.exe
1600	Jddiegbm.exe
1804	Jlkafdco.exe
1920	Kbeibo32.exe
1072	Kdffjgpj.exe
4328	Kkpnga32.exe
1612	Kajfdk32.exe
2648	Khdoqefq.exe
2436	Kongmo32.exe
3304	Kalcik32.exe
3052	Khfkfedn.exe
4404	Kopcbo32.exe
4564	Kejloi32.exe
3720	Klddlckd.exe
3900	Kemhei32.exe
2032	Lkiamp32.exe
3984	Lacijjgi.exe
2916	Lhmafcnf.exe
704	Lklnconj.exe
472	Logicn32.exe
2720	Laffpi32.exe
1848	Lddble32.exe
2716	Lknjhokg.exe
4004	Lbebilli.exe
2232	Ldfoad32.exe
1632	Llngbabj.exe
5144	Lolcnman.exe
5184	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jooeqo32.dll	Iabglnco.exe
File opened for modification	C:\Windows\SysWOW64\Jehfcl32.exe	Jnnnfalp.exe
File created	C:\Windows\SysWOW64\Mhfdfbqe.dll	Khdoqefq.exe
File created	C:\Windows\SysWOW64\Pmbpeafn.dll	Kongmo32.exe
File opened for modification	C:\Windows\SysWOW64\Lbebilli.exe	Lknjhokg.exe
File opened for modification	C:\Windows\SysWOW64\Hbfdjc32.exe	Hjolie32.exe
File opened for modification	C:\Windows\SysWOW64\Hjaioe32.exe	Hchqbkkm.exe
File created	C:\Windows\SysWOW64\Jejbhk32.exe	Jnpjlajn.exe
File created	C:\Windows\SysWOW64\Ojglddfj.dll	Jejbhk32.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	Jjihfbno.exe
File opened for modification	C:\Windows\SysWOW64\Kajfdk32.exe	Kkpnga32.exe
File opened for modification	C:\Windows\SysWOW64\Khfkfedn.exe	Kalcik32.exe
File opened for modification	C:\Windows\SysWOW64\Lknjhokg.exe	Lddble32.exe
File created	C:\Windows\SysWOW64\Hbknebqi.exe	Hgeihiac.exe
File created	C:\Windows\SysWOW64\Bdelednc.dll	Hejjanpm.exe
File created	C:\Windows\SysWOW64\Kopcbo32.exe	Khfkfedn.exe
File created	C:\Windows\SysWOW64\Okahhpqj.dll	Lbebilli.exe
File created	C:\Windows\SysWOW64\Inkaqb32.exe	Icfmci32.exe
File opened for modification	C:\Windows\SysWOW64\Jddiegbm.exe	Jbbmmo32.exe
File created	C:\Windows\SysWOW64\Jddiegbm.exe	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Kejloi32.exe	Kopcbo32.exe
File opened for modification	C:\Windows\SysWOW64\Kemhei32.exe	Klddlckd.exe
File opened for modification	C:\Windows\SysWOW64\Lddble32.exe	Laffpi32.exe
File created	C:\Windows\SysWOW64\Ldfoad32.exe	Lbebilli.exe
File opened for modification	C:\Windows\SysWOW64\Jdalog32.exe	Jacpcl32.exe
File created	C:\Windows\SysWOW64\Jbbmmo32.exe	Jlidpe32.exe
File created	C:\Windows\SysWOW64\Kemhei32.exe	Klddlckd.exe
File created	C:\Windows\SysWOW64\Kjekja32.dll	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Ibnjkbog.exe	Hghfnioq.exe
File created	C:\Windows\SysWOW64\Bmapeg32.dll	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Jlkafdco.exe	Jddiegbm.exe
File opened for modification	C:\Windows\SysWOW64\Kbeibo32.exe	Jlkafdco.exe
File created	C:\Windows\SysWOW64\Mobpnd32.dll	Kalcik32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnconj.exe	Lhmafcnf.exe
File opened for modification	C:\Windows\SysWOW64\Logicn32.exe	Lklnconj.exe
File created	C:\Windows\SysWOW64\Cobnge32.dll	Hgeihiac.exe
File created	C:\Windows\SysWOW64\Jopaaj32.dll	Ibnjkbog.exe
File opened for modification	C:\Windows\SysWOW64\Kongmo32.exe	Khdoqefq.exe
File created	C:\Windows\SysWOW64\Mnfooh32.dll	Lknjhokg.exe
File created	C:\Windows\SysWOW64\Hjolie32.exe	Hqghqpnl.exe
File created	C:\Windows\SysWOW64\Gcqpalio.dll	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Dcmnee32.dll	Jddiegbm.exe
File opened for modification	C:\Windows\SysWOW64\Kalcik32.exe	Kongmo32.exe
File opened for modification	C:\Windows\SysWOW64\Jnpjlajn.exe	Jehfcl32.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jddiegbm.exe
File created	C:\Windows\SysWOW64\Gpejnp32.dll	Jlidpe32.exe
File opened for modification	C:\Windows\SysWOW64\Khdoqefq.exe	Kajfdk32.exe
File created	C:\Windows\SysWOW64\Kalcik32.exe	Kongmo32.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Klddlckd.exe
File created	C:\Windows\SysWOW64\Fcnhog32.dll	Kemhei32.exe
File opened for modification	C:\Windows\SysWOW64\Ijbbfc32.exe	Ieeimlep.exe
File opened for modification	C:\Windows\SysWOW64\Jacpcl32.exe	Jjihfbno.exe
File opened for modification	C:\Windows\SysWOW64\Ilhkigcd.exe	Icachjbb.exe
File opened for modification	C:\Windows\SysWOW64\Infhebbh.exe	Ilhkigcd.exe
File opened for modification	C:\Windows\SysWOW64\Jldkeeig.exe	Jejbhk32.exe
File created	C:\Windows\SysWOW64\Qekjhmdj.dll	Kopcbo32.exe
File created	C:\Windows\SysWOW64\Hbfdjc32.exe	Hjolie32.exe
File opened for modification	C:\Windows\SysWOW64\Halaloif.exe	Hjaioe32.exe
File created	C:\Windows\SysWOW64\Jhkljfok.exe	Jbncbpqd.exe
File created	C:\Windows\SysWOW64\Ofnfbijk.dll	Kejloi32.exe
File created	C:\Windows\SysWOW64\Jmjdlb32.dll	Lkiamp32.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Laffpi32.exe
File opened for modification	C:\Windows\SysWOW64\Hbknebqi.exe	Hgeihiac.exe
File opened for modification	C:\Windows\SysWOW64\Hghfnioq.exe	Hejjanpm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5292	5184	WerFault.exe	159

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnhkdd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgeihiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieeimlep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnnnfalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jejbhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbncbpqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jddiegbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbeibo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kalcik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjaioe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hejjanpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdalog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icachjbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Infhebbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkpnga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldkeeig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfoad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijbbfc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlidpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacijjgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d7c7d3b3e4de1094a0c1b363deea3210N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iccpniqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kopcbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklnconj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iabglnco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laffpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inidkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdffjgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbebilli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbbkocid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hchqbkkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilhkigcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inkaqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hqghqpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbfdjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igjbci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hghfnioq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibnjkbog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehfcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnpjlajn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbknebqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkljfok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkafdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khfkfedn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lolcnman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgocgjgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjolie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjihfbno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbbmmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kongmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kejloi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Halaloif.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	d7c7d3b3e4de1094a0c1b363deea3210N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilhkigcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Inkaqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlidpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pinffi32.dll"	Ilhkigcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdffjgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkqcmb.dll"	Klddlckd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lacijjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obcckehh.dll"	Inidkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmbpeafn.dll"	Kongmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkclkjqn.dll"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekdaogi.dll"	Lolcnman.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbknebqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncapfeoc.dll"	Icfmci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhodke32.dll"	Kdffjgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d7c7d3b3e4de1094a0c1b363deea3210N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mobpnd32.dll"	Kalcik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lddble32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jehfcl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jnpjlajn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kejloi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbbkocid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hchqbkkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdklc32.dll"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cadpqeqg.dll"	Icachjbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fooqlnoa.dll"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohnncn32.dll"	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjfkgg32.dll"	Jnnnfalp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Logicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laffpi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llngbabj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibnjkbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbebilli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgcnomaa.dll"	Logicn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iabglnco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hqghqpnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hnhkdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jldkeeig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ijbbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jopaaj32.dll"	Ibnjkbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aedfbe32.dll"	Infhebbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jdalog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lacijjgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Igjbci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Infhebbh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 1408	4888	d7c7d3b3e4de1094a0c1b363deea3210N.exe	93
PID 4888 wrote to memory of 1408	4888	d7c7d3b3e4de1094a0c1b363deea3210N.exe	93
PID 4888 wrote to memory of 1408	4888	d7c7d3b3e4de1094a0c1b363deea3210N.exe	93
PID 1408 wrote to memory of 1416	1408	Gbbkocid.exe	94
PID 1408 wrote to memory of 1416	1408	Gbbkocid.exe	94
PID 1408 wrote to memory of 1416	1408	Gbbkocid.exe	94
PID 1416 wrote to memory of 3688	1416	Hgocgjgk.exe	95
PID 1416 wrote to memory of 3688	1416	Hgocgjgk.exe	95
PID 1416 wrote to memory of 3688	1416	Hgocgjgk.exe	95
PID 3688 wrote to memory of 4616	3688	Hnhkdd32.exe	96
PID 3688 wrote to memory of 4616	3688	Hnhkdd32.exe	96
PID 3688 wrote to memory of 4616	3688	Hnhkdd32.exe	96
PID 4616 wrote to memory of 5076	4616	Hqghqpnl.exe	97
PID 4616 wrote to memory of 5076	4616	Hqghqpnl.exe	97
PID 4616 wrote to memory of 5076	4616	Hqghqpnl.exe	97
PID 5076 wrote to memory of 3544	5076	Hjolie32.exe	98
PID 5076 wrote to memory of 3544	5076	Hjolie32.exe	98
PID 5076 wrote to memory of 3544	5076	Hjolie32.exe	98
PID 3544 wrote to memory of 1864	3544	Hbfdjc32.exe	99
PID 3544 wrote to memory of 1864	3544	Hbfdjc32.exe	99
PID 3544 wrote to memory of 1864	3544	Hbfdjc32.exe	99
PID 1864 wrote to memory of 736	1864	Hchqbkkm.exe	100
PID 1864 wrote to memory of 736	1864	Hchqbkkm.exe	100
PID 1864 wrote to memory of 736	1864	Hchqbkkm.exe	100
PID 736 wrote to memory of 3208	736	Hjaioe32.exe	101
PID 736 wrote to memory of 3208	736	Hjaioe32.exe	101
PID 736 wrote to memory of 3208	736	Hjaioe32.exe	101
PID 3208 wrote to memory of 3808	3208	Halaloif.exe	102
PID 3208 wrote to memory of 3808	3208	Halaloif.exe	102
PID 3208 wrote to memory of 3808	3208	Halaloif.exe	102
PID 3808 wrote to memory of 4252	3808	Hgeihiac.exe	103
PID 3808 wrote to memory of 4252	3808	Hgeihiac.exe	103
PID 3808 wrote to memory of 4252	3808	Hgeihiac.exe	103
PID 4252 wrote to memory of 940	4252	Hbknebqi.exe	105
PID 4252 wrote to memory of 940	4252	Hbknebqi.exe	105
PID 4252 wrote to memory of 940	4252	Hbknebqi.exe	105
PID 940 wrote to memory of 540	940	Hejjanpm.exe	106
PID 940 wrote to memory of 540	940	Hejjanpm.exe	106
PID 940 wrote to memory of 540	940	Hejjanpm.exe	106
PID 540 wrote to memory of 216	540	Hghfnioq.exe	107
PID 540 wrote to memory of 216	540	Hghfnioq.exe	107
PID 540 wrote to memory of 216	540	Hghfnioq.exe	107
PID 216 wrote to memory of 4408	216	Ibnjkbog.exe	108
PID 216 wrote to memory of 4408	216	Ibnjkbog.exe	108
PID 216 wrote to memory of 4408	216	Ibnjkbog.exe	108
PID 4408 wrote to memory of 3980	4408	Igjbci32.exe	110
PID 4408 wrote to memory of 3980	4408	Igjbci32.exe	110
PID 4408 wrote to memory of 3980	4408	Igjbci32.exe	110
PID 3980 wrote to memory of 4100	3980	Iabglnco.exe	111
PID 3980 wrote to memory of 4100	3980	Iabglnco.exe	111
PID 3980 wrote to memory of 4100	3980	Iabglnco.exe	111
PID 4100 wrote to memory of 4608	4100	Icachjbb.exe	112
PID 4100 wrote to memory of 4608	4100	Icachjbb.exe	112
PID 4100 wrote to memory of 4608	4100	Icachjbb.exe	112
PID 4608 wrote to memory of 2136	4608	Ilhkigcd.exe	113
PID 4608 wrote to memory of 2136	4608	Ilhkigcd.exe	113
PID 4608 wrote to memory of 2136	4608	Ilhkigcd.exe	113
PID 2136 wrote to memory of 4680	2136	Infhebbh.exe	114
PID 2136 wrote to memory of 4680	2136	Infhebbh.exe	114
PID 2136 wrote to memory of 4680	2136	Infhebbh.exe	114
PID 4680 wrote to memory of 2840	4680	Iccpniqp.exe	115
PID 4680 wrote to memory of 2840	4680	Iccpniqp.exe	115
PID 4680 wrote to memory of 2840	4680	Iccpniqp.exe	115
PID 2840 wrote to memory of 3232	2840	Inidkb32.exe	117

C:\Users\Admin\AppData\Local\Temp\d7c7d3b3e4de1094a0c1b363deea3210N.exe
"C:\Users\Admin\AppData\Local\Temp\d7c7d3b3e4de1094a0c1b363deea3210N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\SysWOW64\Gbbkocid.exe
  C:\Windows\system32\Gbbkocid.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\Hgocgjgk.exe
    C:\Windows\system32\Hgocgjgk.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\Hnhkdd32.exe
      C:\Windows\system32\Hnhkdd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4616
      - C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Hchqbkkm.exe
        
        C:\Windows\system32\Hchqbkkm.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3232
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4528
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Jnpjlajn.exe
        
        C:\Windows\system32\Jnpjlajn.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4068
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3188
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4548
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1600
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Windows\SysWOW64\Kdffjgpj.exe
        
        C:\Windows\system32\Kdffjgpj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3720
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3900
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:472
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2720
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 412
        66⤵
        Program crash
        
        PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5184 -ip 5184
1⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
1⤵
PID:5652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Fljloomi.dll

Filesize
7KB

MD5
9d5f20a655558c2b0d553773101c58e1

SHA1
0b6fb7773679032297700e14fa299a1c66b40f72

SHA256
bf559bb4d13f86576021a8a282137bd0a95d28ef6a24a034814928df82c99940

SHA512
122e00612f044bd27338eac4d44c426cd90e47b4cf2eede2bc28deaaec5f68701f011e8bb2c4bc319773f76d71e183e5854fccd35ba8ab2fdb3ed374f58c2bd0

Download Submit
C:\Windows\SysWOW64\Gbbkocid.exe

Filesize
96KB

MD5
edc6732d88eabfc488e0404604f2fe8d

SHA1
5b145fb16acb7cd6fdfcf85f6f21324acad8ed11

SHA256
cf2d4bd1ac5375a6968de5e2e13393ea75073930894a5560d35178a74c5a51af

SHA512
783b0cde610de291340bb944b5ce39c64215514ebee23f516784831a3435f3f99aa0bb28cf9d6e206a51c9e3e8f5dd8a5d7efecd2cf79f081263b2111d3dbffd

Download Submit
C:\Windows\SysWOW64\Halaloif.exe

Filesize
96KB

MD5
6fa717f547721adb780272ae4304b541

SHA1
882d6f69da42f5e7c6a1ec876e8e0c37d0f4b409

SHA256
fadf44d049ab84c1da1966121c05b5b619ea8da27e15b1c24a71fb553f82e8ec

SHA512
2b5513efb65766f9c7acbd5c89d753431ee63a818a86cf5b7fd3ef0ca20d2c085bb01f27ace62720bf39f8a22f0fdfe2f4e35cce8436a727b0b9c2f5a9b6bddb

Download Submit
C:\Windows\SysWOW64\Hbfdjc32.exe

Filesize
96KB

MD5
b99a0f160d20241e2b81cc2e4b1de008

SHA1
04b22e6b228b8e26bcf3fe2792e84bddc1a265c8

SHA256
bb45715cb004525c65f732a16f214259c1873a4cd3477df9b490cac8364a2a28

SHA512
3ab246dd5a19c9cc45b6af969f112df6c1a4c261f862a5f6f024e0e03c8797bea62da8215aafcb17dc2f317844c5e103128928f3d8dc81dab53653a2b944f65a

Download Submit
C:\Windows\SysWOW64\Hbknebqi.exe

Filesize
96KB

MD5
6336bc465da00c949e16f5f5dd36c234

SHA1
993df218473674ec7581c29168e5d9428c7ec17e

SHA256
807e47f0f4ff4b34b05317f453c2d61c703fbc3ff208290098ddb837ddd99a55

SHA512
6ca931ef3df85906057c5b1b571ed6074143303537ed9340674101ad03eb0225f86a64ae5a627520ccd803f06c20b7851481c6c58a9df4c4bc75be1400934b40

Download Submit
C:\Windows\SysWOW64\Hchqbkkm.exe

Filesize
96KB

MD5
2fba824762662f2192659d9a2759c81b

SHA1
a1f446cf740ed91de69496db94812c72f81de4f6

SHA256
45b653b0d0fccea083814a20077395af8b334b7ca1ae165250701a715e4cb9e4

SHA512
4b2db593fa675522f6286527c924061c621b363bb47cc2a56bc680d1976ed05155eacdbb00e14abf2a6b406b72d1a66001921f053bfaf94ebd0e4114da8d6a29

Download Submit
C:\Windows\SysWOW64\Hejjanpm.exe

Filesize
96KB

MD5
b3e03cc66c4ada2d024e860e444b4ae9

SHA1
f904707bba3109d87a42d8259430db8acf6efcca

SHA256
73da805d0c5f5a59a2d21d9b70933069eb1cfa9b2bf6d3c61f4f69ac87677b31

SHA512
efb245bbdff22fa2f0dc9e00e1b153f7f1400a9e283ef1f1f8c6c397187c2ba7265af279a06a3f50cdc2f510c626ed03ee2cd90fd2d656dad413cca4aefa64b3

Download Submit
C:\Windows\SysWOW64\Hgeihiac.exe

Filesize
96KB

MD5
c638b5be1a55a4e81c11a52d4e419f21

SHA1
24b5853ebbd7c7db617091c9879bacb83fa110bb

SHA256
151ac4cda3804669257b3ca0fb548cd73cdefd539acd92644020f18978cb049f

SHA512
2d830b58eb68bd83c1f9e07feb3c622da1f0e3d72b30f7d3399e3db375d9a0fc1366a4a1b8865a6fc3f979b92a67fdfba77120e1f746aa184d70a16297dd594c

Download Submit
C:\Windows\SysWOW64\Hghfnioq.exe

Filesize
96KB

MD5
2fc5577510087e63c68cb92a40bcd592

SHA1
2b3cdcd32d26e6b55f94b0d51f0a21e768a468d9

SHA256
0a6a049c1d479cb8e1d97298d221409e03a5d1addfd76fbb47ddb5ad545efe10

SHA512
d08fb83e743f9a87e9cb788b5236445f4d69e72336096e2e580ef8d98173e35e3503b3110f60781320bb0aa4b66ddaf764d281ba8c29dc331fbcc51087b5dba8

Download Submit
C:\Windows\SysWOW64\Hgocgjgk.exe

Filesize
96KB

MD5
0c3e48cd3af80844095efdef2911f7b3

SHA1
9c2f38c715bd38a603467b903a4a1c2052e1c861

SHA256
e51c5eef19a3e86e28a08ad5434b2f1c5143bb4f460df077cb3846e7fe5a1c32

SHA512
ddc6f6519871a12ac753e03c74720d4794a088b3f51df3ad9590514bf6bef7eceef44e54cfac338dbe79dc974366b17773f73140540f273e55f9a58e623ff989

Download Submit
C:\Windows\SysWOW64\Hjaioe32.exe

Filesize
96KB

MD5
6a541ed11e41439313bf00029e2014f5

SHA1
a441ff2838667a9533b01b58b0873be98e3dc99f

SHA256
0eaeb791763b3ae6615e1a0e4b35f67dcbe657d5b3e92d2247f5b941f5b72069

SHA512
fe60ca15fa3e6b30fee9edf761dbecd9ca27a102687d7ce76666ac96ff179f124607b7fb50471aa06428e096d041e811dd7a1e31746e69eabab9c941635b3997

Download Submit
C:\Windows\SysWOW64\Hjolie32.exe

Filesize
96KB

MD5
80019290d0f6e8c9cc299808d9ecd262

SHA1
89b70c4591cb2b4bed1f6041bdf713b3a64b4f15

SHA256
7a917d8d135ae9b925f345c7470592583acdd4b713befdf810d3b90a28d0acbc

SHA512
b2677806a9858aba40c41514e9544769799824b443bd2f7bb68b092aeacb97bc61e8b49ce5c59092521b6bf4ea39f8cdb6048669c8c409265ffd5358a940a8fb

Download Submit
C:\Windows\SysWOW64\Hnhkdd32.exe

Filesize
96KB

MD5
5c8f763b8b83c5cde6da8b7c1f2bfb50

SHA1
a1566fe792af24783f0470d2a680cf4d5e410fab

SHA256
c75088b3248adece0d4a7fb31ef22961018d03f4244048da2edb63913b45300e

SHA512
3392197f20cd4d6feecbf280dc9727aaf503fdd6d13e052f93db4eaa9dd350424404b07c9571850abaeb60cb0be13abb273b2d9fc4449ce77f8702d7804a20a4

Download Submit
C:\Windows\SysWOW64\Hqghqpnl.exe

Filesize
96KB

MD5
8146d2ec4f0e4d0dcd4da7283970159a

SHA1
b10db6e7991fa361b2ea3b6290ecbf20bcafdf83

SHA256
502430d6e870b96204534e2834a43e0585060998ac3dc537fe54ec45b360663e

SHA512
78152f794c41e75b5276674d3280c2ea7100b40caad91a18da4471b9d3f219d410529375d8ff3b51823a3c3968ba89a7aa98b7f905c24f94846f15ca4ae4cb83

Download Submit
C:\Windows\SysWOW64\Iabglnco.exe

Filesize
96KB

MD5
cefecdacd39de91e85c7d7a2a2c6b911

SHA1
6e081423e478aedac73039f98fff133c22e9795a

SHA256
4eeb098f3da4ce68f22aaee7fea1f6929edadc62ec4e2e5f48b5784f607f8227

SHA512
580653cdba948ab10bcbbd866396b0f870de651c32aefde6dc7805ba6238e9b9ee2abf34f4f121ee33df4a5ed44777c183e526da8bfec1b1d67f22ac668fd517

Download Submit
C:\Windows\SysWOW64\Ibnjkbog.exe

Filesize
96KB

MD5
3ddc46d6a024201417ffc7fd4a40466d

SHA1
f9f33342f46aec3fd48af4f6129c79fbd7a40579

SHA256
4e66bf5448b54ae125819441e3d772f6a7fd4be45fb9a026114a194eefe824e9

SHA512
79222b5696896392d81e964c93f4ec63ae79683b8e7a6d4c220f3b4cb2f426059a1a25d7aafbd6fc5094d718eb1ac38dc80080623b41e70ec3e81db71c1a1b3d

Download Submit
C:\Windows\SysWOW64\Icachjbb.exe

Filesize
96KB

MD5
9e022b4d7263dce518b400e40692c196

SHA1
beb5defd91bf6f75bab51d4bb8391beda37a98a0

SHA256
2a92b50017e7f647c350d7244d05f1b43ed0ce7227a77058220c26e686d05474

SHA512
7cd79ae98f00ba698dbd1ae1ebad72bdb1be10a514b0dc812ae51d25c8aaeb9ea275d02ed5972c0a41f726177af9a9e3d3f5bbf3efaea08c4828b801b5315185

Download Submit
C:\Windows\SysWOW64\Iccpniqp.exe

Filesize
96KB

MD5
20c40fea254b9ab4557474affc7f13d3

SHA1
b70636a35d2957513fdae69b8fbdfb699ca9ab4c

SHA256
cdeca608fa05b077262a017fd9afa1d2cf62ca2e4892549d58e33169fcf5b574

SHA512
75524f9cf465db3fba976feedd1336a35e88e707d9560644f41ffa2e577811c8f0db7e540cd1128de76c9bf34c56ee58b83b8cbf7faff20313d90abf6f64a5f9

Download Submit
C:\Windows\SysWOW64\Icfmci32.exe

Filesize
96KB

MD5
a11ea69102f4e66de49a91aa20c2cb14

SHA1
790e9ac7b240ea37d86cbba345b9c734a7fc512b

SHA256
2476eef6091961d2f56b5cbc364beb964fa877f795ebaf9df18105f0f889274a

SHA512
66ec6362e81452f6d4dec136070b44886fea5361c07e397dfbdd233786e5dfac2fd9c7c69d494db11c447ff990b796f7a53efa078b04625063359f3afd96057d

Download Submit
C:\Windows\SysWOW64\Ieeimlep.exe

Filesize
96KB

MD5
1fb94f481980cad658924b570e29a63a

SHA1
f11ddb58b8d667c2c7b4e212fc2624e58609b062

SHA256
2441086fcdd06aded3d0a4b48c3c0c9b1963c31836d2cfbf582945e37546db75

SHA512
db58b48b233c08fb8ae51c95600e38657c934bec8edec3eb4ee1d449648f4fc556a12c8bc1c1c82184073d167f2d3e8b79e98a4894ef241aa14ff6879d6c5eec

Download Submit
C:\Windows\SysWOW64\Igjbci32.exe

Filesize
96KB

MD5
5b5369c68f34830bb1769449540ae286

SHA1
5f75d3fd2e74e939fd22bb575486cbf02cebed90

SHA256
4a59794c356361e3c7664e68a24cea7de636b2baee544428a35bd804d4f23b42

SHA512
de65a839be76d976d79a374769241f054939fcf9e7a1cf65ccb9318d845ac1e671dda14670100e71afb67c24e809c15a755114ff6783c8be4f58b45ab4669d3e

Download Submit
C:\Windows\SysWOW64\Ijbbfc32.exe

Filesize
96KB

MD5
eda5d734e5cf3b31a2b29d6e016816b5

SHA1
da2ecd5459dedaa4e6cbfae7c70e966ba16cd5ba

SHA256
63c3151d15e3fe723ca3a3d10e7a9656551b4a3d6cc831ea1fba7812be926d3d

SHA512
4da6526e5ff78e8a73e1bdef181d60363c588fa7890616680d09dc528ee2a792db50b72d6f091e79eca8499a0a57639b3d38b4f7e6c4639f85ce68c79e737a69

Download Submit
C:\Windows\SysWOW64\Ilhkigcd.exe

Filesize
96KB

MD5
3082798ed4e3421ebd6d25e6a1eebb2b

SHA1
b9902d09885b310bf27abb22617d4e9458be1de9

SHA256
b84bd4dc59a30e9a7486ff71edb3e373b2dc845bbdb620ca9bfca4ea94ebc8d5

SHA512
b1731b64be6829353e0cbe35cfbc57e028a6371eade9a519462466dd59060e3bf1fc387fcc688ae10af53323d3c75ad0fa8d8cc0772915f6295da4b6d6d9afce

Download Submit
C:\Windows\SysWOW64\Infhebbh.exe

Filesize
96KB

MD5
e74ceaa84e226febd08298142b69e9e7

SHA1
e4f7018f6a2e11786c1c82e3692d1bbf77f0bd3c

SHA256
9deb5447c12381ac1aae12d12f7705e96df46defa9a1939c02495e2d2e606eb6

SHA512
f1bb9656324c7e35f5d8fb9fcda783a9d0221b598b83579a3cfeba0fa3afc3b1b5edd156122753189b67fce1c6ed45ad39300810b7b34dc14dcd2ab865f2d017

Download Submit
C:\Windows\SysWOW64\Inidkb32.exe

Filesize
96KB

MD5
2cd781927cb5495e0a5b7842917be853

SHA1
3a2efff7cd8c828584cf6631af9c0abd797d9e1b

SHA256
058de0736c65e31ce9e17fa887b9e4bd1cd2cbe0df5c035f6a8aeec96e856378

SHA512
942eccfe4bab7b655c59fd63130b1803efb633046c8594afdbddad13369ef1cda1c1fcee9c0575d171efb58d93652b266a7682156097e9935fe9c60e97c0f3a1

Download Submit
C:\Windows\SysWOW64\Inkaqb32.exe

Filesize
96KB

MD5
fdfee95345867f3157c169c102962aed

SHA1
b829d601192bc69ffb2e2be2675cac0d9f4025be

SHA256
3b6190c5c40bdf73dbcd5ececec8bb850a2b90be5ccac004b45cac68489d7040

SHA512
9cb9b041402e031ef067e1f5fd1b5890690f519a0506dfaf4268fedc36dfd9851a4360d229c7fac36da2eaac795173dadf0f1e16a72c6487189a03c7ae83f061

Download Submit
C:\Windows\SysWOW64\Jbncbpqd.exe

Filesize
96KB

MD5
ef6feebcaca254fed02bb756afa04606

SHA1
3547009c38d9b21bd15168c06088ba9c38afaf5a

SHA256
ff39b61e355dfe04c181856300f8114cd9c97b5290d25d8e354b49b3e03681a9

SHA512
b86656c602ba6861505401373ea6e7f259f084f4df653ea8f3283111a804d9511be2adfb9f9f3e19bc15a95dda00e2736f1b5c370de50feba15ca8d452825920

Download Submit
C:\Windows\SysWOW64\Jehfcl32.exe

Filesize
96KB

MD5
519d009096c3a26fe67479a1bd35f454

SHA1
c097d19bc3c870e42a9739e9d75cd0ed629ac570

SHA256
bcf507703451782c9ddc1cf62c82fa463a76d43d07a0c1071d1843ad6440cd5c

SHA512
506a9ea3e14345bb635adec13a9e8f670c6a6f63a18512abc500b7b7714f33def7f26a2b5fb5ca375fe77e7c3d4f20cfaf385bd75e4d31b73d304aa1a8093466

Download Submit
C:\Windows\SysWOW64\Jejbhk32.exe

Filesize
96KB

MD5
9f3b38ca7ebccbe57afae1fa51d59d82

SHA1
72036eb102205aba564deaf7d1f7f35a83d8b0c0

SHA256
2aa86ff1629fe7b1cf4d064d64106bfd1fdd5e07f2d4a467af042b664d975da9

SHA512
96f9752cf49c6c52153132ec63a716685e274191e96e5ffa45ea8937e2fed5f69d1a1cc20280fa37633c08e8040e4da9cd229fa3126e75674804c78f0334278c

Download Submit
C:\Windows\SysWOW64\Jhkljfok.exe

Filesize
96KB

MD5
889233686fedd52933b1c4c5c9f5990d

SHA1
b66bc2ad1453e6817073644b8fe3cbe8654dc8e4

SHA256
3432992c923908a3530dae44b47943f1f71f06b2e93e3d4d514397ffd7b531ab

SHA512
aa7923e92100aee0a8d7a888fff19eed386f6fcf65107cf0dbc8b641c2361e66707f9674db55b7600516e56117d1b0e9d53ecf014e605db183ae3b940c78b855

Download Submit
C:\Windows\SysWOW64\Jldkeeig.exe

Filesize
96KB

MD5
ba950baaff77e9ea78e8cc1fe2a3f9c6

SHA1
ea7de622cf578977f8a6ac39197341436abe38c7

SHA256
4b5204eb09ab3b9867f5c82fa816a2e8df9f3400a4820d12d37413655f97fd4a

SHA512
c90a1673bc3bddbdb678a9311b2d3bb2b48ca23ccc0dc9e9624424dfa51f7f6ec43f4e79da5ad9dd8816a63aae1d03dfc7d88419d5c887bf0edb4a037639b158

Download Submit
C:\Windows\SysWOW64\Jnnnfalp.exe

Filesize
96KB

MD5
f4ce37c987c34c542773edbef92bfb9e

SHA1
56ca5cc7ec4d3da70eb0286698aef6718ba0dab7

SHA256
9cd0b998f0ff1ff539de2f96936df1c4d997122f2f9bda077c01061bdc7e1bd6

SHA512
f789906a328a8dcef187286bde4e92f3aa3bc089b9dbeba38d5d23e607c45d8cdba57705c5fb79149fabeb07bee455e20ba064cc5b6a17c9e785b60c68eb6c5d

Download Submit
C:\Windows\SysWOW64\Jnpjlajn.exe

Filesize
96KB

MD5
f003db3ddaf02044bf8ce479011d9acb

SHA1
434ca6c5595facf316b636410663591d2fd90be6

SHA256
6c485b78594aca1bf11b4174a95d3ce70c36ee3572fa9f4529f103f90527df1a

SHA512
3413f5a1a9853d3a23f0f73bf7345cf5790420bf5951800693e36efcc83767ad49034f3027f1dc36713d7e1ac810d7132fbe80c869861ab46621b9c77d73b777

Download Submit
C:\Windows\SysWOW64\Kemhei32.exe

Filesize
96KB

MD5
ea696177cb6b041f74c89f1428fb98db

SHA1
fd1f88a62604b8f5061e8e6d84dc07042f4af31b

SHA256
0357c58583dede831cb8d403e720a129cb5b9e2364a244817d8c715a0963b264

SHA512
23eeb9ee1ab0fd86dc3c01c2cf7b0ba2706eece6ffc526e54282b301b8876c157cc218a86a7118ad36388e29c2bc9e1136c6eec456bcc4825dc867cb318df8d1

Download Submit
C:\Windows\SysWOW64\Kkpnga32.exe

Filesize
96KB

MD5
08728db71ddef0c9ac82d76fb2769a02

SHA1
76b6f686151466a61fe40cf82fd29895e435cd5a

SHA256
73043fcc9fd0889d53ca60f2fc8779e416e0e00a1fceab22b8a7499750568c1d

SHA512
e50bf742cb33bfd7111ac5d3e36f540cfe189cbc8e4de52b33a9c5a90ed96e1a2d9250e98200161049e0458230383789870b8f4e0d9ae7b4dee606a84e276a6c

Download Submit
C:\Windows\SysWOW64\Lacijjgi.exe

Filesize
96KB

MD5
403ce77786fd200c809a5d416bcfd4f1

SHA1
8bfdfde794aeb5f945061eb2557418e42155eee7

SHA256
b3186400e8cde654aaa2a4f508ce13d1527b374d802e938248ed7ea8f737dd7f

SHA512
91e1dbea079191100aec6125d18663c13c3397f6eb139a1c819d1def36b6d25583811f6bee16b8874c888fb001a391d75735a4b8e56bea033252e0152ab07067

Download Submit
memory/216-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/472-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/704-457-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/704-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/736-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/820-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/820-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1072-471-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1072-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1408-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1416-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-474-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1612-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1612-469-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1632-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1632-451-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1804-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1804-473-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1848-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1848-455-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1864-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2008-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2008-477-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2032-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2032-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2060-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2136-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2232-452-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2232-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2348-183-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2436-467-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2436-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2512-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2512-475-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-468-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2716-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2716-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2720-456-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2720-408-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2840-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2916-458-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3052-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3052-465-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3188-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3208-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3232-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3480-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3688-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3720-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3720-462-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3808-80-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3900-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3900-461-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3980-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3984-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3984-459-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-453-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4068-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4100-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4252-87-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-470-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4328-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4404-464-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4404-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4408-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4564-463-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4564-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4608-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4616-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4648-239-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4680-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4888-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-476-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-479-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5004-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5076-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5144-450-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5144-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5184-449-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5184-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads