131df2e6e49e0780d8f124b91e17e9fbf35fe4a50b48ad9947b52c3cbf8d6a4f

Analysis

max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20da86711e2f90fe3a63bc0c42574b00N.exe
Size

72KB
MD5

20da86711e2f90fe3a63bc0c42574b00
SHA1

1ad6a279a6787dd9bfa95ae1bb52b0f4947e0ea6
SHA256

131df2e6e49e0780d8f124b91e17e9fbf35fe4a50b48ad9947b52c3cbf8d6a4f
SHA512

8ce8036f60a1d531898117bd6f0535ed94f97d1110320d41e98ef977c3b2238aa782708e65c5d8e02ed739da0cd50856e85118284eec74ff89e2d4ef30431e94
SSDEEP

1536:EJtQJPwN/Sx2DPulDyfkNqYJplm7dM9W3+nZP/YZg:ErsA/bPulDycNqYJprWOnZnYZg

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	20da86711e2f90fe3a63bc0c42574b00N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	20da86711e2f90fe3a63bc0c42574b00N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe

Executes dropped EXE 59 IoCs

pid	Process
100	Adgbpc32.exe
4116	Ageolo32.exe
3336	Anogiicl.exe
412	Aqncedbp.exe
2916	Agglboim.exe
2928	Amddjegd.exe
3640	Acnlgp32.exe
5080	Afmhck32.exe
2252	Andqdh32.exe
3664	Aabmqd32.exe
2868	Aglemn32.exe
1112	Ajkaii32.exe
3588	Aadifclh.exe
3316	Accfbokl.exe
2704	Bfabnjjp.exe
3584	Bmkjkd32.exe
2400	Bcebhoii.exe
4836	Bjokdipf.exe
3996	Bmngqdpj.exe
3548	Bgcknmop.exe
3132	Bmpcfdmg.exe
3764	Bcjlcn32.exe
3380	Bjddphlq.exe
5028	Beihma32.exe
388	Bhhdil32.exe
2684	Bfkedibe.exe
1744	Bcoenmao.exe
1000	Cjinkg32.exe
4256	Cmgjgcgo.exe
2600	Cenahpha.exe
3636	Cfpnph32.exe
1280	Cnffqf32.exe
4600	Cmiflbel.exe
764	Cdcoim32.exe
848	Cjmgfgdf.exe
3224	Cmlcbbcj.exe
1568	Ceckcp32.exe
1696	Chagok32.exe
2364	Cjpckf32.exe
3824	Cmnpgb32.exe
3780	Cdhhdlid.exe
2336	Cffdpghg.exe
748	Calhnpgn.exe
3344	Ddjejl32.exe
3396	Dfiafg32.exe
3756	Dmcibama.exe
4080	Dejacond.exe
1928	Dhhnpjmh.exe
2328	Djgjlelk.exe
3280	Dmefhako.exe
1752	Ddonekbl.exe
4516	Dfnjafap.exe
3360	Dmgbnq32.exe
4672	Ddakjkqi.exe
1420	Dkkcge32.exe
3884	Dmjocp32.exe
4068	Dddhpjof.exe
4192	Dknpmdfc.exe
2696	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Agglboim.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Echegpbb.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	20da86711e2f90fe3a63bc0c42574b00N.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Akmfnc32.dll	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Adgbpc32.exe	20da86711e2f90fe3a63bc0c42574b00N.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aabmqd32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Ageolo32.exe	Adgbpc32.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2696	WerFault.exe	148

System Location Discovery: System Language Discovery 1 TTPs 61 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20da86711e2f90fe3a63bc0c42574b00N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	20da86711e2f90fe3a63bc0c42574b00N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	20da86711e2f90fe3a63bc0c42574b00N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amddjegd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 100	4296	20da86711e2f90fe3a63bc0c42574b00N.exe	86
PID 4296 wrote to memory of 100	4296	20da86711e2f90fe3a63bc0c42574b00N.exe	86
PID 4296 wrote to memory of 100	4296	20da86711e2f90fe3a63bc0c42574b00N.exe	86
PID 100 wrote to memory of 4116	100	Adgbpc32.exe	87
PID 100 wrote to memory of 4116	100	Adgbpc32.exe	87
PID 100 wrote to memory of 4116	100	Adgbpc32.exe	87
PID 4116 wrote to memory of 3336	4116	Ageolo32.exe	88
PID 4116 wrote to memory of 3336	4116	Ageolo32.exe	88
PID 4116 wrote to memory of 3336	4116	Ageolo32.exe	88
PID 3336 wrote to memory of 412	3336	Anogiicl.exe	89
PID 3336 wrote to memory of 412	3336	Anogiicl.exe	89
PID 3336 wrote to memory of 412	3336	Anogiicl.exe	89
PID 412 wrote to memory of 2916	412	Aqncedbp.exe	90
PID 412 wrote to memory of 2916	412	Aqncedbp.exe	90
PID 412 wrote to memory of 2916	412	Aqncedbp.exe	90
PID 2916 wrote to memory of 2928	2916	Agglboim.exe	91
PID 2916 wrote to memory of 2928	2916	Agglboim.exe	91
PID 2916 wrote to memory of 2928	2916	Agglboim.exe	91
PID 2928 wrote to memory of 3640	2928	Amddjegd.exe	92
PID 2928 wrote to memory of 3640	2928	Amddjegd.exe	92
PID 2928 wrote to memory of 3640	2928	Amddjegd.exe	92
PID 3640 wrote to memory of 5080	3640	Acnlgp32.exe	93
PID 3640 wrote to memory of 5080	3640	Acnlgp32.exe	93
PID 3640 wrote to memory of 5080	3640	Acnlgp32.exe	93
PID 5080 wrote to memory of 2252	5080	Afmhck32.exe	94
PID 5080 wrote to memory of 2252	5080	Afmhck32.exe	94
PID 5080 wrote to memory of 2252	5080	Afmhck32.exe	94
PID 2252 wrote to memory of 3664	2252	Andqdh32.exe	95
PID 2252 wrote to memory of 3664	2252	Andqdh32.exe	95
PID 2252 wrote to memory of 3664	2252	Andqdh32.exe	95
PID 3664 wrote to memory of 2868	3664	Aabmqd32.exe	96
PID 3664 wrote to memory of 2868	3664	Aabmqd32.exe	96
PID 3664 wrote to memory of 2868	3664	Aabmqd32.exe	96
PID 2868 wrote to memory of 1112	2868	Aglemn32.exe	97
PID 2868 wrote to memory of 1112	2868	Aglemn32.exe	97
PID 2868 wrote to memory of 1112	2868	Aglemn32.exe	97
PID 1112 wrote to memory of 3588	1112	Ajkaii32.exe	98
PID 1112 wrote to memory of 3588	1112	Ajkaii32.exe	98
PID 1112 wrote to memory of 3588	1112	Ajkaii32.exe	98
PID 3588 wrote to memory of 3316	3588	Aadifclh.exe	99
PID 3588 wrote to memory of 3316	3588	Aadifclh.exe	99
PID 3588 wrote to memory of 3316	3588	Aadifclh.exe	99
PID 3316 wrote to memory of 2704	3316	Accfbokl.exe	100
PID 3316 wrote to memory of 2704	3316	Accfbokl.exe	100
PID 3316 wrote to memory of 2704	3316	Accfbokl.exe	100
PID 2704 wrote to memory of 3584	2704	Bfabnjjp.exe	101
PID 2704 wrote to memory of 3584	2704	Bfabnjjp.exe	101
PID 2704 wrote to memory of 3584	2704	Bfabnjjp.exe	101
PID 3584 wrote to memory of 2400	3584	Bmkjkd32.exe	102
PID 3584 wrote to memory of 2400	3584	Bmkjkd32.exe	102
PID 3584 wrote to memory of 2400	3584	Bmkjkd32.exe	102
PID 2400 wrote to memory of 4836	2400	Bcebhoii.exe	104
PID 2400 wrote to memory of 4836	2400	Bcebhoii.exe	104
PID 2400 wrote to memory of 4836	2400	Bcebhoii.exe	104
PID 4836 wrote to memory of 3996	4836	Bjokdipf.exe	105
PID 4836 wrote to memory of 3996	4836	Bjokdipf.exe	105
PID 4836 wrote to memory of 3996	4836	Bjokdipf.exe	105
PID 3996 wrote to memory of 3548	3996	Bmngqdpj.exe	106
PID 3996 wrote to memory of 3548	3996	Bmngqdpj.exe	106
PID 3996 wrote to memory of 3548	3996	Bmngqdpj.exe	106
PID 3548 wrote to memory of 3132	3548	Bgcknmop.exe	107
PID 3548 wrote to memory of 3132	3548	Bgcknmop.exe	107
PID 3548 wrote to memory of 3132	3548	Bgcknmop.exe	107
PID 3132 wrote to memory of 3764	3132	Bmpcfdmg.exe	109

C:\Users\Admin\AppData\Local\Temp\20da86711e2f90fe3a63bc0c42574b00N.exe
"C:\Users\Admin\AppData\Local\Temp\20da86711e2f90fe3a63bc0c42574b00N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\Adgbpc32.exe
  C:\Windows\system32\Adgbpc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Windows\SysWOW64\Ageolo32.exe
    C:\Windows\system32\Ageolo32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\SysWOW64\Anogiicl.exe
      C:\Windows\system32\Anogiicl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3548
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:848
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3224
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1696
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:748
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4080
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1752
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 416
        62⤵
        Program crash
        
        PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2696 -ip 2696
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
72KB

MD5
10e1355b12abf3d3f1086417a409c553

SHA1
6b745924e60ca271b929f1d2d52fc24d6f0face3

SHA256
ac85cc3a41794fac5d84c6d6fbed264772756dbfdf59a6be7ff74f380dd18e73

SHA512
967c499c0097264e620d515a8214516dec62f67220aeac3626241fea70f8e9875759eb6a98fb2b7112f487c253342f341c24e3c03a3a5406ccbae529dd1d7d79

Download Submit
C:\Windows\SysWOW64\Aadifclh.exe

Filesize
72KB

MD5
61a797462a00341062d73d42fff9974c

SHA1
2614049badf878086b35b20ae11fb4f593163899

SHA256
cc610ad11de4f6f39174e1a610133704ac2e1b42698f921682b2fd3dda536c91

SHA512
6bf1f59fd11d51888338ef85b4be722fe2182ce5cc2347bc9f784349604ae6bad6624cb8689443c703ee71c7dc57a3b0bdd6971d297c4576fe6cf12f6dbd9ee7

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
72KB

MD5
12034f7ccc04e1029d01ede54cf4d12f

SHA1
aeae267874a9f46f7f84d1023cb09c0f2063452b

SHA256
db535c9fad660c2792c564513ecbfa9e680c943c55777c9e8fe8d422cc9dfdb2

SHA512
cd42d8c06b5bfa744eca6d28a428cf6c617dd3051ccef8ee0364f9d5b40283ad2908fb44609b492e22c76467e6d49588353764f513238d338328b891f05fa6fa

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
72KB

MD5
bd6bde947171b9df46391761e140b16d

SHA1
e69a65f0f28a4031869dbe8670f6726f9df71afc

SHA256
8ac44897ea79fd8e59232951e34ba4f03fc3ae1b69b5cedd2a295801cf67dde1

SHA512
25181bf70b82ef5717da0692b8f229df9839ee4b91d625ca91bd97c160f6a219ca7ac20dccbedac3152d17b3d814b6b4139344e3d65d3ea1afa28756e6c8f61a

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
72KB

MD5
4a4a915638f6e99dcd64455a08ac9839

SHA1
591cb923ad46476b31ae87e2b11f811a6e43405e

SHA256
05df473e649ad3f17a21edf78e67fcf4e3ecf600cb90ff3dbf29789a582ba265

SHA512
324a64dd61490f15039030b4353f76929ac633b4e1900ea174e511d16751d4ea6da1ef49de658b03d75e69d1bb8b917f32d5d7c61c615195562cf7fb9ca11083

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
72KB

MD5
498657b6a7f1a55fb5940f0bd85b4072

SHA1
b71e9154a471b34fded0ff4b5374ebe2fbdaff15

SHA256
aa2827c70bc9381d22e8bc79bad373cc4e8d5cd94f3e8d2415492db78254f7f7

SHA512
60f32035fba66a5638d174de08bbf25af1a8de8042c7d1bacb603eee8271eff5b347f0688e7bf71b8164c846eadb14870a2697d952a4b1d828947e2530ae8e5e

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
72KB

MD5
ae555d566bc46defe468a2bbdbd6fcc1

SHA1
0b782a2a8502d1cfe42af432582479dfb5835208

SHA256
6d5cfaa71f5f017e4c4bfa621c471d784da07fc32fc0fad14e21548482a595b0

SHA512
2511d903488adc59405c6cee24b60f30cf8e93fd2874519c7bd20bdd38d93ea251de697653e35bb38cbcaf802cb665b884223f1d9426cb475c3d96df70f4c9bb

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
72KB

MD5
609999d8d4e268c502d0dbde720db703

SHA1
e71fca1071cd565e0df81e140d458a70b508378c

SHA256
b8adf03b3abf6c473e307abf13184cd6d5a11d1c407cd52f4290b25da4d3f9ef

SHA512
caed89c65d3a056e93c9edd1520bd34016f164ecb5839886a524288451bcb61cd377b707d890f3ec099153795ffbfd80844db234039c22cde2fcb22490b3e397

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
72KB

MD5
093a63aad9685bd210a39c40e622de63

SHA1
a42345637ff96dd3761c4a6e5befa067af81c8bf

SHA256
74b7b19991b5ee778a196a2ac9106f7f9b03a03c927e2864c6871ea1a44a40e5

SHA512
fec9f57b509d61da62be363127b7b5942b12b352ccd85f9e9b5963eef3feab336b8e1a61f18bdcc07e2418b364cf9d4df883d63ba177e864e00b5ef880260270

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
72KB

MD5
204753d7c904cb973122fa64fbbe2549

SHA1
7c0a76514bfe1e91e74c590301105462b60af8c0

SHA256
448fd5e75cb2ff5fea1354b74082d531d1d244f8b935876ee5e33d5419d52723

SHA512
6da7699eb7f8b0e350b8cbcbedfd85d568e4b6d3394a252f8654cf88755f54fa1af6ff87f032f97945a9069e7192e399306f206e843d2cd409afdd06e59bde91

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
72KB

MD5
c2103c3da8207a65a2b90eb48034813b

SHA1
b9a967e5417fb21e51b076739e1bfeb3334b892f

SHA256
9ff35fd743f780edc6c3c77d570f5ee535838c0d4a16d01ce517ecd556b038ea

SHA512
596801930a9cdfb644879bcbf62bfb12bf09df560470527be1bcd5659b6c89584058b5301cbdafa1707f4715241d87c1f18226109a3847c228230c0aa9c6b359

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
72KB

MD5
11e894255861af51e653c719ba5e199e

SHA1
5b7bd35176a654b19b7ea7436644feaf42774b56

SHA256
54a245c84f0a4a0a5fb7af1a78c41d2b2a0c2d882e77a553577b0dd5e63d52c8

SHA512
f71fd204144da7e0e61fb4b1b4943c7699613489384cb161a5faabccb648f5ed845db9a0a63f493b7f2a1f484533637a0cb6652e206253b5f3fffa4cc0a8eea2

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
72KB

MD5
b0b6ed398b32b0d538c4336212232db4

SHA1
3cf465b97707e4ebda7f2dad61ad80dd667eeb38

SHA256
b6bc2c0b1f3a34f638dd44eb16627a7000c4866dd1442a61d772ea32bd637218

SHA512
763e95af1877290d61313c2078b0f34ba721f80bc73bb37ab00bce3ef7826a93c52523dc98ad8f938458e19c3b0bb94d3df9ab957e8dc19c0c7d8d3111336cf5

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
72KB

MD5
f323680fb874f88a248083fc0a09de0c

SHA1
d9714a52400d749ed597f5c71ebc248a8e5cf4b4

SHA256
e8ff6a79b4ae4427cbd963c211d014fff35283fa935a8d8309ca37d0527ad5b6

SHA512
e6e1872030227290004098091e692fa3378487c558370230415f0c9329245c5653af547391c903baf806649d1a26d0f96470bede31ff0b83af7f391a1e532fac

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
72KB

MD5
3ece46f971a99aeb9874a7804d0e1be8

SHA1
1d9b737cbde6a1d3e035ce2b9ca0a9664a317d9c

SHA256
91edfbf71ed6664366eeb02f6a459f6d90a6242ea2e9255d6ed241b860782e4b

SHA512
d61b2f761e6a76c7c05734a91cda70e34779f2c54fe76680a908125b132f01dc84c9243afc94f662ac4fa0a918607dea0d82fde230f3f3625e578722baff395a

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
72KB

MD5
84f4e1f97cbff08fd716a234fdee607c

SHA1
635ce12e1162dce1f4c19996ab19eb9978133627

SHA256
ac52f54887ffdad69741e91927b865807391460202f93c19650565fd01066aa1

SHA512
31ac3d90136a4a2ad567b9c3c202e6aeb2cef46971e384cfc82e6184eaa9894a0a2cdd5f2eb5e9b69f9381cd57a5025fff8640382a428c341e20621c970a462a

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
72KB

MD5
e763a69727447f243595c4aecbed19eb

SHA1
2c57a67f35185fa67ca831bd4ffc2de0a828fc57

SHA256
9dc0508e95033cd1fd95318e79f06f720b2351a67ef5426daedfbfcf5bcd1b79

SHA512
793439913c98f7b849c0b7d53fbd1d96e4b37afbf18b21c8bd75583408151ecc228bb9ef5871d3e716f8ce0e336eb77546533a7a4bfd14d3ef1d2305d918403e

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
72KB

MD5
408aeb21963444780529ee828cb36df6

SHA1
46ce1ab65524c2cedcc417588b5fb786917f7d3c

SHA256
0854d1dacc5a69c1a1a1a42007f9cac326e9f72745b4ac0f8db1d156b67b0e3a

SHA512
6dbe2eabae6a2a38963d3eca3794d2be20cd9cfc4141a134dd992075213af91665fd2330c9171a7f7e125be786c72ca238dab29f67425a8d366760ce9d4a08fe

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
72KB

MD5
9a93f4228de2b5c394b102d9595d8fc6

SHA1
b22f2cc64718a9ddf7d89755e39964f32cae7378

SHA256
8906de91115feda7d72c095cdc61346645355135b1ed0b77ce16e5513d875a4c

SHA512
0a3ec1b51e8d2809f7e277bf26de1c1513c2e7f76bd8e45a88b4eca4f71fd4d522ab5fdb53aa5462fb0023821d383f5c0c33813996a1f4aa3267402ee3ec39c3

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
72KB

MD5
e8c877392a1536d7336c3283efcec224

SHA1
6019bf2043dfa277294e3f878cfc0b2d504e25fb

SHA256
aa40bff5c72ebc22d91cccccd69084fcf199684370cffd149a522270c7e89d3e

SHA512
f1346c65406ddee0b2d4e926952c4b07dd091f9730f377c33b547799184372cdad68da9e8dc60f982d6a8fdf7fa5eba0f042ecb8aba0404224efa35a1f5a57f8

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
72KB

MD5
accf134ca754a6cd2796178e260ce862

SHA1
f6628bdb0323485819eaf74cf0733c27ad0c0029

SHA256
9813c9ce2b79e50ef8895a61572800d5dbc0975b6b76562c2f8c2c72e42e426a

SHA512
43f58437a7ecdcb46f07dcbeb258e0e09c08c8ada7ca51cbd4ead42f09605acf54df220cc173100dcbe5702ffd23c84b3f5f9be9143cf1a9c380e589f42ad677

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
72KB

MD5
6316f2a8e04c1088957dea687d499bcc

SHA1
3f03ea641beff6beb6361d89ad2a50722fa5a231

SHA256
741d7c4027aa720c61f8a1efcbdb4644cf680f2c9806c95942ec769ae34414c8

SHA512
c0715bc4d3321a9459d495b4c94230a610dfe70ac7491630da8430ae1a5fe3a22ae3c27c2efeddffc5aed2e6f9b367f155c2d124c14b6dec40e29b54f21b224d

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
72KB

MD5
8457f0c0edd85dfa70ad070b72eb6c86

SHA1
98211bb5210928774c8fee59a174014959419a28

SHA256
bd5d22e76ca6e040a6e55cee32ac669205a8e1bd41616542d0351b4ac8606ff7

SHA512
01e00f833d8d285b439f2b7f3137fe83268e2fd30e83990c6e1d905cb108723b04f50a7a6b674a7add9c2aff15e4d0b2c1dd28591f84300976514544b2d187c7

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
72KB

MD5
82d12097c768dfa59c399198e1ca928c

SHA1
be17967537a9cb2cd9708fe5efb14c98e38c800d

SHA256
f2a803c42d10031b13ae34d0e0d9681f4a67f4d009c5acf84034d1d33d85bc2a

SHA512
f2612c9180ad91e07c1e604ca68d0a0632d982831d7376d81bfd692927b333e1939f1aef278969382dd90ad97dfa0f6e084af0b507426ef95fbb9ceb00044db8

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
72KB

MD5
b60a14170b5f4fbcf4d461c39d3c7535

SHA1
812d8e936470384c88651225d26a16771388d9d7

SHA256
2e64d50621bedb3677d1659f553c9999962408b8fa2f93a35361b4b67854fe9b

SHA512
0ed9a9844cc72df55b0a3da91bdce2f7736977129ed602018b00ceec2401924fa2237cb7e5d556a1f076d0cf45a21057fb155bdee025cb6d9ddd906634cc7b00

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
72KB

MD5
18f77484efde4924d1ce34f6dcc9d2c5

SHA1
972316c8109a15806ffc69950d53f6a9dfa3db73

SHA256
9c7075bcc8f9cd20504945814a8d6bff60045d77ab17767c638b2cd32464c85a

SHA512
68e865e39fe548a27a73caf21a19822ece1c811962c54894a93f9a59999273f58c209f49df1d67e3177d76ed41afcb7285342d925de7774b1b1b9f0f6340e5bd

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
72KB

MD5
749fe3d9f5d18f06703491ca802cff63

SHA1
02bdc0623e69f10be57480cf09213da61475630d

SHA256
6bf641688758fbceccf1a63fc555a4296e134446eabbded43d2e1fc844dd8a58

SHA512
eca4ab2240635ebdd86e8360059a28f2e0552252bc5c494c06e021c02e5f12c0a8c64fd60663cd6cf9639411132662ff75cac0c4dc7525dd403f6c6587e3e01a

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
72KB

MD5
2aafe6593b223eeeebf1782e034b66b0

SHA1
5c75d3e4d84e4c3f1d8390eee470c8320e439833

SHA256
da57268181527a59a67b9a5188eefc1565bc13e124146768d9be3cf105ede0c6

SHA512
ac165920d417ed5d72350f3feb9d5496bac7ab4c2d1b1a787edef64dfc719658adf6d9f656e1b19b7859eb5ad5cfb2f99e6c7821ae2763c7d634cd87623b4616

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
72KB

MD5
07bef99ad276c7be48ab7990bdaae1bf

SHA1
580775d22d7db9aca6f4eb263ed1a2fa7c1719ad

SHA256
3bc7c01a2956388f719dd9d57025131eaebb2e8827d0f0cd141e6b4a84941bd5

SHA512
433fadec3c564b1d379d490d3887f571e0ade2c2f1d0ba6cd39dd8489c8c6ec4bfc2a244d6bbd37efc6387ada4c7e05cdbfcc8e21ea5d4bed793a806d81016b1

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
72KB

MD5
17f1469e239827a78ae9867654d34a52

SHA1
e4f9da1071f1ff60e465156caee904c005f676d6

SHA256
0a8792ff8d5c485acfc7c65fdbfaa41505a6059c8580ef58201adf5384b22cf8

SHA512
c4da2e1ca9e4662a748bb3f6ccf2db9c0c80bb1bacc39349239b47492defcaf1cee850f6c4b7342adea6d9fb09b06a44a54efe4e1a8d1bedc4830b54440ce4fc

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
72KB

MD5
1c4d4424d8ca18d47d15c3665202bbb1

SHA1
bb681ba82b33f36ebaeb64cec0cbbcdbcb5925f0

SHA256
b7e6239f50f6bd4509e762ba9793ad25b1bdc341554f8a9a15ea8cba905f8362

SHA512
947841181823bea7e2d8f66c5f8133c171ad75aa87686f19088cdffc421764e59cdb88a37d0388d3c1316a6fb005a40affdc83f9c3e16b2801f32ea6a12df936

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
72KB

MD5
ea543344a593e267b5b23feb17506b08

SHA1
f045a3931c255c6703c7b0176353393eea39b16a

SHA256
c9de1102d663660454a74b8a7116cb3421f9b12343a5a871c98f5eb397baf4f9

SHA512
ff19606d4773794144dedbe1fd2d2592247bf8c585cd511b79f9fbf44e888f7fad1803c4b6273cf157934faf61fdfc5766a9fd910471aa710754a420d50dc3f3

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
72KB

MD5
dc01c8518aac2915b93c81e406205f82

SHA1
053d1fa2b7b487a0bb76a43fc80f322625769452

SHA256
824dc01f185ca64d5ca8c58f1d9c026bbe6138425e69b1208e2dd41ec512ace6

SHA512
6af116fa7aa457223e50faa6e6a2e4effd4fabd74a9ea94c1bafb0ce68a932892a56c358afdf9ba04a831f0c92151c2051f8ed7af6a99ccc155bb034b3970a20

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
72KB

MD5
20ae12cff326b7dec1224ea16f24fba4

SHA1
efb84ef390b0a74eb212bad78dff14f8df959cde

SHA256
7d24059ce6baa6bdf3b007b1f866b743ccc9a239fd02af4f8c0151c34316f15f

SHA512
7340c1c8cb29fdcd730b6316c3ecad38150241f0e98287f3864cd51812feb74e806473b568d48d9244e3d048d6624528ca66de2b4fed0d69ba5218e763ca87a6

Download Submit
C:\Windows\SysWOW64\Dpmdoo32.dll

Filesize
7KB

MD5
6ee12e4ca2b9e896b7fd8fcd0924830c

SHA1
d303b7c8dbf66c311d56df1b4b9be10fe4110669

SHA256
f7ae7855a9adc48790db416faff88eb427370e17aaacbf6143f89dcfb906b55c

SHA512
b47cd6189c2d754d804f561e394b5aec7e3058d6b3fe64e3c1817cef5e62aa08e12c112e09d2e685d98f85cd0fe264ce578c8be2d06b30abf17bdca30d8ff76d

Download Submit
memory/100-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-487-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-483-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/748-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/764-468-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/764-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/848-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/848-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-479-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1112-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1280-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1420-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1420-429-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-481-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1752-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1752-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2252-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2328-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2336-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2364-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2364-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2400-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2600-475-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2600-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2684-485-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2684-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2696-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2696-421-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2916-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2928-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3224-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3224-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-438-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3316-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3336-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3344-450-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3344-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3360-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3360-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3380-491-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3380-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3548-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3584-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3588-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3636-473-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3636-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3640-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3756-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3756-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-493-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3780-456-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3780-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3824-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3884-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3884-427-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3996-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-426-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-444-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-423-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4256-477-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4256-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4672-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4672-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4836-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-489-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads