6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
Size

93KB
MD5

dcb1ef98c7a06d1286620e0ebadefd5f
SHA1

6986fb5939e2cb9d78a259573437e1744eea0324
SHA256

6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86
SHA512

64e231bbf3bb1a5b6b8bad7d29ae8660078f922ee4ec672f77f055d7dde15f0111b73d3a28de792cad0437c7c90a1672a93ad2bae0b140d29ba6c57127e47456
SSDEEP

1536:XdEqzqsRkHX7lDOIx1rsDPav3Bid75YrrA1iKsRQjRkRLJzeLD9N0iQGRNQR8Ryn:tEqzqMkHX7xx1sqcddAtejSJdEN0s4Wg

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqpcjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oaplqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aajhndkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjmjdm32.exe

Executes dropped EXE 64 IoCs

pid	Process
4204	Njfkmphe.exe
3404	Nqpcjj32.exe
1688	Ncnofeof.exe
2236	Njhgbp32.exe
2060	Nqbpojnp.exe
396	Nfohgqlg.exe
4876	Nnfpinmi.exe
4520	Nadleilm.exe
4580	Nfaemp32.exe
840	Nnhmnn32.exe
4972	Npiiffqe.exe
3968	Omnjojpo.exe
3136	Ocgbld32.exe
4028	Onmfimga.exe
2464	Oakbehfe.exe
2524	Ojdgnn32.exe
1628	Oghghb32.exe
3632	Oaplqh32.exe
1536	Ofmdio32.exe
1804	Ojhpimhp.exe
3688	Oabhfg32.exe
1092	Pmiikh32.exe
4336	Pfandnla.exe
412	Pjmjdm32.exe
2420	Ppjbmc32.exe
816	Phajna32.exe
2912	Paiogf32.exe
4036	Pdhkcb32.exe
4836	Phfcipoo.exe
4492	Pnplfj32.exe
4980	Qhhpop32.exe
760	Qaqegecm.exe
4044	Qfmmplad.exe
1436	Qacameaj.exe
2756	Akkffkhk.exe
4904	Aphnnafb.exe
456	Aknbkjfh.exe
2960	Aagkhd32.exe
4288	Agdcpkll.exe
3868	Aajhndkb.exe
3368	Apmhiq32.exe
2136	Akblfj32.exe
2320	Amqhbe32.exe
4356	Agimkk32.exe
3524	Amcehdod.exe
3512	Bhhiemoj.exe
1568	Baannc32.exe
2356	Bmhocd32.exe
2452	Bmjkic32.exe
1832	Bddcenpi.exe
4692	Bnlhncgi.exe
4260	Cpmapodj.exe
4624	Chfegk32.exe
3424	Cpbjkn32.exe
2432	Caageq32.exe
1544	Ckjknfnh.exe
4412	Cdbpgl32.exe
4180	Cgqlcg32.exe
5064	Cnjdpaki.exe
3556	Dpiplm32.exe
1656	Dhphmj32.exe
4936	Dnmaea32.exe
3208	Ddgibkpc.exe
3320	Dgeenfog.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ojdgnn32.exe	Oakbehfe.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Nbgqin32.dll	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
File opened for modification	C:\Windows\SysWOW64\Pnplfj32.exe	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Aknbkjfh.exe
File opened for modification	C:\Windows\SysWOW64\Oakbehfe.exe	Onmfimga.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Agimkk32.exe
File created	C:\Windows\SysWOW64\Mnokgcbe.dll	Oghghb32.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Pmiikh32.exe
File opened for modification	C:\Windows\SysWOW64\Nfaemp32.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Pmpockdl.dll	Aknbkjfh.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Jcleff32.dll	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Jilpfgkh.dll	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Hehhjm32.dll	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Akblfj32.exe	Apmhiq32.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Pfandnla.exe	Pmiikh32.exe
File created	C:\Windows\SysWOW64\Amqhbe32.exe	Akblfj32.exe
File opened for modification	C:\Windows\SysWOW64\Cpbjkn32.exe	Chfegk32.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Qacameaj.exe
File created	C:\Windows\SysWOW64\Gikgni32.dll	Baannc32.exe
File created	C:\Windows\SysWOW64\Bnlhncgi.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Caageq32.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File opened for modification	C:\Windows\SysWOW64\Nnhmnn32.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Jcgmgn32.dll	Paiogf32.exe
File opened for modification	C:\Windows\SysWOW64\Agdcpkll.exe	Aagkhd32.exe
File opened for modification	C:\Windows\SysWOW64\Nadleilm.exe	Nnfpinmi.exe
File created	C:\Windows\SysWOW64\Nnhmnn32.exe	Nfaemp32.exe
File opened for modification	C:\Windows\SysWOW64\Onmfimga.exe	Ocgbld32.exe
File created	C:\Windows\SysWOW64\Aphnnafb.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Ckjknfnh.exe
File created	C:\Windows\SysWOW64\Jhpicj32.dll	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Ojdgnn32.exe	Oakbehfe.exe
File opened for modification	C:\Windows\SysWOW64\Qacameaj.exe	Qfmmplad.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Ehojko32.dll	Bddcenpi.exe
File opened for modification	C:\Windows\SysWOW64\Chfegk32.exe	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Pcmdgodo.dll	Caageq32.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Ckjknfnh.exe
File opened for modification	C:\Windows\SysWOW64\Qhhpop32.exe	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Qacameaj.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Nnfpinmi.exe	Nfohgqlg.exe
File opened for modification	C:\Windows\SysWOW64\Oghghb32.exe	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Qhhpop32.exe	Pnplfj32.exe
File opened for modification	C:\Windows\SysWOW64\Caageq32.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Ojhpimhp.exe	Ofmdio32.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Qacameaj.exe
File created	C:\Windows\SysWOW64\Lcccepbd.dll	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Hlohlk32.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Hcjnlmph.dll	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dgeenfog.exe
File opened for modification	C:\Windows\SysWOW64\Pfandnla.exe	Pmiikh32.exe
File opened for modification	C:\Windows\SysWOW64\Omnjojpo.exe	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Ofmdio32.exe	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Pjmjdm32.exe	Pfandnla.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	2544	WerFault.exe	159

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baannc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqpcjj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhpimhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agdcpkll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qaqegecm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqbpojnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfohgqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmjdm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfpinmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojdgnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppjbmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaplqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njhgbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnplfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phfcipoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnhmnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chfegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckjknfnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bddcenpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qacameaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdhkcb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgeenfog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgbld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oakbehfe.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcgmgn32.dll"	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gikgni32.dll"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagea32.dll"	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenpmnno.dll"	Ocgbld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hehhjm32.dll"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoigp32.dll"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcccepbd.dll"	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqojdee.dll"	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godcje32.dll"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmiadaea.dll"	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgjimp32.dll"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jponoqjl.dll"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqpcjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Qacameaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oaplqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Paiogf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgeaknci.dll"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oghghb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmijpchc.dll"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Caageq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4204	1708	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe	92
PID 1708 wrote to memory of 4204	1708	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe	92
PID 1708 wrote to memory of 4204	1708	6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe	92
PID 4204 wrote to memory of 3404	4204	Njfkmphe.exe	93
PID 4204 wrote to memory of 3404	4204	Njfkmphe.exe	93
PID 4204 wrote to memory of 3404	4204	Njfkmphe.exe	93
PID 3404 wrote to memory of 1688	3404	Nqpcjj32.exe	94
PID 3404 wrote to memory of 1688	3404	Nqpcjj32.exe	94
PID 3404 wrote to memory of 1688	3404	Nqpcjj32.exe	94
PID 1688 wrote to memory of 2236	1688	Ncnofeof.exe	95
PID 1688 wrote to memory of 2236	1688	Ncnofeof.exe	95
PID 1688 wrote to memory of 2236	1688	Ncnofeof.exe	95
PID 2236 wrote to memory of 2060	2236	Njhgbp32.exe	96
PID 2236 wrote to memory of 2060	2236	Njhgbp32.exe	96
PID 2236 wrote to memory of 2060	2236	Njhgbp32.exe	96
PID 2060 wrote to memory of 396	2060	Nqbpojnp.exe	97
PID 2060 wrote to memory of 396	2060	Nqbpojnp.exe	97
PID 2060 wrote to memory of 396	2060	Nqbpojnp.exe	97
PID 396 wrote to memory of 4876	396	Nfohgqlg.exe	98
PID 396 wrote to memory of 4876	396	Nfohgqlg.exe	98
PID 396 wrote to memory of 4876	396	Nfohgqlg.exe	98
PID 4876 wrote to memory of 4520	4876	Nnfpinmi.exe	100
PID 4876 wrote to memory of 4520	4876	Nnfpinmi.exe	100
PID 4876 wrote to memory of 4520	4876	Nnfpinmi.exe	100
PID 4520 wrote to memory of 4580	4520	Nadleilm.exe	101
PID 4520 wrote to memory of 4580	4520	Nadleilm.exe	101
PID 4520 wrote to memory of 4580	4520	Nadleilm.exe	101
PID 4580 wrote to memory of 840	4580	Nfaemp32.exe	102
PID 4580 wrote to memory of 840	4580	Nfaemp32.exe	102
PID 4580 wrote to memory of 840	4580	Nfaemp32.exe	102
PID 840 wrote to memory of 4972	840	Nnhmnn32.exe	104
PID 840 wrote to memory of 4972	840	Nnhmnn32.exe	104
PID 840 wrote to memory of 4972	840	Nnhmnn32.exe	104
PID 4972 wrote to memory of 3968	4972	Npiiffqe.exe	105
PID 4972 wrote to memory of 3968	4972	Npiiffqe.exe	105
PID 4972 wrote to memory of 3968	4972	Npiiffqe.exe	105
PID 3968 wrote to memory of 3136	3968	Omnjojpo.exe	106
PID 3968 wrote to memory of 3136	3968	Omnjojpo.exe	106
PID 3968 wrote to memory of 3136	3968	Omnjojpo.exe	106
PID 3136 wrote to memory of 4028	3136	Ocgbld32.exe	108
PID 3136 wrote to memory of 4028	3136	Ocgbld32.exe	108
PID 3136 wrote to memory of 4028	3136	Ocgbld32.exe	108
PID 4028 wrote to memory of 2464	4028	Onmfimga.exe	109
PID 4028 wrote to memory of 2464	4028	Onmfimga.exe	109
PID 4028 wrote to memory of 2464	4028	Onmfimga.exe	109
PID 2464 wrote to memory of 2524	2464	Oakbehfe.exe	110
PID 2464 wrote to memory of 2524	2464	Oakbehfe.exe	110
PID 2464 wrote to memory of 2524	2464	Oakbehfe.exe	110
PID 2524 wrote to memory of 1628	2524	Ojdgnn32.exe	111
PID 2524 wrote to memory of 1628	2524	Ojdgnn32.exe	111
PID 2524 wrote to memory of 1628	2524	Ojdgnn32.exe	111
PID 1628 wrote to memory of 3632	1628	Oghghb32.exe	112
PID 1628 wrote to memory of 3632	1628	Oghghb32.exe	112
PID 1628 wrote to memory of 3632	1628	Oghghb32.exe	112
PID 3632 wrote to memory of 1536	3632	Oaplqh32.exe	113
PID 3632 wrote to memory of 1536	3632	Oaplqh32.exe	113
PID 3632 wrote to memory of 1536	3632	Oaplqh32.exe	113
PID 1536 wrote to memory of 1804	1536	Ofmdio32.exe	114
PID 1536 wrote to memory of 1804	1536	Ofmdio32.exe	114
PID 1536 wrote to memory of 1804	1536	Ofmdio32.exe	114
PID 1804 wrote to memory of 3688	1804	Ojhpimhp.exe	115
PID 1804 wrote to memory of 3688	1804	Ojhpimhp.exe	115
PID 1804 wrote to memory of 3688	1804	Ojhpimhp.exe	115
PID 3688 wrote to memory of 1092	3688	Oabhfg32.exe	116

C:\Users\Admin\AppData\Local\Temp\6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe
"C:\Users\Admin\AppData\Local\Temp\6ec7959cbb1d8af913e76b9fbb54f5f71b12fdd7c82c3585db29669c21ec7e86.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\Njfkmphe.exe
  C:\Windows\system32\Njfkmphe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\Nqpcjj32.exe
    C:\Windows\system32\Nqpcjj32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\SysWOW64\Ncnofeof.exe
      C:\Windows\system32\Ncnofeof.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2236
      - C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:760
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4044
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2756
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:456
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4288
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3368
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4624
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5064
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1656
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 424
        67⤵
        Program crash
        
        PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2544 -ip 2544
1⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4164,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:8
1⤵
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bnlhncgi.exe

Filesize
93KB

MD5
ed3c807e4f3c75dad7d9f7b98fa944c5

SHA1
bb391ba3a411b89adbab7329f5d3716f54a04888

SHA256
ab7d95a51049cc7a16ec237815bf7198f6ccc6a8393a754b4661bfcfeb9f0440

SHA512
01b19c4801a5bd5258c50ba12f7cb619a62423d8dd446f9fee7b9eeac97306e8a514a9ac88e7023434262cdc999b91a54c3ea99fe2daea128cbf444dc5ab508a

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
93KB

MD5
026bc21722a3539639f642d4ded7a95f

SHA1
140df7df44fffa66f9f73305f1cbc02d62d2e061

SHA256
52d43a09abb01d86405e22439c441ba099f7306826b2409de1c0e883871e5e95

SHA512
6cd7a314ca31dd51a384a081babef58e7fee84b9f86d2495c0ba0d682abdd797b513e1e2956f30383f69bb503f5331f7d456611564fa07bf7159894d328937b6

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
93KB

MD5
3d69eee0d5c1a2943ddc80535b609f89

SHA1
d2f9187af4a24b128ffd4a7d8521a1a37f3f96d0

SHA256
8aa258c039dd2ffb15ecc2dd836f0734a4709a4ac157ec5714e7f0a6c1d145d2

SHA512
681fbce18b3ab67728df60397752f68b8440f2447a97196cdc51ccedf8f24ca78fe94d396dfa99b2bd4480a9cb74228619cf67c852f51eae16001b92c0274500

Download Submit
C:\Windows\SysWOW64\Ncnofeof.exe

Filesize
93KB

MD5
45e18a1564bcc711aa8e365818e26576

SHA1
333ff2aecb1a45a126d8cdfe80c45f86fee50158

SHA256
cb8609a6983025825f179b65ada22cd6f8ac0a93da2bf6f5a3adac56cf3d8026

SHA512
5c425b5adf4169a428f2065070794244b00f2343830f6ef283705cc288f1d35a841fcc57fc7dad695c547779e5cd1ec09033c195a6800a392da1a532079ffefb

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
93KB

MD5
7939d2111d655a3807be3747e659f9b2

SHA1
7e340b75c3bc275d3da58bab74ff528ecf30bb54

SHA256
82edfad15fd2e7265ca3f6e7907f92771ed9ffa8015829ba050b92770c0fcec9

SHA512
58eeee378820d52e9340bed5d0b5b2c64fee24a5a253aa28896e46550b92322f9969fc05440e7f09bbf1da17e1cee2f3859c46f4bc5be88d7595099fef5586ca

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
93KB

MD5
ff77e7a945da0de8a64868892cb868de

SHA1
6365dcb4718bee571239360f2f1832923c8b06df

SHA256
e270404b408c7de235aa305e7ad2a87348ac7014802a06cfaf3cf5e13b0e2cb8

SHA512
ab3e5007d5b24af0b4a02d8973022c1c5218610ca8c3e793bf3a67c466739d91b2ffe2e0c92ca4f2e59e9a811ac2a38c4a86c8c4035dbc2985c32ce997a2892d

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
93KB

MD5
e4f07bd498dfcc0fb6975f9e7550259e

SHA1
0e63834f6d3d500a73f409cbf1c2d1275c5cdd72

SHA256
16cb81c815022806446867d32bb62f23bce1be86bd971cf5d17bbd7fad2a8c51

SHA512
da7274e0d8e914a82153e7c6fa2a6602d7c8de2fa79bafc50266379e14a3533fe0888fa0b13b05db11d5ad7e31b449a0fbb273528e0e46a10e8a6ba2d4b23d19

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
93KB

MD5
66a4b197615a632edb7a2b5ce8d68285

SHA1
a14313f2f0485195dd1cc15e6c752a08396fa7d3

SHA256
1af37c65125561bd955bf8d00c851f38ba392cbc639ead7778cf2b8f152fa226

SHA512
cc529c775f9501d60ea7c17534d14d71cec63aa64bc18903bfacbd4e713d744175b2013dde13731eff574d53713104051c41713e8ed7d781ce1066dad2c2619d

Download Submit
C:\Windows\SysWOW64\Nmiadaea.dll

Filesize
7KB

MD5
b09798bf16eb03128109e1ff08e937ce

SHA1
4bc1e5b407520f304550200af425de382df72113

SHA256
6202e4b66622197d6e954623cab90185806c02da4d38c95d878dcf9b8d66e315

SHA512
ad86c166f5ee8854c8b1bc4baf3ef7ccdf3cb1e980ba17f7c62d2a9c9edf129bb07ad28afe460d5468592eacf8bada47d28f8baa4cc2dbd4cb18133168b89709

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
93KB

MD5
728f7201271d177c482475387e9627f5

SHA1
0bcfb17b2d05190b3fb45746ebc1fcdedc1be2a0

SHA256
23904bda5508242dfd34b51e52f53b821404ce6f14c382cba26a6b3af937947d

SHA512
17b55ddd469b88f196758f86c4d62fadebd1a0222332f569d2da25b237d7ce444c14cb3b78c4522aae9bce0db5839632521649e114d19ea93aede2fa63fbb3a7

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
93KB

MD5
fd1030b43942793e0fedb3f6d0857975

SHA1
5affdddd35c7c94681fbf6e4af6a88e1a54f357d

SHA256
af1eb99afec43c890e4629217adca526acd8232958785ccbc2aaf7dac7881ff1

SHA512
e4e8b2bb9d7e4eafbbeb44e08c52c8a7c6ccc5b734bd30acce018ba519db2a9f654aa46d6c8748b93585d109b97b6a1c9a27fdd5b6aa94c7c14ff2a647279294

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
93KB

MD5
b74e6768b2c41c22ac8b7e784c480968

SHA1
fddf3acb60d58eb37669b35b37902481c428440b

SHA256
74cb7f6d3880a9ff61baab9c12abf9057afb4d16f01dc31074df2fa9af002781

SHA512
9c0d0ed9d95fc2168da59b1000bd4c3ad3a1c58d0d313bfe21073cdbc92e97d3b9aca08faa7530d4cad03f47491244314b2297f670553762b70428cc1acddaae

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
93KB

MD5
71716f51e47e954a3334802114a6f622

SHA1
e3981739bec7624e0b46bfcffe5b61e179634ef6

SHA256
51030d6fd6acd8beba324b59fb5fd40951274e70707288d338cb543a114f79cd

SHA512
bdc439b5f43a7ab437a59bfff84aaaa973b3797cdcd76f808c88f49fc47f78e4c428b560fd7b06d202d9e9e6dfc7e0c7afecc39611737f85d4606370af248918

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
93KB

MD5
7cbc01818a392a70aceb84570c6851be

SHA1
c7a62add88a6e152dfb94cd2f211baca131531b8

SHA256
32c8761eed478b391a55ba7f5313778a4bb848601b6241a6b664a83f3ee81b14

SHA512
c09e1caa2d0703528e4f6cd53780c188a954637af9c411cbae1002713a977cf232b4025b1924b993abe65b23bbc876b679c34ae8cf910efc66f3048edb310ce5

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
93KB

MD5
2095e765d5469b4b1e0c3c6732f19e7d

SHA1
a37d0e431afa17a6d572f44103a9a345379240f1

SHA256
e058a63900be89435f56e512b4c72c0988553256400bd61e56d2462906358837

SHA512
487898ec23cc4ff48fb66bb3c8061c73796e7ee321db59da2232ebe4f2812bc06e82cc7f13683e651ca5eb7a4bcaf410cef6e495a4b5221f6ca435fca1853654

Download Submit
C:\Windows\SysWOW64\Oakbehfe.exe

Filesize
93KB

MD5
f659542c14a22b717e755b7f2cef2b0b

SHA1
a74a2d9ce01611f197536160b9ad771f843aeeb3

SHA256
4e749d9c71965e21951204dec3ed40be0564c2268e99a33bd046f4292278b352

SHA512
e61aeda8ec66aafa1ba9dd9e8350e32c14940d3b1a5c3e92d05a3ab5f1d4f92df9ef9f15f59b119a46572fbdc564b569e2e2bed84ed9b53fb5b83e675e1a84ad

Download Submit
C:\Windows\SysWOW64\Oaplqh32.exe

Filesize
93KB

MD5
9ed4f33928c1348ce57757cc92e8ef8b

SHA1
8c9e8738ee4bc715a16fb837d6545d8db95cb4c6

SHA256
bf1c7e45d437a42b90503138a134ead3fc71e51d21201feb2e56c892a7031197

SHA512
a2c7366f51910690c49b017dd4da8ed14be348872bebf1149491e92becabee2e3573036f92c8f524df4a9e7646b5c3aab048d0a84119704b5a2bb0523563ee3e

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
93KB

MD5
91bbcc822162b1751604a53f451968ce

SHA1
7e58a27f4f965addbeba16fadbafe18198b07c0b

SHA256
eb6b9bf2e33f9f9ac4961d8615bde8e66db9005a2b8e3bbb39e012be774a3efb

SHA512
a86ef4e4ebb91cbf2279f8608ae6125680c28915d3beadd6ba2e912b197477ffd9c7b1d4e1e798fce1879dc90cfecb0bea08bce2093fdde57454f031465f22db

Download Submit
C:\Windows\SysWOW64\Ofmdio32.exe

Filesize
93KB

MD5
c3c124e431e4c66eebaf97f6f149cef0

SHA1
8a44108d147a2bc3049aa99b023a0c4ecc65f58f

SHA256
ee2d2252e3571f8aadf103e68d22628adc6358f6a059812b34bb41acde74670a

SHA512
1b7cf570058e06ec020e50ea1d5135ef7df9e9f7338acb218a90bba5e7d965b5f27ed7cd6e2a3d883dda29ba1d2cbfcad8414c64f9fe2b0086d699108542309e

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
93KB

MD5
843ece151eb4f42398b63937ff7ee8b2

SHA1
6e4f0863146c5ff0b2df7e539686256329b98063

SHA256
f79de5df47dc187d771c2b201026c55b7a39b6061f27bf1860379c1f8d731476

SHA512
7dcc5504792153c5ed232efa09c58f467b893f71ecb45b7a088693459eca2371e3ef5df1fd4d43876f90fdaae6cc5b81a7ea6c3d863e82538bface9ce3450a7d

Download Submit
C:\Windows\SysWOW64\Ojdgnn32.exe

Filesize
93KB

MD5
9445555f1e45af7e6404e7e2063e4c34

SHA1
f9e70e8b4e018121fd95386725bcaefe7b759394

SHA256
8eb27a82d4f04af1f311c8e4c7a037cde81575bd65561f2266eb068d33aae976

SHA512
5e8f5f82a6db76529da334bd82323c97f1843b1c20037b49cb507b3c5debf3100080dd0f681a7066232f7559f3efc243abbb05474348521f591be1e3feffcb46

Download Submit
C:\Windows\SysWOW64\Ojhpimhp.exe

Filesize
93KB

MD5
4f1cd4be72fe5373eb2c2dc760488221

SHA1
a7de3a713fab9ba78afde18df7ebd0c10348d649

SHA256
d97dc208b688792151b2163e4a00ada35dad957b71ae46651506b11ba69325e9

SHA512
149a078066dbc44ca6af4309995b239d3f788e9d635594f39733adb59d632a56f11b18ed26ac71981c7b54c5a19d57b809a7ed154bf2e1210d5f7ac854b0da9d

Download Submit
C:\Windows\SysWOW64\Omnjojpo.exe

Filesize
93KB

MD5
2d1b3729f456df6d165c9d854961c5e2

SHA1
550c0a5a37702a31be5dfb42e02f31f969759a3c

SHA256
2955aba5c2751b1173086dce28804961ca5a7a1d23b2f24d55451926c1528aae

SHA512
3ccdcabf8e2c59d9b1cb13ec9ca968a5460633671f74efb2e61c4d5bf2221bd849745d7970dc1a56e781fb457d6decfe2ddf2666466a87e2a9abc3b450fe981f

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
93KB

MD5
30829842f102031578970d299c5849e2

SHA1
c7e1b807d635aaffb8d15d164e965891d5cc6dfc

SHA256
9add225b77ccc44afb0a72b6b3c24abdcbe312ebdc263e65a988462b7cf93b30

SHA512
7a4cacbaa1a3831d0f4fab27e524e70b0be568ccebd7001e2e89f94f1b0e0b91db3170a999606c57f382d410951d1eef199989d7524aafd48119b31fac770c65

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
93KB

MD5
e0fbd774668277bd7332b35003c1576c

SHA1
b4d69458d4d9a00dbf9b1932c9fe7ff97f214679

SHA256
ee219d9e7c3efbc9f63a5b8d95cb06e20094d3635fd2877b34ae0ad36a99b08d

SHA512
fe0712c0012a963dad33103ad5f236f6b535b1bbda8c3dc43f20f88992f6c181e25d398dca45c0b7d46d06ea4968128fe0369ff3f75e66ccb6e34060c29f4c79

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
93KB

MD5
745629a652b1535c7fdaff2506ab614a

SHA1
db24983b640683e153462e8962041f9a9410e10c

SHA256
7531b8c446738ab5cba99e14be4012e4f565664c657ca4f0f5c514f41256e22c

SHA512
489b41cbd2d09fa693937b88a5892284948ddf4f05cdc35cddc49e9d7b831f1e25480fb7ff47450ffb40f7eeb46b3a9176cff1f498f6fc67b93422de0390ed03

Download Submit
C:\Windows\SysWOW64\Pfandnla.exe

Filesize
93KB

MD5
d5aa9a26d253fa002e22e4bc24a88b37

SHA1
f2cc1e10c20200c6934e17b985859ca3607ff08c

SHA256
7c11739af7ad7b2ce6ce03ff691d25e494b4ef2fb1b78f82faa16fe272bc124d

SHA512
8b543354a16c6625c72fa72c2003a9de3afd8c9155a9ee2a700cade10475b4d64b76769e138fee4c3d7df44c04c36c97c85dbb32511ca58e42c2a8dc6b119804

Download Submit
C:\Windows\SysWOW64\Phajna32.exe

Filesize
93KB

MD5
b83c5070fd68e242e3cfd97b614ff923

SHA1
d195f8c22b08cb99bfbf89d5b44cbb13049fbf82

SHA256
996cc324c879c28618e01cd4d5864d90f8623e01a6095e7ecc474313e28f2921

SHA512
c469ee3c3358fd6434dc27cd83f3331d0f6d4e45e6ab95d84b1c52f7203d6d33f23f44b9a4fcb4c1602c6b87585e572bdb5dcc5068931c7cebb90244e3ee9019

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
93KB

MD5
06f3f8bf8071eca7f88815bf0b74f672

SHA1
7f899cc510ec57061f43d836051900051d793ac5

SHA256
a35e47d07d41c8617e39b42b668cde2c7c0440293ff80ec06d8c41aefcd516a0

SHA512
7ba369baed016b176626514ff4d97779e34745063fb5fe3c552d6e36785f8fcc581e033abe1fe85a4c20176537589850fafe731d03eaabc5e22b38d9e7edb99b

Download Submit
C:\Windows\SysWOW64\Pjmjdm32.exe

Filesize
93KB

MD5
b70a125091c3bdddf9fc34f96e77ba26

SHA1
86276e2a395e0482cb01336f493dff3f70e44b27

SHA256
b27335f8ee3e653993b29361e294c334eafb789760007ed447d3502e5749fa3e

SHA512
3515d6ad3267fc87ee08f29665e3bd83af70e155a07603191b0e69130428c95cbed0dcb742a10c09cc9e50c89d24d4d86f27d232d5976ea6ac064b59df85301e

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
93KB

MD5
9a0d6e209d17f0d1297b481f1a7314c9

SHA1
39c6f3b9f82b3979c0b39c3235edab139e141472

SHA256
146af031855067a3b0bdf1f24fd5318950fddc97e7bf5b5abf586ecdeb8f624a

SHA512
7b9a375535225d10c65e3b23fef4ce168416117b1bea6fe58485545be1336c0329671c7f1a1d535f11458274d4a215a96b89921c21d72d1ca808efacfee5cd04

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
93KB

MD5
a876383414cd22c14562d15301514c52

SHA1
e7676fffca7299456f473b7945128793f65cc426

SHA256
e84b06a315b91425a3b0fdc7877e04b11cfe36f21edf65edf058fd619309475b

SHA512
7829a3cde5d476bdee3217966aa54be13e8d62ecf8d94a3301e95a41e7501f5f6c982a72191450c36a68ea16d10884778c72cf1031d2509bd5346198286fb33e

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
93KB

MD5
58044acd817fdb4e22ed9585ce501cac

SHA1
521e4d81dd52ebb55e1c41c223eb73135eb2ee27

SHA256
37f06e7dba78c3e630e584e1177c0231de324fc28395ba524dadf864f526ac0a

SHA512
eff139f82fb3874abcb36610debfec78547013821f6361fcc4cdb70cf1ac7b280f2a5285e76e121c3fc5db5e5a2477954adffebfd6e1d7c798d2ba48e9b25ced

Download Submit
C:\Windows\SysWOW64\Qacameaj.exe

Filesize
93KB

MD5
db5f405aeb70f0106eedfe3e8d7c30ac

SHA1
78211941b0bb9fe3f983804c1a8e64a4a2f474d8

SHA256
38cc96281516f6459876cd2b2b6bc5ada56999d3bfd3f77981ed0f0fc777ef4e

SHA512
1c50f0ab02f19b0e54a470fba02aada158a41b3d67b202447c684d6c030bee6805b2acd19ac5049d49631d93cb001f8fc148bab0d699d371063ce18755ec0525

Download Submit
C:\Windows\SysWOW64\Qaqegecm.exe

Filesize
93KB

MD5
c96f294a769127d3ea3faacea24e189c

SHA1
9691e947fc3c8cd5cbac8488f43b6b0fefb2ebe9

SHA256
21645be0e16130980eadee3cb6c386486490a00419b8541e5ac2de703ed27fe6

SHA512
f01d64166ecf961317faed850b4f396ac4a9663b659f64dc2c5271f35a7be0d5c06ab03f261f30acf76edd1e9f7c7ded4758d9fbe0d00b49173e36c43b022b05

Download Submit
C:\Windows\SysWOW64\Qhhpop32.exe

Filesize
93KB

MD5
5a80ace9f6b77c86edc97ed044529e05

SHA1
2313080518a05e2917ba798d2c7caf0e4e2796e6

SHA256
c646590e99a576b081cc458971fd4a23a5d8569fe2451f3cb615a60f71f1eae7

SHA512
984da8e6d49aaf04d98e4f26f659cfa0f35c27e0e0123901f469d97d3b378b13a73db551324fea34db7c70f3a54066ef7a8016d5202f0f1ced66b22b4ab2bff7

Download Submit
memory/396-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/412-206-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/412-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/456-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/456-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/760-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/760-277-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/816-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/816-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/840-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/840-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-188-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-361-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1536-166-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1568-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-236-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-143-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1688-107-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1688-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1804-171-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1804-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1832-404-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2060-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2060-124-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-417-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2236-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2236-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2320-355-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2320-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2356-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2420-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2420-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2452-397-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2464-126-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2464-215-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2524-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2524-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2756-368-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2756-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2912-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2912-237-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-320-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3136-197-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3136-108-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3368-410-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3368-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3404-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3404-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3512-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3524-369-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3632-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-267-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-180-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3868-403-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3868-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-99-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-187-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4028-116-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4028-205-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-319-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-285-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4260-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4288-327-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4288-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4336-198-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4336-284-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4356-362-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-333-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-259-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4520-151-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4580-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4580-165-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4692-411-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-326-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-250-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-142-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4904-375-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4904-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-179-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads