eeb849e34b17f0950f8603d5f4ca7ea19c9b933c3b9492733dee4839c760c2d0

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e29e112cdc021a4d1aea071f7342890N.exe
Size

89KB
MD5

0e29e112cdc021a4d1aea071f7342890
SHA1

d1fe874c954c6c98c6cd4ed4e40cf03fad73f20f
SHA256

eeb849e34b17f0950f8603d5f4ca7ea19c9b933c3b9492733dee4839c760c2d0
SHA512

e6beb4df94950b643e3a64f5054187f91fc152807726f0ec9e5204c7f57c5d98496fd6ebb7b09f282fd4d917e0172468eaad0bbe8bd1a8f367640a2c466c87b6
SSDEEP

1536:Tyq3rImICeaSwGryegvfo+/PVBuW3fsnoZjxHm25Y78KUNN7c9qcwplExkg8Fk:Tyq3rIDeSwGrggkCgKUN5Jculakgwk

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmbgfkje.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocphf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cebeem32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgaaah32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	0e29e112cdc021a4d1aea071f7342890N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bieopm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cocphf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgoelh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegoqlof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchfhfeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgoelh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceebklai.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmnnkl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgaaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbffoabe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceebklai.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmnnkl32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchfhfeh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfioia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfioia32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmpce32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbblda32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	0e29e112cdc021a4d1aea071f7342890N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbblda32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bieopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boogmgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbffoabe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boogmgkl.exe

Executes dropped EXE 22 IoCs

pid	Process
1200	Bmnnkl32.exe
2308	Bchfhfeh.exe
856	Bieopm32.exe
2816	Boogmgkl.exe
2840	Bfioia32.exe
2764	Bmbgfkje.exe
2568	Ccmpce32.exe
1464	Cenljmgq.exe
400	Cocphf32.exe
1744	Cbblda32.exe
684	Cgoelh32.exe
1052	Cpfmmf32.exe
280	Cebeem32.exe
3028	Cgaaah32.exe
860	Cbffoabe.exe
2064	Ceebklai.exe
1624	Clojhf32.exe
1384	Cmpgpond.exe
1312	Cegoqlof.exe
1088	Cgfkmgnj.exe
1812	Dmbcen32.exe
1712	Dpapaj32.exe

Loads dropped DLL 47 IoCs

pid	Process
2468	0e29e112cdc021a4d1aea071f7342890N.exe
2468	0e29e112cdc021a4d1aea071f7342890N.exe
1200	Bmnnkl32.exe
1200	Bmnnkl32.exe
2308	Bchfhfeh.exe
2308	Bchfhfeh.exe
856	Bieopm32.exe
856	Bieopm32.exe
2816	Boogmgkl.exe
2816	Boogmgkl.exe
2840	Bfioia32.exe
2840	Bfioia32.exe
2764	Bmbgfkje.exe
2764	Bmbgfkje.exe
2568	Ccmpce32.exe
2568	Ccmpce32.exe
1464	Cenljmgq.exe
1464	Cenljmgq.exe
400	Cocphf32.exe
400	Cocphf32.exe
1744	Cbblda32.exe
1744	Cbblda32.exe
684	Cgoelh32.exe
684	Cgoelh32.exe
1052	Cpfmmf32.exe
1052	Cpfmmf32.exe
280	Cebeem32.exe
280	Cebeem32.exe
3028	Cgaaah32.exe
3028	Cgaaah32.exe
860	Cbffoabe.exe
860	Cbffoabe.exe
2064	Ceebklai.exe
2064	Ceebklai.exe
1624	Clojhf32.exe
1624	Clojhf32.exe
1384	Cmpgpond.exe
1384	Cmpgpond.exe
1312	Cegoqlof.exe
1312	Cegoqlof.exe
1088	Cgfkmgnj.exe
1088	Cgfkmgnj.exe
1812	Dmbcen32.exe
1812	Dmbcen32.exe
1492	WerFault.exe
1492	WerFault.exe
1492	WerFault.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nefamd32.dll	Cgoelh32.exe
File opened for modification	C:\Windows\SysWOW64\Ceebklai.exe	Cbffoabe.exe
File created	C:\Windows\SysWOW64\Dmbcen32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Bmnnkl32.exe	0e29e112cdc021a4d1aea071f7342890N.exe
File opened for modification	C:\Windows\SysWOW64\Bchfhfeh.exe	Bmnnkl32.exe
File created	C:\Windows\SysWOW64\Aqpmpahd.dll	Cenljmgq.exe
File created	C:\Windows\SysWOW64\Nloone32.dll	Cmpgpond.exe
File created	C:\Windows\SysWOW64\Kgloog32.dll	Cbffoabe.exe
File opened for modification	C:\Windows\SysWOW64\Bfioia32.exe	Boogmgkl.exe
File opened for modification	C:\Windows\SysWOW64\Cpfmmf32.exe	Cgoelh32.exe
File opened for modification	C:\Windows\SysWOW64\Cgaaah32.exe	Cebeem32.exe
File created	C:\Windows\SysWOW64\Fikbiheg.dll	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Bmnnkl32.exe	0e29e112cdc021a4d1aea071f7342890N.exe
File created	C:\Windows\SysWOW64\Lbhnia32.dll	Bfioia32.exe
File opened for modification	C:\Windows\SysWOW64\Cbblda32.exe	Cocphf32.exe
File opened for modification	C:\Windows\SysWOW64\Cebeem32.exe	Cpfmmf32.exe
File opened for modification	C:\Windows\SysWOW64\Cbffoabe.exe	Cgaaah32.exe
File created	C:\Windows\SysWOW64\Cegoqlof.exe	Cmpgpond.exe
File opened for modification	C:\Windows\SysWOW64\Bieopm32.exe	Bchfhfeh.exe
File created	C:\Windows\SysWOW64\Jpebhied.dll	Bchfhfeh.exe
File opened for modification	C:\Windows\SysWOW64\Cenljmgq.exe	Ccmpce32.exe
File opened for modification	C:\Windows\SysWOW64\Cocphf32.exe	Cenljmgq.exe
File created	C:\Windows\SysWOW64\Ednoihel.dll	Cocphf32.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Ibcihh32.dll	Bieopm32.exe
File created	C:\Windows\SysWOW64\Bchfhfeh.exe	Bmnnkl32.exe
File created	C:\Windows\SysWOW64\Jidmcq32.dll	Cbblda32.exe
File created	C:\Windows\SysWOW64\Cpfmmf32.exe	Cgoelh32.exe
File created	C:\Windows\SysWOW64\Hbocphim.dll	Cgaaah32.exe
File created	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File created	C:\Windows\SysWOW64\Godonkii.dll	0e29e112cdc021a4d1aea071f7342890N.exe
File opened for modification	C:\Windows\SysWOW64\Cgoelh32.exe	Cbblda32.exe
File created	C:\Windows\SysWOW64\Fnbkfl32.dll	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Efeckm32.dll	Ceebklai.exe
File created	C:\Windows\SysWOW64\Cpmahlfd.dll	Cegoqlof.exe
File created	C:\Windows\SysWOW64\Gmkame32.dll	Bmnnkl32.exe
File created	C:\Windows\SysWOW64\Boogmgkl.exe	Bieopm32.exe
File opened for modification	C:\Windows\SysWOW64\Boogmgkl.exe	Bieopm32.exe
File created	C:\Windows\SysWOW64\Bfioia32.exe	Boogmgkl.exe
File created	C:\Windows\SysWOW64\Cmpgpond.exe	Clojhf32.exe
File created	C:\Windows\SysWOW64\Pcaibd32.dll	Clojhf32.exe
File opened for modification	C:\Windows\SysWOW64\Cegoqlof.exe	Cmpgpond.exe
File opened for modification	C:\Windows\SysWOW64\Dmbcen32.exe	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Lloeec32.dll	Boogmgkl.exe
File created	C:\Windows\SysWOW64\Bmbgfkje.exe	Bfioia32.exe
File created	C:\Windows\SysWOW64\Cbffoabe.exe	Cgaaah32.exe
File opened for modification	C:\Windows\SysWOW64\Clojhf32.exe	Ceebklai.exe
File created	C:\Windows\SysWOW64\Cgfkmgnj.exe	Cegoqlof.exe
File created	C:\Windows\SysWOW64\Cebeem32.exe	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Ccmpce32.exe	Bmbgfkje.exe
File opened for modification	C:\Windows\SysWOW64\Ccmpce32.exe	Bmbgfkje.exe
File created	C:\Windows\SysWOW64\Aaddfb32.dll	Ccmpce32.exe
File created	C:\Windows\SysWOW64\Cocphf32.exe	Cenljmgq.exe
File created	C:\Windows\SysWOW64\Cgaaah32.exe	Cebeem32.exe
File created	C:\Windows\SysWOW64\Clojhf32.exe	Ceebklai.exe
File created	C:\Windows\SysWOW64\Bieopm32.exe	Bchfhfeh.exe
File opened for modification	C:\Windows\SysWOW64\Bmbgfkje.exe	Bfioia32.exe
File created	C:\Windows\SysWOW64\Kaqnpc32.dll	Cebeem32.exe
File opened for modification	C:\Windows\SysWOW64\Cmpgpond.exe	Clojhf32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Fchook32.dll	Bmbgfkje.exe
File created	C:\Windows\SysWOW64\Cenljmgq.exe	Ccmpce32.exe
File created	C:\Windows\SysWOW64\Cbblda32.exe	Cocphf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1712	WerFault.exe	52

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmnnkl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bieopm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbblda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgfkmgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0e29e112cdc021a4d1aea071f7342890N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocphf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgoelh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cebeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgaaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceebklai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clojhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccmpce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfioia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbgfkje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenljmgq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbffoabe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegoqlof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boogmgkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpgpond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchfhfeh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	0e29e112cdc021a4d1aea071f7342890N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfioia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbblda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nloone32.dll"	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bieopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jidmcq32.dll"	Cbblda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpmahlfd.dll"	Cegoqlof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmnnkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bchfhfeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfioia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegoqlof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cenljmgq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmnnkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmbgfkje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgloog32.dll"	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikbiheg.dll"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmpgpond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpebhied.dll"	Bchfhfeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqpmpahd.dll"	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcaibd32.dll"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmpgpond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	0e29e112cdc021a4d1aea071f7342890N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchook32.dll"	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nefamd32.dll"	Cgoelh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgaaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeckm32.dll"	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godonkii.dll"	0e29e112cdc021a4d1aea071f7342890N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Boogmgkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaddfb32.dll"	Ccmpce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbblda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bchfhfeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhnia32.dll"	Bfioia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbocphim.dll"	Cgaaah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clojhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbffoabe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	0e29e112cdc021a4d1aea071f7342890N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcihh32.dll"	Bieopm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boogmgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ednoihel.dll"	Cocphf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgoelh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	0e29e112cdc021a4d1aea071f7342890N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	0e29e112cdc021a4d1aea071f7342890N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmkame32.dll"	Bmnnkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cocphf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgoelh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpfmmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaqnpc32.dll"	Cebeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lloeec32.dll"	Boogmgkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bieopm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cocphf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1200	2468	0e29e112cdc021a4d1aea071f7342890N.exe	31
PID 2468 wrote to memory of 1200	2468	0e29e112cdc021a4d1aea071f7342890N.exe	31
PID 2468 wrote to memory of 1200	2468	0e29e112cdc021a4d1aea071f7342890N.exe	31
PID 2468 wrote to memory of 1200	2468	0e29e112cdc021a4d1aea071f7342890N.exe	31
PID 1200 wrote to memory of 2308	1200	Bmnnkl32.exe	32
PID 1200 wrote to memory of 2308	1200	Bmnnkl32.exe	32
PID 1200 wrote to memory of 2308	1200	Bmnnkl32.exe	32
PID 1200 wrote to memory of 2308	1200	Bmnnkl32.exe	32
PID 2308 wrote to memory of 856	2308	Bchfhfeh.exe	33
PID 2308 wrote to memory of 856	2308	Bchfhfeh.exe	33
PID 2308 wrote to memory of 856	2308	Bchfhfeh.exe	33
PID 2308 wrote to memory of 856	2308	Bchfhfeh.exe	33
PID 856 wrote to memory of 2816	856	Bieopm32.exe	34
PID 856 wrote to memory of 2816	856	Bieopm32.exe	34
PID 856 wrote to memory of 2816	856	Bieopm32.exe	34
PID 856 wrote to memory of 2816	856	Bieopm32.exe	34
PID 2816 wrote to memory of 2840	2816	Boogmgkl.exe	35
PID 2816 wrote to memory of 2840	2816	Boogmgkl.exe	35
PID 2816 wrote to memory of 2840	2816	Boogmgkl.exe	35
PID 2816 wrote to memory of 2840	2816	Boogmgkl.exe	35
PID 2840 wrote to memory of 2764	2840	Bfioia32.exe	36
PID 2840 wrote to memory of 2764	2840	Bfioia32.exe	36
PID 2840 wrote to memory of 2764	2840	Bfioia32.exe	36
PID 2840 wrote to memory of 2764	2840	Bfioia32.exe	36
PID 2764 wrote to memory of 2568	2764	Bmbgfkje.exe	37
PID 2764 wrote to memory of 2568	2764	Bmbgfkje.exe	37
PID 2764 wrote to memory of 2568	2764	Bmbgfkje.exe	37
PID 2764 wrote to memory of 2568	2764	Bmbgfkje.exe	37
PID 2568 wrote to memory of 1464	2568	Ccmpce32.exe	38
PID 2568 wrote to memory of 1464	2568	Ccmpce32.exe	38
PID 2568 wrote to memory of 1464	2568	Ccmpce32.exe	38
PID 2568 wrote to memory of 1464	2568	Ccmpce32.exe	38
PID 1464 wrote to memory of 400	1464	Cenljmgq.exe	39
PID 1464 wrote to memory of 400	1464	Cenljmgq.exe	39
PID 1464 wrote to memory of 400	1464	Cenljmgq.exe	39
PID 1464 wrote to memory of 400	1464	Cenljmgq.exe	39
PID 400 wrote to memory of 1744	400	Cocphf32.exe	40
PID 400 wrote to memory of 1744	400	Cocphf32.exe	40
PID 400 wrote to memory of 1744	400	Cocphf32.exe	40
PID 400 wrote to memory of 1744	400	Cocphf32.exe	40
PID 1744 wrote to memory of 684	1744	Cbblda32.exe	41
PID 1744 wrote to memory of 684	1744	Cbblda32.exe	41
PID 1744 wrote to memory of 684	1744	Cbblda32.exe	41
PID 1744 wrote to memory of 684	1744	Cbblda32.exe	41
PID 684 wrote to memory of 1052	684	Cgoelh32.exe	42
PID 684 wrote to memory of 1052	684	Cgoelh32.exe	42
PID 684 wrote to memory of 1052	684	Cgoelh32.exe	42
PID 684 wrote to memory of 1052	684	Cgoelh32.exe	42
PID 1052 wrote to memory of 280	1052	Cpfmmf32.exe	43
PID 1052 wrote to memory of 280	1052	Cpfmmf32.exe	43
PID 1052 wrote to memory of 280	1052	Cpfmmf32.exe	43
PID 1052 wrote to memory of 280	1052	Cpfmmf32.exe	43
PID 280 wrote to memory of 3028	280	Cebeem32.exe	44
PID 280 wrote to memory of 3028	280	Cebeem32.exe	44
PID 280 wrote to memory of 3028	280	Cebeem32.exe	44
PID 280 wrote to memory of 3028	280	Cebeem32.exe	44
PID 3028 wrote to memory of 860	3028	Cgaaah32.exe	45
PID 3028 wrote to memory of 860	3028	Cgaaah32.exe	45
PID 3028 wrote to memory of 860	3028	Cgaaah32.exe	45
PID 3028 wrote to memory of 860	3028	Cgaaah32.exe	45
PID 860 wrote to memory of 2064	860	Cbffoabe.exe	46
PID 860 wrote to memory of 2064	860	Cbffoabe.exe	46
PID 860 wrote to memory of 2064	860	Cbffoabe.exe	46
PID 860 wrote to memory of 2064	860	Cbffoabe.exe	46

C:\Users\Admin\AppData\Local\Temp\0e29e112cdc021a4d1aea071f7342890N.exe
"C:\Users\Admin\AppData\Local\Temp\0e29e112cdc021a4d1aea071f7342890N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\Bmnnkl32.exe
  C:\Windows\system32\Bmnnkl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\Bchfhfeh.exe
    C:\Windows\system32\Bchfhfeh.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\Bieopm32.exe
      C:\Windows\system32\Bieopm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Windows\SysWOW64\Boogmgkl.exe
        
        C:\Windows\system32\Boogmgkl.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\SysWOW64\Bfioia32.exe
        
        C:\Windows\system32\Bfioia32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\Bmbgfkje.exe
        
        C:\Windows\system32\Bmbgfkje.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Ccmpce32.exe
        
        C:\Windows\system32\Ccmpce32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Cenljmgq.exe
        
        C:\Windows\system32\Cenljmgq.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Cocphf32.exe
        
        C:\Windows\system32\Cocphf32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Cbblda32.exe
        
        C:\Windows\system32\Cbblda32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Cgoelh32.exe
        
        C:\Windows\system32\Cgoelh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Cpfmmf32.exe
        
        C:\Windows\system32\Cpfmmf32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Cebeem32.exe
        
        C:\Windows\system32\Cebeem32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:280
        
        C:\Windows\SysWOW64\Cgaaah32.exe
        
        C:\Windows\system32\Cgaaah32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Cbffoabe.exe
        
        C:\Windows\system32\Cbffoabe.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\SysWOW64\Ceebklai.exe
        
        C:\Windows\system32\Ceebklai.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Clojhf32.exe
        
        C:\Windows\system32\Clojhf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Cmpgpond.exe
        
        C:\Windows\system32\Cmpgpond.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Cegoqlof.exe
        
        C:\Windows\system32\Cegoqlof.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Cgfkmgnj.exe
        
        C:\Windows\system32\Cgfkmgnj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Dmbcen32.exe
        
        C:\Windows\system32\Dmbcen32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 144
        24⤵
        Loads dropped DLL
        Program crash
        
        PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bchfhfeh.exe

Filesize
89KB

MD5
cfd8fe8a55c06bc00a28882b38858521

SHA1
d21fc0507bcf8ed7bf8e193bfe53394e12e4e41a

SHA256
a5abc47088b9834641df3b0f8379530b64ca3684823565ce4a846e8c8ec49b36

SHA512
a47ea5d2420e484561f7dd75ab09f3c139331da8fc165eb69cbcfbe9a16296771226579545f22bffb822c022a46c9ac068caa391e667910497033d3e6ea97241

Download Submit
C:\Windows\SysWOW64\Cegoqlof.exe

Filesize
89KB

MD5
1942966e00ea7faf0166f096251b8fad

SHA1
eb7477d3c9826050f7ccfbc01cddc07d1684261a

SHA256
b8399350214372616cdee696a8acaf93e58fabcae87faccfef1808aad4020cd3

SHA512
a0f630d57bb2fc9deca9d1690eaf79b6460cd7f3a6cba6916ac67d39d54b2a59dfc5a464a61d63d8fc8e7dc3bb1e0e4ed2f4f402ffb8cd0508e92378ad89bc49

Download Submit
C:\Windows\SysWOW64\Cenljmgq.exe

Filesize
89KB

MD5
2ea314cf795e98ad1984fc7c2f402479

SHA1
add1ef12af37dfcf72a21419bc2d60d641ceb8ff

SHA256
4d0630261f5afcad964c311bd7208b9bac6ce8125eeb58e5296bab3e77e9b2ef

SHA512
8191accea1fce6061ee371bef60ed9b005284aa150a8bebacff948e71670a80c5607c4632bc339d7a586b5902aff3d081953c4b5225705ac6d3ff6d2ab87825e

Download Submit
C:\Windows\SysWOW64\Cgaaah32.exe

Filesize
89KB

MD5
b207fa2bb714b902c9156a2cdeac9334

SHA1
54e046aa4769714995351e719bf773ff3d74ca65

SHA256
7b3561741a47ae561ce00e4834e33ad2810fdb5ccc35100f112e2574430a3ba8

SHA512
e6a1508f8a33a5a276c21364acbeb0ab244e209fc47f6f7728cf0f5c79217fcb041fb474d1bd69cfe701431df2adcc141c9a2a75a4c383989bbb8f408b5eb9be

Download Submit
C:\Windows\SysWOW64\Cgfkmgnj.exe

Filesize
89KB

MD5
b8e8a57f81bd058fb0c52572c54da6d9

SHA1
6ff8e3c2058a927391300529ce2f750fdccf899e

SHA256
88d5a0f4e553082250dba59a55be39939dba83007413388600e8146d7457f390

SHA512
46431b908de6c162de7c32eb193c872fcd029c4e8dd0a27569c9498d6731683fa178c52adf9baa3d7caeb19261f23b7171726260266ed151c038b08482ad7ab9

Download Submit
C:\Windows\SysWOW64\Clojhf32.exe

Filesize
89KB

MD5
d282abd76e869b222f3d8df75e09687e

SHA1
e741ce55d0b170a67f4ee4241a49742fd0a26898

SHA256
f5bd06e0af32ff034aada8bc3e3982596f7f894151ce009adde7479ecf10a541

SHA512
bf610cb8528123ec71cc99d12d2aa62e4e43a3fb0e1ad8e6077a2550c8be1a7a983ef36f6f3a9f92a8805305f2dfb6c03be1fa101ba984b82a677fa92192a5d3

Download Submit
C:\Windows\SysWOW64\Cmpgpond.exe

Filesize
89KB

MD5
7755099baea73b7e48f3c0fab4763086

SHA1
18a2cdc3c63c09a3c9a79101b7fcdf5fae2e6a82

SHA256
70aeb4b0ca6c166b1d92148aa998fce7b5cc9040e8a02f091da00b60dfd8234e

SHA512
dbff86c4cdf75b89a654d181e054ebc9508f1c06fe5dcf9240997292ff8e5e22cfcfc3de4207d30c1ed97a223252ba6caf14fc1489908c5a6b4cf25c3970122d

Download Submit
C:\Windows\SysWOW64\Cpfmmf32.exe

Filesize
89KB

MD5
2f0648f681ac225004b37937bec539ba

SHA1
16a858162cbf9823fa711b32a2c1fc8763c790fa

SHA256
c6ca5f8495a2d6ea956c6b409358cd791fe894798b0116bdf83a43d6f057014d

SHA512
f4262dab4194ec03e0234340b28ab0e861c04be78c0e7e926d589f584b196a90f952153457cf008993db5a56a9c964cc24cd7d819111eb64cdebb1956e01d3a7

Download Submit
C:\Windows\SysWOW64\Dmbcen32.exe

Filesize
89KB

MD5
5c5f9f5f1160a7dc58a86796f25e4259

SHA1
fa6825cfc819e5f1c38e00e33f3ae5e5249674ee

SHA256
fe5c3d57d69204dd4231f97ba7ea31eaeef31ef24e528c247408fc6f1f589d47

SHA512
922ef337a47ce275a5818cca33bfbfcb3258fa66717abf96c86fb7f26378c243d1baea3e0d957dbfe5ba17fcc51ab8d7a8363b07211ae8f9209eba39580d0468

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
89KB

MD5
715c7b1a9819eea247107fceb8c4be43

SHA1
642e347d06778836976956e3303f0256dd9b62f3

SHA256
0c5e0072227b76bac3d490313c2d0fdbfcd5865aad8935be73bee16cb6b7141c

SHA512
020301cfbc6dca13a4efbb3d29e0f1ca2a1172d9a03aaebba90a1a11ae69dd09589318cb784f9ef0595a6c3d82a2f9f90034bd5063990a55ed04a4688254a9a7

Download Submit
C:\Windows\SysWOW64\Lloeec32.dll

Filesize
7KB

MD5
ddd6bae3c96cbd546bf69d5a34a7a188

SHA1
769be9a577ee018df69bc0a3900e5dbe885dda27

SHA256
8d1f11bc39e37802dfa09eaa916b5b29a7607a7cf9e653e57dcefc13bf79768b

SHA512
aaffd53514c1b1acb9e7d12d66062aad018a643187a7a356b9c615eb6d63b7ee8fe968e09ea6a479f14a8beb8c675f204934916c62be4b50486c3d191d2f7955

Download Submit
\Windows\SysWOW64\Bfioia32.exe

Filesize
89KB

MD5
ae23211cce882c5694816671d63d3141

SHA1
827252f8696f7da15bb394af2fb03a99028b4412

SHA256
c2c09ae138657608987326ddb3bea450dc97b6135ffd99671712628148ebfeff

SHA512
4d04a480c44f85726dab55a5a494fe2e7e18062e8be79c2bb674785f6aaf248a7584c6ba7afb67e1b3887ff5b3d056f0682732cea2d893a156c2a4b660fd5ab0

Download Submit
\Windows\SysWOW64\Bieopm32.exe

Filesize
89KB

MD5
9eff078f18b67fceeaddc8ad274ecd3e

SHA1
cb0b3e40e30167ce922056b34da764414342e746

SHA256
ed55c434b202be7de3ab91f3705a4fdb71f9b854e1817660c23c2407afe8f821

SHA512
b4d07ebff863440c63627256e08ce5e3a2f3ddd23c3161bfa10317b89636e3f7c73782b668f9f240235a36e128065d153f3b72867d3ddd057c916883949f8938

Download Submit
\Windows\SysWOW64\Bmbgfkje.exe

Filesize
89KB

MD5
d454e588667ddd0e947cbb7125c3199e

SHA1
29f2d19282c3dcab82626727c00d24881744f516

SHA256
61607d140883e310e00a02ddee7288f8cc09c0d621036d12e1bbcba772c94274

SHA512
e2ba0218b5c944fbf57c954058b583df26bc5ef56b21d3918c92d24c9f45c38ff68727f71940aede24b3c1efaba73c7973cdad8c399e0f4e174f67e1cc54c20a

Download Submit
\Windows\SysWOW64\Bmnnkl32.exe

Filesize
89KB

MD5
9bec3943ba82e0dc7d692465624151ed

SHA1
3ed8e1583fc69ede024d8ac12d4dd12f7e35a047

SHA256
39fcaee12d0c37cac24052b35b15adac4e4a55fa26e6eee283012b9c912761f9

SHA512
22c6fd0c68fb831c8dc293a2ba45f0f407c6c1ff8228899be705813bda879075456e870ba4e05366e71ae935f8c5b58d78219731d1b6d4bd415c5bcf6d49de73

Download Submit
\Windows\SysWOW64\Boogmgkl.exe

Filesize
89KB

MD5
4b04d8a80d06ab7170f69978bb4d2548

SHA1
1684b2e76160570d0f4c513bccb9eef13f83d991

SHA256
9ffdefc05c9a858f8d6330fe27c6bdad5e2e1302cd380a99c36c6df82ab5fab5

SHA512
4695db075757b672aaafc41236b1b678f8c4849126d608b57fcb5eaa55c2d48d3ae9191aa9a2b252e29917c04cecccb293054b51c3272e5ef0b84bcebd75f4cf

Download Submit
\Windows\SysWOW64\Cbblda32.exe

Filesize
89KB

MD5
8c7a7719f4e3eed1e23bd3994c1d92cb

SHA1
7eafef668b620bbdfe62c82515eb4fb1032b8159

SHA256
d21fe77c6f4e81a9270e90f18ab884343cdcdf3bd47f5ca6c4465f451c9cf9aa

SHA512
a1d81b1041d4caeaf250a47d68ea07252d91c7839751a30de29572f7ae933ea72359cd1bb2059630f2d47b4f1554ec9db3462da52244da5ed50afa206d0d7905

Download Submit
\Windows\SysWOW64\Cbffoabe.exe

Filesize
89KB

MD5
8b9f9eb7232e6da3f25587199cdfae4e

SHA1
cf04749e5f1f3c3a395e6ae342714ed635a5c172

SHA256
69cb9332528d26f48e0206894d4369c058f45a9c8322a31c7bd6aeaad7541128

SHA512
0b1e5b9e5630fef9340d15de1cdacd8ed05dc79e5254d368b96dfe48c4c4bb559eb5791897fafc9e3d85149e74d6be6279ad07d2040678dae61b4444dc54445a

Download Submit
\Windows\SysWOW64\Ccmpce32.exe

Filesize
89KB

MD5
201eaff7dddbeeeb024c13d6a619136e

SHA1
f8e84c8ead77aff099d39c8ed5f8348dc2cad695

SHA256
55ea54565c613b39e08c35cbb52e65591bb536a381d615f237a590ffe049c2a4

SHA512
4c5e2c524b0f7988457d0866bc69b87ef9f1a32e33373ad633b8f5a732b50fed5346f53cc31c330fd0378846b89278baabf8ae71ea5b60fc9e4a0ab0583e4e5e

Download Submit
\Windows\SysWOW64\Cebeem32.exe

Filesize
89KB

MD5
0f2ef8ec5c851eed1f3935eee2aa38a9

SHA1
69dfd17fe5c706e09278cc21ccd472fcfe2fadf5

SHA256
f0f22b81c9e8e48e735d11055eb48dfffbfcd9414f5f91103fb3f7282f7a7708

SHA512
e6525532f3c62b7263849c8baf893df8f9b12f6d0d29cce85d689ebbc1d052ab15fa3581f3d4569ec4f775dde0893eb357da3c9f1267f98681a6f9a9ff8186fe

Download Submit
\Windows\SysWOW64\Ceebklai.exe

Filesize
89KB

MD5
e59c86f42890268fd51ef30bee91ec6e

SHA1
b3722f70754b2749569177686a35785e75667606

SHA256
5634c9888790913743c1091af1cb5ec19195ab1eaf5b6f2d3f3bc714c8b5fefa

SHA512
b1c801b03b0639a4dd0a788de253e8821ae6980d3dc83084972456fff39dffbbf0c6d4580efc36210c6df1358db68732c6ca6c4ed9261811799d2b23a8258ae5

Download Submit
\Windows\SysWOW64\Cgoelh32.exe

Filesize
89KB

MD5
9f44be789b3add634330932eeff03dae

SHA1
0fd35eb2515e5480a65d2033db9cbb48299e1b9d

SHA256
4c71d653b37d83583bab498dd47807015d1dae4e5b5577073492de093ed38b84

SHA512
a3402e75fc10291f44e1dd5c6339cfcbaea78c9f26bb80fa90978aa50b18e21291120201db5c6fce3aabefe341c711bec89588cc520471fa37cf32449de0c0c1

Download Submit
\Windows\SysWOW64\Cocphf32.exe

Filesize
89KB

MD5
ec1e22ba2e7e70e080e00ef2084b5e6a

SHA1
6f69c8b4bd3eedb15754a3711f327f3eda500526

SHA256
c0f31398d98a68324366394aa661662b5d2a8cbe2348d2ae03f7e07f6b7410b4

SHA512
984be6ec39d236d27c6aaa1b5a6e947115605e5a516d68bc75cbc92f3ef7f517eb1ec92fcca46bea2621c83ce16239f2d3918dd0fddc9ed90dab091553d42c21

Download Submit
memory/280-290-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/400-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/684-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/684-149-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/856-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/860-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1052-158-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1052-166-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1052-289-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-252-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-258-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/1088-262-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/1088-297-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1200-278-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1200-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1312-250-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/1312-251-0x0000000000320000-0x0000000000360000-memory.dmp

Filesize
256KB

Download
memory/1312-296-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1312-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1384-295-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1384-236-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1384-240-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1384-230-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1464-285-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1464-112-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1464-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1624-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1712-273-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1712-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1744-131-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1744-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1744-139-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1812-271-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1812-272-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1812-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2064-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2064-218-0x0000000000290000-0x00000000002D0000-memory.dmp

Filesize
256KB

Download
memory/2064-211-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-33-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2308-279-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2468-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2468-277-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2468-12-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download
memory/2468-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-284-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-103-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2764-78-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-283-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-86-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2816-52-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2816-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2816-59-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2840-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-291-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-192-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/3028-198-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads