9f057be772ce217518f1a371c71ae2ee739eab4bde4c34c73b860327d85a8a67

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2536a8d2c12187b6cf9490b47b60f10N.exe
Size

72KB
MD5

d2536a8d2c12187b6cf9490b47b60f10
SHA1

af56e51d1ffacc1e2946402e5d559608d5d55196
SHA256

9f057be772ce217518f1a371c71ae2ee739eab4bde4c34c73b860327d85a8a67
SHA512

72c59d8ba21a9959ed1c299bdd21fac6dddc3469c093aaa7f0c5b980f8eabcf04e017b654b626c05028e20b3e73797d7b5eb709a6bd5963d838d20153e859282
SSDEEP

768:rsiXWGQXkyop3kwER770vrInzBa57s2QjiDZRWz/1H58CU9UiEb/KEiEixV38HiD:rsqQ5wE97ArIj2Y8KGPgUN3QivEtA

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbnnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccppmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecikjoep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdlfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cienon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapgdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdapehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egnajocq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egpnooan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gggmgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfogbjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjficg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cancekeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecikjoep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjhkmbho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbfmgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgdncplk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjcmngnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpedeiff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cienon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egpnooan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fboecfii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggccllai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjhkmbho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcphdqmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckidcpjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdiakp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egnajocq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacmpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcffnbee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljehpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcphdqmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqfojblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmladm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddfbgelh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlnfjbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edaaccbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqmlccdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdapehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dinael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gggmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnffhgon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daeifj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddfbgelh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmladm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cigkdmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddklbd32.exe

Executes dropped EXE 64 IoCs

pid	Process
3448	Abmjqe32.exe
3956	Bmbnnn32.exe
4516	Bdlfjh32.exe
1116	Bjfogbjb.exe
4284	Bapgdm32.exe
3512	Bbaclegm.exe
656	Bjhkmbho.exe
404	Bpedeiff.exe
2428	Bdapehop.exe
1456	Bmidnm32.exe
1276	Bbfmgd32.exe
216	Bmladm32.exe
1724	Bdeiqgkj.exe
3832	Ckpamabg.exe
4796	Cpljehpo.exe
4692	Cienon32.exe
3880	Cmpjoloh.exe
4520	Ccmcgcmp.exe
4744	Cigkdmel.exe
1644	Cancekeo.exe
5016	Cdmoafdb.exe
4780	Ccppmc32.exe
4980	Ckidcpjl.exe
3940	Cacmpj32.exe
1740	Ccdihbgg.exe
2236	Dinael32.exe
852	Daeifj32.exe
1476	Ddcebe32.exe
724	Dcffnbee.exe
5108	Ddfbgelh.exe
1468	Dgdncplk.exe
4244	Dggkipii.exe
696	Djegekil.exe
4800	Ddklbd32.exe
1564	Djgdkk32.exe
1424	Dcphdqmj.exe
2772	Ekgqennl.exe
1604	Epdime32.exe
5044	Egnajocq.exe
4860	Ejlnfjbd.exe
3840	Edaaccbj.exe
676	Egpnooan.exe
2068	Eafbmgad.exe
2612	Ecgodpgb.exe
4708	Enlcahgh.exe
3948	Ecikjoep.exe
552	Ekqckmfb.exe
624	Eqmlccdi.exe
1508	Fjeplijj.exe
2592	Fkemfl32.exe
4872	Fboecfii.exe
1912	Fcpakn32.exe
1760	Fnffhgon.exe
208	Fgnjqm32.exe
2836	Fqfojblo.exe
5068	Fqikob32.exe
4320	Ggccllai.exe
4304	Gjaphgpl.exe
2016	Gdgdeppb.exe
220	Gjcmngnj.exe
4928	Gdiakp32.exe
3108	Gggmgk32.exe
3952	Gjficg32.exe
2712	Gbmadd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ccmcgcmp.exe	Cmpjoloh.exe
File created	C:\Windows\SysWOW64\Ddklbd32.exe	Djegekil.exe
File created	C:\Windows\SysWOW64\Ecgodpgb.exe	Eafbmgad.exe
File created	C:\Windows\SysWOW64\Fqfojblo.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Cacmpj32.exe	Ckidcpjl.exe
File created	C:\Windows\SysWOW64\Efoope32.dll	Cacmpj32.exe
File opened for modification	C:\Windows\SysWOW64\Ddcebe32.exe	Daeifj32.exe
File created	C:\Windows\SysWOW64\Jfqqddpi.dll	Fboecfii.exe
File created	C:\Windows\SysWOW64\Gjaphgpl.exe	Ggccllai.exe
File opened for modification	C:\Windows\SysWOW64\Gbmadd32.exe	Gjficg32.exe
File created	C:\Windows\SysWOW64\Iocmhlca.dll	Bapgdm32.exe
File created	C:\Windows\SysWOW64\Labnlj32.dll	Bdeiqgkj.exe
File opened for modification	C:\Windows\SysWOW64\Dinael32.exe	Ccdihbgg.exe
File opened for modification	C:\Windows\SysWOW64\Dcffnbee.exe	Ddcebe32.exe
File opened for modification	C:\Windows\SysWOW64\Fjeplijj.exe	Eqmlccdi.exe
File opened for modification	C:\Windows\SysWOW64\Gggmgk32.exe	Gdiakp32.exe
File created	C:\Windows\SysWOW64\Cigkdmel.exe	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Obhmcdfq.dll	Djegekil.exe
File opened for modification	C:\Windows\SysWOW64\Bjfogbjb.exe	Bdlfjh32.exe
File opened for modification	C:\Windows\SysWOW64\Bbfmgd32.exe	Bmidnm32.exe
File created	C:\Windows\SysWOW64\Cpljehpo.exe	Ckpamabg.exe
File created	C:\Windows\SysWOW64\Bdbbme32.dll	Ckpamabg.exe
File opened for modification	C:\Windows\SysWOW64\Cienon32.exe	Cpljehpo.exe
File created	C:\Windows\SysWOW64\Fbcolk32.dll	Cmpjoloh.exe
File created	C:\Windows\SysWOW64\Ejlnfjbd.exe	Egnajocq.exe
File created	C:\Windows\SysWOW64\Dodfed32.dll	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Adbofa32.dll	Fkemfl32.exe
File created	C:\Windows\SysWOW64\Fnffhgon.exe	Fcpakn32.exe
File created	C:\Windows\SysWOW64\Gjcmngnj.exe	Gdgdeppb.exe
File created	C:\Windows\SysWOW64\Aammfkln.dll	Daeifj32.exe
File opened for modification	C:\Windows\SysWOW64\Djegekil.exe	Dggkipii.exe
File created	C:\Windows\SysWOW64\Dfbjkg32.dll	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Bmidnm32.exe	Bdapehop.exe
File created	C:\Windows\SysWOW64\Cancekeo.exe	Cigkdmel.exe
File created	C:\Windows\SysWOW64\Jnblgj32.dll	Cdmoafdb.exe
File opened for modification	C:\Windows\SysWOW64\Ckidcpjl.exe	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Ccdihbgg.exe	Cacmpj32.exe
File opened for modification	C:\Windows\SysWOW64\Egnajocq.exe	Epdime32.exe
File created	C:\Windows\SysWOW64\Mfikmmob.dll	Ecgodpgb.exe
File created	C:\Windows\SysWOW64\Eclhcj32.dll	Ecikjoep.exe
File created	C:\Windows\SysWOW64\Fgnjqm32.exe	Fnffhgon.exe
File opened for modification	C:\Windows\SysWOW64\Bapgdm32.exe	Bjfogbjb.exe
File created	C:\Windows\SysWOW64\Dggkipii.exe	Dgdncplk.exe
File opened for modification	C:\Windows\SysWOW64\Ecgodpgb.exe	Eafbmgad.exe
File opened for modification	C:\Windows\SysWOW64\Gdiakp32.exe	Gjcmngnj.exe
File created	C:\Windows\SysWOW64\Backedki.dll	Gjcmngnj.exe
File created	C:\Windows\SysWOW64\Hjmgbm32.dll	Gjficg32.exe
File created	C:\Windows\SysWOW64\Bapgdm32.exe	Bjfogbjb.exe
File opened for modification	C:\Windows\SysWOW64\Ecikjoep.exe	Enlcahgh.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fgnjqm32.exe
File created	C:\Windows\SysWOW64\Bbjlpn32.dll	Gjaphgpl.exe
File created	C:\Windows\SysWOW64\Ljkgblln.dll	Egnajocq.exe
File opened for modification	C:\Windows\SysWOW64\Gjaphgpl.exe	Ggccllai.exe
File created	C:\Windows\SysWOW64\Qjfpkhpm.dll	Ggccllai.exe
File opened for modification	C:\Windows\SysWOW64\Bmladm32.exe	Bbfmgd32.exe
File opened for modification	C:\Windows\SysWOW64\Cpljehpo.exe	Ckpamabg.exe
File created	C:\Windows\SysWOW64\Ldicpljn.dll	Fgnjqm32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbnnn32.exe	Abmjqe32.exe
File created	C:\Windows\SysWOW64\Ddcebe32.exe	Daeifj32.exe
File opened for modification	C:\Windows\SysWOW64\Ekgqennl.exe	Dcphdqmj.exe
File opened for modification	C:\Windows\SysWOW64\Egpnooan.exe	Edaaccbj.exe
File created	C:\Windows\SysWOW64\Eafbmgad.exe	Egpnooan.exe
File created	C:\Windows\SysWOW64\Jlojif32.dll	Ccmcgcmp.exe
File created	C:\Windows\SysWOW64\Lnedgk32.dll	Edaaccbj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	2712	WerFault.exe	156

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpjoloh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdncplk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcffnbee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djegekil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddklbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbmadd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbaclegm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egnajocq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ejlnfjbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjcmngnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2536a8d2c12187b6cf9490b47b60f10N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbnnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpedeiff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cancekeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccdihbgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinael32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcebe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgdkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fboecfii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjaphgpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gggmgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckpamabg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckidcpjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqfojblo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmoafdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccppmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmidnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekqckmfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abmjqe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ekgqennl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqmlccdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmladm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cienon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecikjoep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edaaccbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fjeplijj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdgdeppb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdlfjh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fnffhgon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdiakp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdapehop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fcpakn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfogbjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjhkmbho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpljehpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccmcgcmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacmpj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daeifj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddfbgelh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dggkipii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dcphdqmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Epdime32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egpnooan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eafbmgad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecgodpgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enlcahgh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkemfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqikob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdeiqgkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cigkdmel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fgnjqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggccllai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjficg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapgdm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gggmgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gihfoi32.dll"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paifdeda.dll"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kojkgebl.dll"	Eafbmgad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojimfh32.dll"	Ekqckmfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abmjqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbfmgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edaaccbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekqckmfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqikob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egnajocq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aolphl32.dll"	Egpnooan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmladm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgdkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhnbgoib.dll"	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d2536a8d2c12187b6cf9490b47b60f10N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acajpc32.dll"	Ddcebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adbofa32.dll"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgnjqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjhkmbho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cienon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccmcgcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fekmfnbj.dll"	Bbaclegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpljehpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cancekeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dinael32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjfeo32.dll"	Djgdkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nailkcbb.dll"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekgqennl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdeiqgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodfed32.dll"	Enlcahgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggccllai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfikmmob.dll"	Ecgodpgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cancekeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnmanm32.dll"	Cpljehpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecgodpgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbnnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkemfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjaphgpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dinael32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daeifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gggmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmgbm32.dll"	Gjficg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddfbgelh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacmpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cigkdmel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edaaccbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmladm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enlcahgh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3448	2840	d2536a8d2c12187b6cf9490b47b60f10N.exe	92
PID 2840 wrote to memory of 3448	2840	d2536a8d2c12187b6cf9490b47b60f10N.exe	92
PID 2840 wrote to memory of 3448	2840	d2536a8d2c12187b6cf9490b47b60f10N.exe	92
PID 3448 wrote to memory of 3956	3448	Abmjqe32.exe	93
PID 3448 wrote to memory of 3956	3448	Abmjqe32.exe	93
PID 3448 wrote to memory of 3956	3448	Abmjqe32.exe	93
PID 3956 wrote to memory of 4516	3956	Bmbnnn32.exe	94
PID 3956 wrote to memory of 4516	3956	Bmbnnn32.exe	94
PID 3956 wrote to memory of 4516	3956	Bmbnnn32.exe	94
PID 4516 wrote to memory of 1116	4516	Bdlfjh32.exe	95
PID 4516 wrote to memory of 1116	4516	Bdlfjh32.exe	95
PID 4516 wrote to memory of 1116	4516	Bdlfjh32.exe	95
PID 1116 wrote to memory of 4284	1116	Bjfogbjb.exe	97
PID 1116 wrote to memory of 4284	1116	Bjfogbjb.exe	97
PID 1116 wrote to memory of 4284	1116	Bjfogbjb.exe	97
PID 4284 wrote to memory of 3512	4284	Bapgdm32.exe	98
PID 4284 wrote to memory of 3512	4284	Bapgdm32.exe	98
PID 4284 wrote to memory of 3512	4284	Bapgdm32.exe	98
PID 3512 wrote to memory of 656	3512	Bbaclegm.exe	99
PID 3512 wrote to memory of 656	3512	Bbaclegm.exe	99
PID 3512 wrote to memory of 656	3512	Bbaclegm.exe	99
PID 656 wrote to memory of 404	656	Bjhkmbho.exe	100
PID 656 wrote to memory of 404	656	Bjhkmbho.exe	100
PID 656 wrote to memory of 404	656	Bjhkmbho.exe	100
PID 404 wrote to memory of 2428	404	Bpedeiff.exe	101
PID 404 wrote to memory of 2428	404	Bpedeiff.exe	101
PID 404 wrote to memory of 2428	404	Bpedeiff.exe	101
PID 2428 wrote to memory of 1456	2428	Bdapehop.exe	102
PID 2428 wrote to memory of 1456	2428	Bdapehop.exe	102
PID 2428 wrote to memory of 1456	2428	Bdapehop.exe	102
PID 1456 wrote to memory of 1276	1456	Bmidnm32.exe	103
PID 1456 wrote to memory of 1276	1456	Bmidnm32.exe	103
PID 1456 wrote to memory of 1276	1456	Bmidnm32.exe	103
PID 1276 wrote to memory of 216	1276	Bbfmgd32.exe	104
PID 1276 wrote to memory of 216	1276	Bbfmgd32.exe	104
PID 1276 wrote to memory of 216	1276	Bbfmgd32.exe	104
PID 216 wrote to memory of 1724	216	Bmladm32.exe	105
PID 216 wrote to memory of 1724	216	Bmladm32.exe	105
PID 216 wrote to memory of 1724	216	Bmladm32.exe	105
PID 1724 wrote to memory of 3832	1724	Bdeiqgkj.exe	106
PID 1724 wrote to memory of 3832	1724	Bdeiqgkj.exe	106
PID 1724 wrote to memory of 3832	1724	Bdeiqgkj.exe	106
PID 3832 wrote to memory of 4796	3832	Ckpamabg.exe	107
PID 3832 wrote to memory of 4796	3832	Ckpamabg.exe	107
PID 3832 wrote to memory of 4796	3832	Ckpamabg.exe	107
PID 4796 wrote to memory of 4692	4796	Cpljehpo.exe	108
PID 4796 wrote to memory of 4692	4796	Cpljehpo.exe	108
PID 4796 wrote to memory of 4692	4796	Cpljehpo.exe	108
PID 4692 wrote to memory of 3880	4692	Cienon32.exe	109
PID 4692 wrote to memory of 3880	4692	Cienon32.exe	109
PID 4692 wrote to memory of 3880	4692	Cienon32.exe	109
PID 3880 wrote to memory of 4520	3880	Cmpjoloh.exe	110
PID 3880 wrote to memory of 4520	3880	Cmpjoloh.exe	110
PID 3880 wrote to memory of 4520	3880	Cmpjoloh.exe	110
PID 4520 wrote to memory of 4744	4520	Ccmcgcmp.exe	111
PID 4520 wrote to memory of 4744	4520	Ccmcgcmp.exe	111
PID 4520 wrote to memory of 4744	4520	Ccmcgcmp.exe	111
PID 4744 wrote to memory of 1644	4744	Cigkdmel.exe	112
PID 4744 wrote to memory of 1644	4744	Cigkdmel.exe	112
PID 4744 wrote to memory of 1644	4744	Cigkdmel.exe	112
PID 1644 wrote to memory of 5016	1644	Cancekeo.exe	113
PID 1644 wrote to memory of 5016	1644	Cancekeo.exe	113
PID 1644 wrote to memory of 5016	1644	Cancekeo.exe	113
PID 5016 wrote to memory of 4780	5016	Cdmoafdb.exe	114

C:\Users\Admin\AppData\Local\Temp\d2536a8d2c12187b6cf9490b47b60f10N.exe
"C:\Users\Admin\AppData\Local\Temp\d2536a8d2c12187b6cf9490b47b60f10N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\Abmjqe32.exe
  C:\Windows\system32\Abmjqe32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\Bmbnnn32.exe
    C:\Windows\system32\Bmbnnn32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\SysWOW64\Bdlfjh32.exe
      C:\Windows\system32\Bdlfjh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1116
      - C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4980
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3940
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1740
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1476
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:724
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:696
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:676
        
        C:\Windows\SysWOW64\Eafbmgad.exe
        
        C:\Windows\system32\Eafbmgad.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2612
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4708
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3948
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:552
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:624
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4872
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1760
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3952
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 400
        66⤵
        Program crash
        
        PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2712 -ip 2712
1⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abmjqe32.exe

Filesize
72KB

MD5
581b503ed095ce25e5079160900461fb

SHA1
86be194664fd4e49f68e0f2235affb67e4814777

SHA256
ecb9d526bd03e05fa6695010111b3385b1910339a3f6473f7caac90c1e30d901

SHA512
009256b74d2a46d52a134bafd7b66924bcfa6d5f41abf93abb40940842db59e405587c2e28fa215a96136144183d85eaa35a3938b10114200eee2d097dc2de08

Download Submit
C:\Windows\SysWOW64\Bapgdm32.exe

Filesize
72KB

MD5
8ed3a8caf5ccfc1f41cfeb5eaa42ba77

SHA1
a98497288053a6fb65e6067a92c855a4e345b6d1

SHA256
b4106012fc36b5c27ec49537b5de2a2266868cde9866e4d8d5e5388633ab0f0b

SHA512
e79c8591e306e76a0272d2c5d0891c8d3a492afc6d9b900b83ab5a0b20a3a030610e4738ed352327d78edd06d5f3f8c81d3a0ddbd6501c7aeb9e5a28b9f71987

Download Submit
C:\Windows\SysWOW64\Bbaclegm.exe

Filesize
72KB

MD5
161ac86dbbecd6331e892502174db5d1

SHA1
f34a5e13b2af1d65d6fbeeb1d335188044f2bd7d

SHA256
8c27f4aac377fb31b8232edfc48ba4bfcc5cc784f14f16921b14c635f6bd54c9

SHA512
7606d4eb7b6dc3eca7f5341ddb4b014c4eacd2cea233e62b11ce4a02c8cd6c06a39b18495254674b0a0858e6337d4b3822377598a6c74ae697b41f28523b695a

Download Submit
C:\Windows\SysWOW64\Bbfmgd32.exe

Filesize
72KB

MD5
2fee0658bb96583f2a7d60dcd79baac2

SHA1
602d69ee43b0e28af619620e501b3b5d0007ea6a

SHA256
cd1850d42fd6035be8dfac1d34ff9884a424be1ab0f4a59c504c552f14f790c6

SHA512
91181a053997dd40ea475f5e9527b923c39f614bd6a026fddec4a384c61097ff2b683ad342e10087bd3a81cfc4e037aa7b3134f9f485a22ad47606959d118333

Download Submit
C:\Windows\SysWOW64\Bdapehop.exe

Filesize
72KB

MD5
596a8e0c3d6804b299cba698ac2e6411

SHA1
81115c326689432969c7bd6bdf26b26743b068c8

SHA256
71555d987740fb8a4921a107b45a5a4fd79c9fd606a26340cbc1d4aa30a523d4

SHA512
3bb44871c4c79cdc3a529f477a53b75b0ff72615356bb0cf0da5e1f4f1c0efff9decb44999513f3fc99d8b5e405a9f4afedf7ff452859206d448a80608c53b30

Download Submit
C:\Windows\SysWOW64\Bdeiqgkj.exe

Filesize
72KB

MD5
e72bb624ef91c15787b504ca92ab6016

SHA1
5ed507960eff9b7e3889ea6b8b376ba7e0ebe117

SHA256
39351e123954d7ca83ae4ee3c1c375e305e15c997db8af36959033fe89071370

SHA512
43195753001ec8ec25949ef839b8b424714c6e7365e29e22a773f8a362a0d1958c8dd24592c16054bc675a48828400f1d2fdfb1eb099fa61752d66fbcf668122

Download Submit
C:\Windows\SysWOW64\Bdlfjh32.exe

Filesize
72KB

MD5
2cc3fd31d39edfe88ef0c1c3fe8c9cfa

SHA1
0c56495a63ad440f8a15a1443348d6cde1293008

SHA256
972df3a4d22917148523ae419978d0c708a502c4c7ad792d08553eef5081af28

SHA512
259b998c14d8591df27cfce1686e6f8e9a5a999f7f64f36523786cd015604f55e82088ddba52a4be9fbada13a902e564d8b2f8d80a432986ee96d2bdffeeefb8

Download Submit
C:\Windows\SysWOW64\Bjfogbjb.exe

Filesize
72KB

MD5
b86aa1d925c2511c23ebd5797e4677f2

SHA1
654411bc55b31006fc0f3917d4f8fb692c564e28

SHA256
69c1a6aaed113718b36d9058906a6b79064b50e7dc5886e72a46b00329351ec7

SHA512
c5a8e696071be4e6e958fe5803b3e36bb8a62ee14c95dd4fbbf3a503205fe49f165deff6923b616822ec2144a5b12fd11d7037ea31193e044858f2d36d2ff318

Download Submit
C:\Windows\SysWOW64\Bjhkmbho.exe

Filesize
72KB

MD5
869ac9d3279184284d4b8fd9aa8297e1

SHA1
4a37baff81fde53db2010439d63d616f7d2365a8

SHA256
a19783e829695da1d3cf3a288f61c2c251de524bb84d6ef3909ce527d1e59961

SHA512
1b15cd23ec2deb9da6c0f5bf5d03946fa701c273633c77e3c8ef1ee41ed7044b1bb328be2b790551c2e4da40276b888c4fbe65234bdd1f116a5f0867dd1e08a0

Download Submit
C:\Windows\SysWOW64\Bmbnnn32.exe

Filesize
72KB

MD5
5cdf217ce393863d2633cd5ded924f18

SHA1
dcd0bc50a9c1c5e61fa7c3f8162b165c8e4a4dc1

SHA256
77206a5262ec8608c4dec15286c3ff07df0605efa333fbd7ce3e0ae0a2018587

SHA512
d5ae864b0241fd7d9a1cc7d77e26faa9569d1d7b87a79e8a214771d0c09688b7ad9c2a5edad21ceed2a8345d277db5089b648a88dde36b29a172930893867ae8

Download Submit
C:\Windows\SysWOW64\Bmidnm32.exe

Filesize
72KB

MD5
98dd037398039d78b7931b039ec3a551

SHA1
4d7532ecb70f2a0d847d331a7526f8ad26856eb6

SHA256
75eb0d8082c305df45305509ea99a9b35a18bd6bafe40fa0ff3b97ded67857aa

SHA512
b58baae685c963f492e00944d952899698067368410765949fcea9c7ba077e90f483f1cee78870bc67f8a306cbaecfafcf0e3a0f514c22222c43b3e640e5c969

Download Submit
C:\Windows\SysWOW64\Bmladm32.exe

Filesize
72KB

MD5
dcac2c7c24ca796f109f382ebf507507

SHA1
e4faa34b7b2ea775d8b365aa6edafc5bdad8cd13

SHA256
4efc2701508f0775f6074aab5d2ff0060c5a1d19ce27c0166079c771d401da16

SHA512
e783d623888926a4dc6c6d1d0c86a5fc3978475edfb5744233a13ab3c7aff96a50c8dc52d72f8555375052f5fdde7035af76cf94f286f2882e1d4456132af3ba

Download Submit
C:\Windows\SysWOW64\Bpedeiff.exe

Filesize
72KB

MD5
91c7b163f7f4b78cbfcf5731468c4350

SHA1
38d0af3b75b1ca3eb701760cf5e9e91b35931e4b

SHA256
435a3172e859fa7e56a936c5991c868362041828139f03c366fc54651b8596f8

SHA512
c3d19d7b806d3445afa16bb35b2a3ddf1c582f45235e0eb9b63546cee5acbfdd27db63fdf5a02a84a093dc7af1de3e7b46c29cdef5bc7558ca5dd4ce5e41ce90

Download Submit
C:\Windows\SysWOW64\Cacmpj32.exe

Filesize
72KB

MD5
5b8c9b56e265690ab930d44b1f246412

SHA1
9434363d60b76f3aee8be20b35afb6b54ba1ea1c

SHA256
9b783da2d42d77d959d2ceaddb3e4a8a66e9dfa54d63d3d11f71d49e1abc7359

SHA512
9ffc85575d7fa2a6e7dd92e6ed51b4fa736b717589bed653229c01f4ba70ff9a952e22474a8a842ca6fdef3ac625e2a17df8308b31e231261e0c049cf0813ccd

Download Submit
C:\Windows\SysWOW64\Cancekeo.exe

Filesize
72KB

MD5
2b30b2734b22c9813d46a827cb8ee31c

SHA1
e4cba4ca57733ffb454115d7eb7a52e750014437

SHA256
c4f05ad5b72a9c69ee2e479ef1faef1d1a40c1206b11701ff74117c60a762f1e

SHA512
8b6b9a0d3a0ff02d60ac7114eb142b9e86b18f0b03d7634b90e9f169b5e4acc43affce57359060d97651ef490e174bb3a6609de37b778f42a1225b108eb6af24

Download Submit
C:\Windows\SysWOW64\Ccdihbgg.exe

Filesize
72KB

MD5
cce1e54092e8476c83b7c73ebce598b5

SHA1
14b3c225a575beeaec61c2a596e494cfd29f640f

SHA256
41b9f610b09a2b08a6ccc334918fd69331fa2e01929e4a8d09a5500da4d2d48b

SHA512
0a2d2e73b66e9c15c41f8962b6133e89fa63e6d55f02a822e9113687a98135d4cedd5e216edfcdd0cc370f902b148b7f3a00fe776b2c3246b247198c1f6410b5

Download Submit
C:\Windows\SysWOW64\Ccmcgcmp.exe

Filesize
72KB

MD5
87dda8227f7aa40140e035dbace5c351

SHA1
1ee481c48059a3778904e0a042fcc9fe248631f2

SHA256
fbd64de46a65f84c59c4e27cca273d5e66c0090979b0839f007793984d7df553

SHA512
e5f1048505e6ddca114407b454baa028a481ee8332acada9a3ff687957995f4498c39b08dc72979e1903559f9efc58283a2c422158281df24d955ddcca40644d

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
72KB

MD5
e0d7e78230d547348a8eed231e19fcd5

SHA1
baceab6b7e64f6559e470a24b42cab36e3490be1

SHA256
f89065c9e09eb426095c50851a3d1bf3b84b307de06df9756481e48e17d3088b

SHA512
27f9dd99324e66f7e32a1a147d67b8171fae6dd88abcc22d4ee18f019c17062023a926355e072c3ba42c40ac30bba69e7e346ac77b403d2d380b34441fee6701

Download Submit
C:\Windows\SysWOW64\Cdmoafdb.exe

Filesize
72KB

MD5
311f949415efd9f8d24360274e0206b5

SHA1
15a112fcf01384ca8dc69842bdbee5383898ea99

SHA256
f96cf7fc766a0d97cdeb03b8530285a0b4562f2a581ae2258dd70f39890f4b17

SHA512
11ec3178a0e32acf25a45eacd354fb271dfb11372fb28df5fda602bcaf7b403cd97e932545451b0b2c8afca830f977c181153fa085bf5cac0558c95e88fb85f3

Download Submit
C:\Windows\SysWOW64\Cienon32.exe

Filesize
72KB

MD5
1ee7251d83bb5b69b07f95dc8fe73759

SHA1
ec94aab15769a6b6245d5b20dae81b7e90b7bd88

SHA256
5b37104ff78d0c5c28eab92375b15f32ced5f94d1bc4cc32467243716302ed94

SHA512
b7c7a0bc09b0d0ae385939bc44fa1aac28cdf27bc9a8da11f5808b4e06dfe4959d0c39932d706f0a6f673133decef95ae1ca1ff907bbe89de3fd1c371da21f9a

Download Submit
C:\Windows\SysWOW64\Cigkdmel.exe

Filesize
72KB

MD5
f3e62b7cf8399c41a86ce33fe8b161fb

SHA1
a652307f9ddbe5158f6e2272f3471e51ff444629

SHA256
380c40ab66a8620d410c4f791657a3ef45f00ce7d1d8ea8d17264afcca2f3543

SHA512
7c02b3455469fddf5af7b651f8979a9b7d0503f55e0fc087611d4e3309c89407a760cb975f7e0a492688cca37f6fcece2d8d49c91336a9aaa6c7e0fc507d755e

Download Submit
C:\Windows\SysWOW64\Ckidcpjl.exe

Filesize
72KB

MD5
a24252e30bfef50604ebe886e51e5bcf

SHA1
56b36d81eeaf65ba7c43bca6d1ce9e408d1194d3

SHA256
5fdf1d13d779734fcfc81a4d90ce0ca9ba0ce9307e7ddce916095e2bd25e18a5

SHA512
ff6808a609bffa3a9181b96ed0858a5f6b3bfe48fb73b40856351aa1815995ab5f3aea28c2b8d5d12f25ed44f079c07344690bc8b0d1e7abf7976879f8e05ed6

Download Submit
C:\Windows\SysWOW64\Ckpamabg.exe

Filesize
72KB

MD5
dfe6b7b586e02d85cafcf918b37bfd2f

SHA1
7c5499ff38942b2ea45d4cd6207e0ecdd260d26f

SHA256
4a49edbc23fd6abc152180be4d4c8789df085ba1b162bb131fe173ec2cac0222

SHA512
70b00c5c3057c1a6dfe8567591163554ac03b9e1c977ee88b3a8a59374fb97570189fd76d90ae2c43b80f6f1a3d5ee7f6ac4e652c6528f09a559663d67a5ea69

Download Submit
C:\Windows\SysWOW64\Cmpjoloh.exe

Filesize
72KB

MD5
5ac465f148eb96b10b5465a0145774ac

SHA1
1a60dc4e04bcf7fa4a691c39a99810268b8a23cf

SHA256
4cc21c4240da0bdda11a7c37d6beeea7c7fde6f8e15d189fd7ff3199c40a6d1d

SHA512
2f2c16475b6eca367f2d203f940ed71ef5f325a72da13534eed32395a1051f2ea6f301136f5c9a5005d41df0af3dafb702cc1223c9e1d3c42b203586dcd6f4c6

Download Submit
C:\Windows\SysWOW64\Cpljehpo.exe

Filesize
72KB

MD5
88415c92fcdee53688786c1dafe3f4f1

SHA1
282d69920d8bad9f658ab2e4830a40fbdc1baa44

SHA256
c3b33c9c03adae0a0d9296868c53d63090f2f988725873e927a2eeb40bf61326

SHA512
09d7950b138e031138399620b517848055e79aa6c20be823030f5c6da75082e6da646587d549a686a971cd57fe0d350bd15cdd6598fd83e2c623b4d7b8434b73

Download Submit
C:\Windows\SysWOW64\Daeifj32.exe

Filesize
72KB

MD5
651b446e1cc2a96b4a52384c1e30581b

SHA1
1cec3146389134ce3b848618761caec7674680b7

SHA256
ebe69cedca2d1c19e7fdc437401d9b10214bca109379681c6d296fa043b29ec1

SHA512
68eb8dbe82e4be9bdf8bc694e7e1de9654436660faf90884d7ff7115aa929b77d79059d4e92f7fc12b3266ed210c0160e419ab1722c04715318dbd381af978e8

Download Submit
C:\Windows\SysWOW64\Dcffnbee.exe

Filesize
72KB

MD5
203a271f6ed20ffb1071349d021c75af

SHA1
20c93cd5879aef7a10a71467687361af9f3b8b1d

SHA256
8bddb07c457a5c74de66511c840e7fc15933a65126d0f39dc06fc55f12f1d177

SHA512
fd3e8cdece835a2fb675b77a7fb48ad880e1363de4980b62ae0c7ce6ca6c941258033c4d1d17b133faa7029a7ebde144e16b8233de0575eb58a22b7b8f90a7f2

Download Submit
C:\Windows\SysWOW64\Ddcebe32.exe

Filesize
72KB

MD5
d320589d0df9638744c235859c271ff4

SHA1
0c5167c089cc6d005463426eb257dd59e1a3651d

SHA256
074f84efab1fec5c17cce243e7ec87db18f9d02aa83314fcfb784ec167e1b97c

SHA512
45e80b87fe65918633e10015a5a4d65115f0d472793fa7cc9d743f0d93e8f47ed84382ee8e65f04b5b0806ac25d9ae155a46cb8dd528514e5e598a96c70fb5ca

Download Submit
C:\Windows\SysWOW64\Ddfbgelh.exe

Filesize
72KB

MD5
6634cf2886d1321a2213dafff61c144b

SHA1
f9a737e33919c05a2b0d2447aa56c237ac30d595

SHA256
384204d82c23ace10d4ee38b82e338d2743001ef6d7a1481a85fdf13370031f6

SHA512
8ac0211274d089f156af1d6a5a057850fb2d5cc491069d1151df896965e09b8cb871d806bebb447ae97274edde35671eb611c545f4d6a364538b9fb37e1fad85

Download Submit
C:\Windows\SysWOW64\Dgdncplk.exe

Filesize
72KB

MD5
00397195555596b907fa2d4e05c4a4a0

SHA1
5feba90e16e53e97686a5b159a8eb8c7d7bd56c9

SHA256
50bb3c1934c8812c65aad0589d4d4ffcf91b72ab0209aea61afd3bd64cfe7d5b

SHA512
7b83d770189b4a192212144a6ce24f46a06097f71d0d180957f991683bd08542abf54a2f8c7c2deb15dd50500f57ec68ffb41f349a41e65961365344678e3189

Download Submit
C:\Windows\SysWOW64\Dggkipii.exe

Filesize
72KB

MD5
5fecefcd5bbc448ca35ad03ec4fbbe79

SHA1
ce05f63ccc25486ca3632f505f02b3813bffd5d2

SHA256
c816972854c6c8c9c32af1a1bbb381e317c825502eb57d06dbc628d7234a4b2f

SHA512
2f9ff7d8bc2c0347b850e4dab1b8d41ec39b9cba77344b0ad00dcf44d111accead45059bdb69db6130f98b06afa074612a2d0e3f6a7dffbfa7246e0a40fbd537

Download Submit
C:\Windows\SysWOW64\Dinael32.exe

Filesize
72KB

MD5
46d217e25b50da847d8a75f6ad174f4f

SHA1
98a17dca58fbbc8692dfa95678e165e6a7ce2811

SHA256
627ef338ad5a9e171b73dad165f0524225a795699f22c2db4737f2fd70ecfa53

SHA512
caae6905603264b25ff83677f2b04e83812b7feaaa20f93e2f9d799ff206d2995d642293f4058525f9fabcc2ba6b95fe2f14cc3de646461f84e410e7993fe86a

Download Submit
C:\Windows\SysWOW64\Enlcahgh.exe

Filesize
64KB

MD5
ced469465258fbcf7015fa1ded632932

SHA1
f8e3c354128e9fdee121da766f00b1341cda311e

SHA256
3d2a7ca19743e4a4a0831d837575685987441c490222b9e7c09a1eed3b0462d0

SHA512
2a64eba8a19cfc381a2046593b291c3e7881636b4370d1368ec70684ae02086c0c1af896df8975a13139ac04204819c26202c70f9233b54cd3623e90a8d1fbe8

Download Submit
C:\Windows\SysWOW64\Fjeplijj.exe

Filesize
72KB

MD5
52d48601011f0fd07e2c82a73bb5596c

SHA1
be6441bfb709fea7a86e5c2afe3916c8d3131373

SHA256
46cbc6cfb92d1104d9263f7d8cb3ed9624b7c12195b441dfa12102e207a5d024

SHA512
e5b612652a72beb25205dc114ec5195bc2cb2476c62ccf463501983a0a713fe78a8ae36d3e04e0c0ac0dff2d41abfeb088e6c1e6ebe2a1b103029e3cc69fab41

Download Submit
C:\Windows\SysWOW64\Ggccllai.exe

Filesize
72KB

MD5
b2c4e39015103c9fde40cc5a753b0dd0

SHA1
4bfe9e6dc4e007da9c4e7fc243b63af37f887a72

SHA256
89bcd5ea81325644f77e091698c7c4fd1e3674248ba59f41dff9eb1d2339c388

SHA512
b7a4185809c4d87bc5a9feef093868728cbf746ed51ce0454c9c5975faf417545fa8e7538341b174a19d77485587a87eb9455745630ce06775e197b722aab18a

Download Submit
C:\Windows\SysWOW64\Gjcmngnj.exe

Filesize
72KB

MD5
971ea888b59e3be5fecc2b8ae2acd0eb

SHA1
4784341c57948c53663b12118d091be79a24a3cd

SHA256
1030be780e83e30b04f5a287b562dceed77c6eecc228db7d6bc847deaa52ff8e

SHA512
574ddf7a722dcca3bf208db0da4204808d252c604da9d75ae862e98526263a71aefa3bce6f3967dfd95f9ee94af1ecde458e4bf025c26c76dd604195862a708d

Download Submit
memory/208-427-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/216-188-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/216-98-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/404-156-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/404-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-378-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/624-385-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/656-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/656-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/676-343-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/676-412-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/696-349-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/696-284-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/724-254-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/852-233-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/852-309-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1116-116-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1116-31-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-179-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1276-89-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1424-303-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1424-370-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1456-80-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1456-170-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1468-335-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1468-268-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1476-246-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1508-392-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-363-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1564-297-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1604-316-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1604-384-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-258-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1644-174-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-197-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1724-107-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1740-215-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1740-296-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1760-420-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1912-413-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2068-350-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2068-419-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2236-228-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2428-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2428-161-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2592-399-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2612-357-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2612-426-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-310-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-377-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2836-434-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2840-79-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2840-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3448-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3448-88-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-134-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3512-48-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3832-121-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3840-336-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3840-405-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3880-232-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3880-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3940-210-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3948-371-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3956-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3956-97-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4244-342-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4244-276-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4284-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4284-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4516-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4516-106-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4520-157-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4692-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4692-227-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4708-433-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4708-364-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4744-253-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4744-162-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4780-189-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4780-275-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4796-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4796-213-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4800-356-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4800-290-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4860-329-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4860-398-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4872-406-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4980-201-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4980-283-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5016-184-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5016-267-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5044-391-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5044-322-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5108-259-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5108-328-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads