260b1dfa8eb8d1b1100466d4de13bc8c7c0523a0aaa274488a17bf687dcacd74

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbec1e019fba21cefd7d0481ce384ca0N.exe
Size

128KB
MD5

cbec1e019fba21cefd7d0481ce384ca0
SHA1

3d38c78dde50145feafbd6ebf2ff8b5b3491b460
SHA256

260b1dfa8eb8d1b1100466d4de13bc8c7c0523a0aaa274488a17bf687dcacd74
SHA512

56ff0a35f390903add489476e4b35a1d49903964d9c397f530d8aafb140f084493154df94590e62b24a7f01652edfd8e078e0160608cb5082c094dd77f2da7d3
SSDEEP

3072:ddctkUmv7hZMHLeAI7DxSvITW/cbFGS9n:da9mv7TMHSA0hCw9n

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgoelh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgoelh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	cbec1e019fba21cefd7d0481ce384ca0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkegah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceebklai.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnmfdb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calcpm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkegah32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenljmgq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	cbec1e019fba21cefd7d0481ce384ca0N.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgcnghpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnmfdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boogmgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Boogmgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckhdggom.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cinafkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cinafkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bqlfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Clojhf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgcnghpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmpce32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenljmgq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhdggom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfmhdpnc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djdgic32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqlfaj32.exe

Executes dropped EXE 23 IoCs

pid	Process
2652	Bqlfaj32.exe
2500	Boogmgkl.exe
2704	Bjdkjpkb.exe
2884	Bkegah32.exe
2280	Ccmpce32.exe
2796	Cenljmgq.exe
2588	Ckhdggom.exe
2076	Cnfqccna.exe
2776	Cfmhdpnc.exe
2784	Cgoelh32.exe
2468	Cpfmmf32.exe
2608	Cinafkkd.exe
1044	Ckmnbg32.exe
2392	Cbffoabe.exe
2052	Ceebklai.exe
1076	Cgcnghpl.exe
680	Clojhf32.exe
2400	Cnmfdb32.exe
1748	Calcpm32.exe
2992	Cgfkmgnj.exe
1532	Djdgic32.exe
2260	Dnpciaef.exe
1484	Dpapaj32.exe

Loads dropped DLL 46 IoCs

pid	Process
2544	cbec1e019fba21cefd7d0481ce384ca0N.exe
2544	cbec1e019fba21cefd7d0481ce384ca0N.exe
2652	Bqlfaj32.exe
2652	Bqlfaj32.exe
2500	Boogmgkl.exe
2500	Boogmgkl.exe
2704	Bjdkjpkb.exe
2704	Bjdkjpkb.exe
2884	Bkegah32.exe
2884	Bkegah32.exe
2280	Ccmpce32.exe
2280	Ccmpce32.exe
2796	Cenljmgq.exe
2796	Cenljmgq.exe
2588	Ckhdggom.exe
2588	Ckhdggom.exe
2076	Cnfqccna.exe
2076	Cnfqccna.exe
2776	Cfmhdpnc.exe
2776	Cfmhdpnc.exe
2784	Cgoelh32.exe
2784	Cgoelh32.exe
2468	Cpfmmf32.exe
2468	Cpfmmf32.exe
2608	Cinafkkd.exe
2608	Cinafkkd.exe
1044	Ckmnbg32.exe
1044	Ckmnbg32.exe
2392	Cbffoabe.exe
2392	Cbffoabe.exe
2052	Ceebklai.exe
2052	Ceebklai.exe
1076	Cgcnghpl.exe
1076	Cgcnghpl.exe
680	Clojhf32.exe
680	Clojhf32.exe
2400	Cnmfdb32.exe
2400	Cnmfdb32.exe
1748	Calcpm32.exe
1748	Calcpm32.exe
2992	Cgfkmgnj.exe
2992	Cgfkmgnj.exe
1532	Djdgic32.exe
1532	Djdgic32.exe
2260	Dnpciaef.exe
2260	Dnpciaef.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bjdkjpkb.exe	Boogmgkl.exe
File opened for modification	C:\Windows\SysWOW64\Cfmhdpnc.exe	Cnfqccna.exe
File opened for modification	C:\Windows\SysWOW64\Cgfkmgnj.exe	Calcpm32.exe
File created	C:\Windows\SysWOW64\Gbnbjo32.dll	cbec1e019fba21cefd7d0481ce384ca0N.exe
File created	C:\Windows\SysWOW64\Lbmnig32.dll	Boogmgkl.exe
File created	C:\Windows\SysWOW64\Kgloog32.dll	Cbffoabe.exe
File opened for modification	C:\Windows\SysWOW64\Clojhf32.exe	Cgcnghpl.exe
File created	C:\Windows\SysWOW64\Cnmfdb32.exe	Clojhf32.exe
File created	C:\Windows\SysWOW64\Bnjdhe32.dll	Bjdkjpkb.exe
File opened for modification	C:\Windows\SysWOW64\Cenljmgq.exe	Ccmpce32.exe
File created	C:\Windows\SysWOW64\Fnpeed32.dll	Ckhdggom.exe
File created	C:\Windows\SysWOW64\Hbocphim.dll	Ckmnbg32.exe
File created	C:\Windows\SysWOW64\Cpmahlfd.dll	Calcpm32.exe
File opened for modification	C:\Windows\SysWOW64\Djdgic32.exe	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Cenljmgq.exe	Ccmpce32.exe
File opened for modification	C:\Windows\SysWOW64\Cinafkkd.exe	Cpfmmf32.exe
File opened for modification	C:\Windows\SysWOW64\Cgcnghpl.exe	Ceebklai.exe
File created	C:\Windows\SysWOW64\Ckhdggom.exe	Cenljmgq.exe
File created	C:\Windows\SysWOW64\Jhogdg32.dll	Cinafkkd.exe
File created	C:\Windows\SysWOW64\Clojhf32.exe	Cgcnghpl.exe
File opened for modification	C:\Windows\SysWOW64\Boogmgkl.exe	Bqlfaj32.exe
File opened for modification	C:\Windows\SysWOW64\Cpfmmf32.exe	Cgoelh32.exe
File created	C:\Windows\SysWOW64\Ceebklai.exe	Cbffoabe.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Cbffoabe.exe	Ckmnbg32.exe
File opened for modification	C:\Windows\SysWOW64\Bkegah32.exe	Bjdkjpkb.exe
File created	C:\Windows\SysWOW64\Ccmpce32.exe	Bkegah32.exe
File opened for modification	C:\Windows\SysWOW64\Cbffoabe.exe	Ckmnbg32.exe
File opened for modification	C:\Windows\SysWOW64\Calcpm32.exe	Cnmfdb32.exe
File created	C:\Windows\SysWOW64\Cgfkmgnj.exe	Calcpm32.exe
File created	C:\Windows\SysWOW64\Ccofjipn.dll	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Calcpm32.exe	Cnmfdb32.exe
File created	C:\Windows\SysWOW64\Boogmgkl.exe	Bqlfaj32.exe
File opened for modification	C:\Windows\SysWOW64\Cgoelh32.exe	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Cpfmmf32.exe	Cgoelh32.exe
File created	C:\Windows\SysWOW64\Eepejpil.dll	Cpfmmf32.exe
File created	C:\Windows\SysWOW64\Cgcnghpl.exe	Ceebklai.exe
File created	C:\Windows\SysWOW64\Niebgj32.dll	Clojhf32.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Dnpciaef.exe
File created	C:\Windows\SysWOW64\Ibcihh32.dll	Bqlfaj32.exe
File created	C:\Windows\SysWOW64\Bkegah32.exe	Bjdkjpkb.exe
File opened for modification	C:\Windows\SysWOW64\Ccmpce32.exe	Bkegah32.exe
File created	C:\Windows\SysWOW64\Cgoelh32.exe	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Nefamd32.dll	Cgoelh32.exe
File created	C:\Windows\SysWOW64\Omakjj32.dll	Ceebklai.exe
File opened for modification	C:\Windows\SysWOW64\Cnmfdb32.exe	Clojhf32.exe
File created	C:\Windows\SysWOW64\Ajaclncd.dll	Cenljmgq.exe
File opened for modification	C:\Windows\SysWOW64\Cnfqccna.exe	Ckhdggom.exe
File created	C:\Windows\SysWOW64\Dnpciaef.exe	Djdgic32.exe
File created	C:\Windows\SysWOW64\Fchook32.dll	Bkegah32.exe
File opened for modification	C:\Windows\SysWOW64\Ckhdggom.exe	Cenljmgq.exe
File created	C:\Windows\SysWOW64\Cnfqccna.exe	Ckhdggom.exe
File created	C:\Windows\SysWOW64\Cfmhdpnc.exe	Cnfqccna.exe
File opened for modification	C:\Windows\SysWOW64\Ckmnbg32.exe	Cinafkkd.exe
File created	C:\Windows\SysWOW64\Djdgic32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Dnpciaef.exe	Djdgic32.exe
File created	C:\Windows\SysWOW64\Pmiljc32.dll	Djdgic32.exe
File created	C:\Windows\SysWOW64\Jidmcq32.dll	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Ckmnbg32.exe	Cinafkkd.exe
File opened for modification	C:\Windows\SysWOW64\Ceebklai.exe	Cbffoabe.exe
File created	C:\Windows\SysWOW64\Bqlfaj32.exe	cbec1e019fba21cefd7d0481ce384ca0N.exe
File opened for modification	C:\Windows\SysWOW64\Bqlfaj32.exe	cbec1e019fba21cefd7d0481ce384ca0N.exe
File created	C:\Windows\SysWOW64\Aaddfb32.dll	Ccmpce32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32†Eanenbmi.¾ll	Dpapaj32.exe

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfqccna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgoelh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cinafkkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckmnbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgcnghpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenljmgq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmhdpnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfmmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnmfdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgfkmgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnpciaef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhdggom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bqlfaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkegah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceebklai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbec1e019fba21cefd7d0481ce384ca0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjdkjpkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ccmpce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbffoabe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clojhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calcpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdgic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boogmgkl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	cbec1e019fba21cefd7d0481ce384ca0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgloog32.dll"	Cbffoabe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs\I´Pro¹Ser¬er3è	Dpapaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkegah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs\I´Pro¹Ser¬er3è\ = "C:\\Windows\\system32†Eanenbmi.¾ll"	Dpapaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeckm32.dll"	Cgcnghpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cinafkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaddfb32.dll"	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckhdggom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cgoelh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepejpil.dll"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	cbec1e019fba21cefd7d0481ce384ca0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nefamd32.dll"	Cgoelh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnmfdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Dnpciaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Boogmgkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpfmmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cinafkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cgcnghpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbocphim.dll"	Ckmnbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omakjj32.dll"	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofaejacl.dll"	Cnmfdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dnpciaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnmfdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fchook32.dll"	Bkegah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejemnf.dll"	Cnfqccna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cgcnghpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkegah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckhdggom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnfqccna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs\I´Pro¹Ser¬er3è\Th¨ead³ngMµdelÚ = "›par®men®"	Dpapaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdhe32.dll"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceebklai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CL‰ID\ÿs	Dpapaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccofjipn.dll"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	cbec1e019fba21cefd7d0481ce384ca0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ccmpce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhogdg32.dll"	Cinafkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbffoabe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jidmcq32.dll"	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niebgj32.dll"	Clojhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmiljc32.dll"	Djdgic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbnbjo32.dll"	cbec1e019fba21cefd7d0481ce384ca0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bqlfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibcihh32.dll"	Bqlfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Boogmgkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cenljmgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bqlfaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cenljmgq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2652	2544	cbec1e019fba21cefd7d0481ce384ca0N.exe	31
PID 2544 wrote to memory of 2652	2544	cbec1e019fba21cefd7d0481ce384ca0N.exe	31
PID 2544 wrote to memory of 2652	2544	cbec1e019fba21cefd7d0481ce384ca0N.exe	31
PID 2544 wrote to memory of 2652	2544	cbec1e019fba21cefd7d0481ce384ca0N.exe	31
PID 2652 wrote to memory of 2500	2652	Bqlfaj32.exe	32
PID 2652 wrote to memory of 2500	2652	Bqlfaj32.exe	32
PID 2652 wrote to memory of 2500	2652	Bqlfaj32.exe	32
PID 2652 wrote to memory of 2500	2652	Bqlfaj32.exe	32
PID 2500 wrote to memory of 2704	2500	Boogmgkl.exe	33
PID 2500 wrote to memory of 2704	2500	Boogmgkl.exe	33
PID 2500 wrote to memory of 2704	2500	Boogmgkl.exe	33
PID 2500 wrote to memory of 2704	2500	Boogmgkl.exe	33
PID 2704 wrote to memory of 2884	2704	Bjdkjpkb.exe	34
PID 2704 wrote to memory of 2884	2704	Bjdkjpkb.exe	34
PID 2704 wrote to memory of 2884	2704	Bjdkjpkb.exe	34
PID 2704 wrote to memory of 2884	2704	Bjdkjpkb.exe	34
PID 2884 wrote to memory of 2280	2884	Bkegah32.exe	35
PID 2884 wrote to memory of 2280	2884	Bkegah32.exe	35
PID 2884 wrote to memory of 2280	2884	Bkegah32.exe	35
PID 2884 wrote to memory of 2280	2884	Bkegah32.exe	35
PID 2280 wrote to memory of 2796	2280	Ccmpce32.exe	36
PID 2280 wrote to memory of 2796	2280	Ccmpce32.exe	36
PID 2280 wrote to memory of 2796	2280	Ccmpce32.exe	36
PID 2280 wrote to memory of 2796	2280	Ccmpce32.exe	36
PID 2796 wrote to memory of 2588	2796	Cenljmgq.exe	37
PID 2796 wrote to memory of 2588	2796	Cenljmgq.exe	37
PID 2796 wrote to memory of 2588	2796	Cenljmgq.exe	37
PID 2796 wrote to memory of 2588	2796	Cenljmgq.exe	37
PID 2588 wrote to memory of 2076	2588	Ckhdggom.exe	38
PID 2588 wrote to memory of 2076	2588	Ckhdggom.exe	38
PID 2588 wrote to memory of 2076	2588	Ckhdggom.exe	38
PID 2588 wrote to memory of 2076	2588	Ckhdggom.exe	38
PID 2076 wrote to memory of 2776	2076	Cnfqccna.exe	39
PID 2076 wrote to memory of 2776	2076	Cnfqccna.exe	39
PID 2076 wrote to memory of 2776	2076	Cnfqccna.exe	39
PID 2076 wrote to memory of 2776	2076	Cnfqccna.exe	39
PID 2776 wrote to memory of 2784	2776	Cfmhdpnc.exe	40
PID 2776 wrote to memory of 2784	2776	Cfmhdpnc.exe	40
PID 2776 wrote to memory of 2784	2776	Cfmhdpnc.exe	40
PID 2776 wrote to memory of 2784	2776	Cfmhdpnc.exe	40
PID 2784 wrote to memory of 2468	2784	Cgoelh32.exe	41
PID 2784 wrote to memory of 2468	2784	Cgoelh32.exe	41
PID 2784 wrote to memory of 2468	2784	Cgoelh32.exe	41
PID 2784 wrote to memory of 2468	2784	Cgoelh32.exe	41
PID 2468 wrote to memory of 2608	2468	Cpfmmf32.exe	42
PID 2468 wrote to memory of 2608	2468	Cpfmmf32.exe	42
PID 2468 wrote to memory of 2608	2468	Cpfmmf32.exe	42
PID 2468 wrote to memory of 2608	2468	Cpfmmf32.exe	42
PID 2608 wrote to memory of 1044	2608	Cinafkkd.exe	43
PID 2608 wrote to memory of 1044	2608	Cinafkkd.exe	43
PID 2608 wrote to memory of 1044	2608	Cinafkkd.exe	43
PID 2608 wrote to memory of 1044	2608	Cinafkkd.exe	43
PID 1044 wrote to memory of 2392	1044	Ckmnbg32.exe	44
PID 1044 wrote to memory of 2392	1044	Ckmnbg32.exe	44
PID 1044 wrote to memory of 2392	1044	Ckmnbg32.exe	44
PID 1044 wrote to memory of 2392	1044	Ckmnbg32.exe	44
PID 2392 wrote to memory of 2052	2392	Cbffoabe.exe	45
PID 2392 wrote to memory of 2052	2392	Cbffoabe.exe	45
PID 2392 wrote to memory of 2052	2392	Cbffoabe.exe	45
PID 2392 wrote to memory of 2052	2392	Cbffoabe.exe	45
PID 2052 wrote to memory of 1076	2052	Ceebklai.exe	46
PID 2052 wrote to memory of 1076	2052	Ceebklai.exe	46
PID 2052 wrote to memory of 1076	2052	Ceebklai.exe	46
PID 2052 wrote to memory of 1076	2052	Ceebklai.exe	46

C:\Users\Admin\AppData\Local\Temp\cbec1e019fba21cefd7d0481ce384ca0N.exe
"C:\Users\Admin\AppData\Local\Temp\cbec1e019fba21cefd7d0481ce384ca0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\Bqlfaj32.exe
  C:\Windows\system32\Bqlfaj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\Boogmgkl.exe
    C:\Windows\system32\Boogmgkl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\Bjdkjpkb.exe
      C:\Windows\system32\Bjdkjpkb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\Bkegah32.exe
        
        C:\Windows\system32\Bkegah32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\SysWOW64\Ccmpce32.exe
        
        C:\Windows\system32\Ccmpce32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Cenljmgq.exe
        
        C:\Windows\system32\Cenljmgq.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Ckhdggom.exe
        
        C:\Windows\system32\Ckhdggom.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Cnfqccna.exe
        
        C:\Windows\system32\Cnfqccna.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Cfmhdpnc.exe
        
        C:\Windows\system32\Cfmhdpnc.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Cgoelh32.exe
        
        C:\Windows\system32\Cgoelh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Cpfmmf32.exe
        
        C:\Windows\system32\Cpfmmf32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Cinafkkd.exe
        
        C:\Windows\system32\Cinafkkd.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\Ckmnbg32.exe
        
        C:\Windows\system32\Ckmnbg32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Cbffoabe.exe
        
        C:\Windows\system32\Cbffoabe.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Ceebklai.exe
        
        C:\Windows\system32\Ceebklai.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Cgcnghpl.exe
        
        C:\Windows\system32\Cgcnghpl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Clojhf32.exe
        
        C:\Windows\system32\Clojhf32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:680
        
        C:\Windows\SysWOW64\Cnmfdb32.exe
        
        C:\Windows\system32\Cnmfdb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Calcpm32.exe
        
        C:\Windows\system32\Calcpm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Cgfkmgnj.exe
        
        C:\Windows\system32\Cgfkmgnj.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2992
        
        C:\Windows\SysWOW64\Djdgic32.exe
        
        C:\Windows\system32\Djdgic32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Dnpciaef.exe
        
        C:\Windows\system32\Dnpciaef.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        24⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bjdkjpkb.exe

Filesize
128KB

MD5
49a225d43c6f5503a8ac31b012de862a

SHA1
08731dc4707dcaa67b9d01cb2c0db099d673b3b6

SHA256
550e76a6acf00ce28032b70f778b15cb7dbb294e05cf9592208358aacd9f5c94

SHA512
d4c41caf10fdfaa231cf5162d7be234cf68b98f5e6fdc021ce5417bcdef6a09345dd9c5b2044e118b6becebf2fdd10b79d1de12720b69c15d93d06506a13baf3

Download Submit
C:\Windows\SysWOW64\Boogmgkl.exe

Filesize
128KB

MD5
e0b99719f24f5cf604b0e5622621a3bc

SHA1
e5935ca473b7a632786ada6bbf21b401b0de2b7a

SHA256
9ef45fbe9764f7634a98dec2a3174bc72121e56615ea357113db1fb90150ffca

SHA512
3485b9baa5a4c6c629e21107aada233c3f160444ad36a963d9fa3c945225eec01000d8fd6b720d0011b840a88468b26e19a1a22c078923fa9522b8a5b5718537

Download Submit
C:\Windows\SysWOW64\Calcpm32.exe

Filesize
128KB

MD5
772c067aa19c6e946c8839dc51bb8c74

SHA1
15f6f1bb3310b1567856d2e7d9ffa9c66121a9d2

SHA256
602b625a270bcb453411b2598cdee89846b1c40b57f429a63646cc98e638d470

SHA512
c48e70eaee4dbf5876264d72acff701c2d4a8c249f7bf74bc66cdcbd78cff646ffd401e41c7d205c9b56f6e0d70d603479871f21016bb2f3fead42088350cf38

Download Submit
C:\Windows\SysWOW64\Cbffoabe.exe

Filesize
128KB

MD5
e701b3f95e71fae57252588a9afe5b41

SHA1
6af7567466420c5c294af56f71f2bb6780f14dbd

SHA256
4409b49aa007d2c3ef2ce19e8f170e36552f6530278af59360e8a750cc7bd885

SHA512
3410a0a2f419440597817e6d0406ca9c7c9605ee030857be5b0f7ac85747c58ebb0824c9f0532136e59f54a563b926d6abcebc1c23ebd44b792c009d3f51e3b8

Download Submit
C:\Windows\SysWOW64\Ccmpce32.exe

Filesize
128KB

MD5
bc1ad7b9390d09abb9ce13b6b62d6020

SHA1
c464432bb9f51094ea26748d0c76c1f70eef3c23

SHA256
3b9a258a281c370b96e781d0f7bc5a42073552a2c1aa5aead666a8ee74d9d075

SHA512
1ade4f317172ee18b8d56e666652284b1aa9c151bdac0cd66dec0e25b09ad3d4d49ab3743c4c1d9227b3a54d6b5ce50f963c7f9428c5bf1e73099706962aeaaf

Download Submit
C:\Windows\SysWOW64\Ceebklai.exe

Filesize
128KB

MD5
45308ee1156907eee8eb5ae3b9315bc2

SHA1
f91a44ac19346d6be5c347ed06ad0eb2ab5a8a0d

SHA256
b43760cb0965e818a2aeef06aedddb563bf4c7f217dc7d52a50c9011529c364f

SHA512
ca741b2dfa55bbffe1254258dc7073571b8cf49f161a09906bd7769bc18d9af1db8e80aaafc1d527220c00360fb1bb4ccc44c6146b5962f2940c91395989e9cd

Download Submit
C:\Windows\SysWOW64\Cenljmgq.exe

Filesize
128KB

MD5
f1fb85824094707bd2f0d54613cb34e6

SHA1
c596c95bb4cc7d75bba93e3f9a1f746d478cac71

SHA256
5807b01b72b642a7ab4ef40954883daa2e51b1fe46da1de33bb0f039dbe6b0df

SHA512
5d109f3c8b817624c8fc0ccb12d5b2b0ceb708f35c61e10c86b55c8e1e5a1d087b7d4c7105ec69a900862d0d622871fa47703ace06ce8b39ec302b307f4dcf11

Download Submit
C:\Windows\SysWOW64\Cgcnghpl.exe

Filesize
128KB

MD5
8d300d8a89adf2327ca1d0a4da984cca

SHA1
fe1e26ef99557d4a7eb198832619e3faaa5ae224

SHA256
5fa711139eff50af0cb098975ed9f512b6038752ae6960c79ccaa769af18e330

SHA512
6d7555ee606bc343b19f237c711968886668c42c4592c2a7c68af0da5a8e2c6a7f117ff925591ed684864b25be44ce46e13fc2fd43b907e01b79da779020994c

Download Submit
C:\Windows\SysWOW64\Cgfkmgnj.exe

Filesize
128KB

MD5
900dee04524b52651914473dceee89f2

SHA1
979724b3b185b8465e0f5592d65ffd788b02bd8e

SHA256
4ad67e0913ea4a33667974c3f32164b1c1417e24218db40fa1be4a4c8923097f

SHA512
78dfa00ae5f7df3a95c5039aa5cea9d509a3228cf52420f342bd5d87b92c6e94218d0671e4248a0e9818d32557de5c9695eed2324edf189b183173c52fd9870e

Download Submit
C:\Windows\SysWOW64\Cgoelh32.exe

Filesize
128KB

MD5
be6a84639bf2c8b050aa2de850e00e0e

SHA1
c7b26d33b883f62987ac729cc436144110c631ee

SHA256
aadeee716bec67bf9d2e3ef2b00ddf6446bf4d5cb910131710cfa488aa395343

SHA512
1187ef2c2866a581ef7bdf10756101a5ef44c6776eef849288350fbb7bd7831b464b1461601745b929cb9e07a1a45bcfcdc104936f77b73443b7b3cc139963d1

Download Submit
C:\Windows\SysWOW64\Cinafkkd.exe

Filesize
128KB

MD5
a2ef046f299b3ac79f66a94c3ed12a88

SHA1
559dbb848e62094837a4f45a260b776242ae05c6

SHA256
a99be8dba8a5fb6599116ccaf06604ee13da4500b3227f1f198fd57f5e0c52c4

SHA512
ba0898f913edbd768b09221fa82882f4fe413c80a690f656a084b6a21abd1b69697fdd0989e51a169faf3c038529f9f15b8526b50f1c95f17122af4c2d736e7c

Download Submit
C:\Windows\SysWOW64\Ckhdggom.exe

Filesize
128KB

MD5
b63e3cb8a45eef218f92f7be8e95715a

SHA1
e68b5f38e949a2a89479d76b3786e271c82a97dc

SHA256
692d3f4c5e08c0fa98f7e2529d8aeaab09c184aa4d8aa61ac92bd8254c6aa86e

SHA512
c5ced6df90e56c0a4e650c67dc167a032195c3625ac3032c4b362f2ccd1a3e3eac490315e9c99bd8de2ee597b060387c965c6876cdd127c1fd32b6625ffff548

Download Submit
C:\Windows\SysWOW64\Ckmnbg32.exe

Filesize
128KB

MD5
9ef94f02db4df380e626841859f865cd

SHA1
d25f371594a1acce619715a54b56118f34ba53f4

SHA256
fe45bcea1b555befbbd7d1554138750aa5e7065c4e39dc58555579bf45ed96d6

SHA512
0c8a7cfabfde27732f4589133e97b3644f8cd3bb8a1e3d96e4367a1de0871efb41cd3b6e6c820e10551e459af2d8b7e3aab74118885230d762b6533b72366992

Download Submit
C:\Windows\SysWOW64\Clojhf32.exe

Filesize
128KB

MD5
4ba329c054ba80b0f8874be273c841db

SHA1
5a6c70198ee64bae8fc17ecadee682f0665e9e08

SHA256
5fd75b33ef85505817ab1617cd34783881f9b8c0b746e2bc5b9eb54713e31914

SHA512
e967a26180857d089b0573131bb58a5dacd680b6617907fec431265681138964bb2aedacfc1bd1f33ed58cdbc2ffa8558263ba6533b80ac8899d4d82f6666d95

Download Submit
C:\Windows\SysWOW64\Cnfqccna.exe

Filesize
128KB

MD5
afa8e72a4d4260366fcd4a6678c2e8b1

SHA1
ba9cb2679a053ad4b8c95703a9c97adf7d135972

SHA256
94f0a070742c144aed458b6a7afd54e6139dc758639831b9492e6b50894d3d01

SHA512
29d9730d28ca4ba9f66dda0b915b113eb3de84ed15084dca8e7492727255abefcd24516c21fbd7c9e2f509aadde7ee834b04940a44d49113dae29da7aaf0d3fb

Download Submit
C:\Windows\SysWOW64\Cnmfdb32.exe

Filesize
128KB

MD5
d490ebe586b309bcc96ce42194b6b26a

SHA1
2ce12a906a123aa360bc834f58e880ead0aaf1fe

SHA256
2a893e5c338f1b69828f824be4c920538e54b478eb5a9c7e9d463091ef931598

SHA512
b1f58da3545fcab60ae84f7505a5a379271fef4851502174f707538d06f68130e60593876d029b185f4ee7db3b837b00b413589d76eb10e4c822559146e1188b

Download Submit
C:\Windows\SysWOW64\Cpfmmf32.exe

Filesize
128KB

MD5
5b39b6001c54c47f0de9029ea23b7bcc

SHA1
8b427a3ada01536738b0b08815538f1f864d6923

SHA256
37fbf988e1b7a8beff583cd215a1c32dab053095114c4001ef188751286112b8

SHA512
4f742d6c6d084122ad2a7297d1acede94635ed3fdf40d39fc9b373759b92234392553539a366a0742e992fd8331df6a8abb2ae02b6870fd09b49ed665e7cadc3

Download Submit
C:\Windows\SysWOW64\Djdgic32.exe

Filesize
128KB

MD5
6e1c76fbfc417e6929b3c4cb2e399a8c

SHA1
f9e84472752613d35676f5b6e71b2377e7b94738

SHA256
a76ff41c8b54a43952f5090406b143f3b230cc3e640f122c3edda713d035c263

SHA512
6be4fe4639914b73ffb7d0b9fad43fe244ab4bd362fff07260b627293ab48b0183bd2f49859e8fa9210fa2ce1fd04329f024648abf7a9bbcc44919d05c36414b

Download Submit
C:\Windows\SysWOW64\Dnpciaef.exe

Filesize
128KB

MD5
20316109a4d3bb1606cd123d50c8cc25

SHA1
96f90834bb7123ed39913e49f2fc805ae05ba105

SHA256
e06eb6e5fa57d2ff1e14d7365082e1c6f97a3f0e63c34fb1e0aa9e7744ce445f

SHA512
137e18b0075c91225dc8fc6e788f2b4686e46afba4459fee77b6e5e56b7e7983ab1fd06d72a628e490048a32a27ec110f531548e4fbfa636b8aa5fff0c28f0dd

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
128KB

MD5
cba3777ac3c79422e5516bda8956ed16

SHA1
b2df8f2c3551b0fac06beb824873e376b768f56f

SHA256
2299d5dd9e852e2e0b86de2dbd98d26d192278a4e804bd1ffd4f2b7c9055c58b

SHA512
628249c351994e97ff6e36c4c0febc69cf7e3528038f47ae19ae5fdcf1bdb198915dd30152c9be1cea418b5a9d95879a4ea8d27ee9227817de7c41327fb50891

Download Submit
C:\Windows\SysWOW64\Fchook32.dll

Filesize
7KB

MD5
f3fb6b72acc3562d89c1ecf91f0dec68

SHA1
13b44816e5d29f94a86d24429a84cb0a27bd1eed

SHA256
bc7f1446c343f43eee5f01e660cf9a578f65312fed020bef724db613ee173968

SHA512
5c1f89ccd2f25c72dec373c21b5726a64a17c997ce5f85b7e18b9a2d5c3cac42d39f4e22e864e1a096cfbab83ff8ebec0299d5424686dea143fce235245688cc

Download Submit
\Windows\SysWOW64\Bkegah32.exe

Filesize
128KB

MD5
650f71d7cc4887f411b26b5ac30b0b9c

SHA1
b175197b46c1a1cb041c02fd617565e98ab58ee6

SHA256
6df167f96918b91fa3e9335c2805dc67f79162678d9e30bfc8be139b4bd4f744

SHA512
983ff56bd1ec0eac3b3c96a79cee18cbc58bc92be35e0986b1d17ca81ebd8c68a928408c1305b5a9c9bebcf68b5ea957372b3a403169098d78ea917daf889a4b

Download Submit
\Windows\SysWOW64\Bqlfaj32.exe

Filesize
128KB

MD5
f643de67afcf0269b46675bf7f9935b0

SHA1
cffc5733176b71292bcf8113ba7d06b11aa3b810

SHA256
d8bd3c97c887c025ad7ce2af693d467388ea55d39a4df43d6cd97e1862fad34d

SHA512
3714a6f7069c1ef78a21524b7e90b6fd09ee9b23ca9366b4707e988d5ce3e1a9a11fa73be09f441ced18c171af0c6d87db8aaab3efb054db330a876bec8f4185

Download Submit
\Windows\SysWOW64\Cfmhdpnc.exe

Filesize
128KB

MD5
34388b3ad385f8817d78ba91eb7ab4bd

SHA1
52670b8a649fd4ef3c5fc13b7f60161f60843e88

SHA256
663bf132df95dd5b458411d12b17528a4a16f8f0bc4cda341294a37e48719880

SHA512
b82b62533e837e6a34747dad6cca60debd6de06767838428c9fad0239f18e0390c8c96f6ddb03cd6beb9b63f56b7814be67389e990bce9fe030e84d0479bc9c1

Download Submit
memory/680-232-0x0000000000440000-0x000000000047C000-memory.dmp

Filesize
240KB

Download
memory/680-231-0x0000000000440000-0x000000000047C000-memory.dmp

Filesize
240KB

Download
memory/680-290-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1044-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1044-171-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1076-296-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1076-218-0x0000000000300000-0x000000000033C000-memory.dmp

Filesize
240KB

Download
memory/1076-211-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1076-222-0x0000000000300000-0x000000000033C000-memory.dmp

Filesize
240KB

Download
memory/1484-287-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1532-289-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1532-266-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1532-271-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/1532-276-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/1748-250-0x0000000000280000-0x00000000002BC000-memory.dmp

Filesize
240KB

Download
memory/1748-244-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1748-254-0x0000000000280000-0x00000000002BC000-memory.dmp

Filesize
240KB

Download
memory/1748-293-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2052-297-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2052-209-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2052-197-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2076-304-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2076-106-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2260-288-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2260-285-0x0000000000290000-0x00000000002CC000-memory.dmp

Filesize
240KB

Download
memory/2280-302-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2392-294-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2392-184-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2400-292-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2400-239-0x0000000000440000-0x000000000047C000-memory.dmp

Filesize
240KB

Download
memory/2400-233-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2400-243-0x0000000000440000-0x000000000047C000-memory.dmp

Filesize
240KB

Download
memory/2468-295-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2500-26-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2500-39-0x0000000000480000-0x00000000004BC000-memory.dmp

Filesize
240KB

Download
memory/2500-299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2544-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2544-17-0x0000000000260000-0x000000000029C000-memory.dmp

Filesize
240KB

Download
memory/2544-308-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2588-105-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/2588-303-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2588-99-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2608-301-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2608-158-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2652-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2704-298-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2776-127-0x0000000000260000-0x000000000029C000-memory.dmp

Filesize
240KB

Download
memory/2776-119-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2776-300-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2784-305-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2784-140-0x0000000000250000-0x000000000028C000-memory.dmp

Filesize
240KB

Download
memory/2796-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2796-307-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2796-86-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2884-52-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2884-309-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2884-60-0x0000000000270000-0x00000000002AC000-memory.dmp

Filesize
240KB

Download
memory/2992-291-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2992-261-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download
memory/2992-255-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2992-265-0x00000000002D0000-0x000000000030C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads