de67c5e0b104db11d6e8a0928094eac1927829ae90c7d6ae3e4d83ef7cbd8de5

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da3575b5b45a3d61becabc2585550060N.exe
Size

465KB
MD5

da3575b5b45a3d61becabc2585550060
SHA1

ae0c7b877c55d04e218a245d8d763795bba1a767
SHA256

de67c5e0b104db11d6e8a0928094eac1927829ae90c7d6ae3e4d83ef7cbd8de5
SHA512

ce5b8bf25405e20cea50909b2f54765364fc8245a47f1eea37fa9bca8553437d5d16c708f1a3e0fb0a1da1654e2a51447ce2193839cebf5e7eba3a1726ad5c86
SSDEEP

6144:ZmNgK8cOSTp+STYaT15fq1+EKOCLxuC7Vg6h7VIjUo:Z1NwTZTYapU8N5VTVVIj

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihceigec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhhodg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jelonkph.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihaidhgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koimbpbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihaidhgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcdhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbncbpqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblflp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlfhke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klddlckd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieeimlep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlanpfkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiamp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdhbpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddble32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehfcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdmcdhhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnedgq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laffpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lddble32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koljgppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijpepcfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhkljfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijpepcfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koimbpbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaaldjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leoejh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Logicn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kopcbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnconj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Logicn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehfcl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnnnfalp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbijgp32.exe

Executes dropped EXE 58 IoCs

pid	Process
840	Ihaidhgf.exe
2800	Ijpepcfj.exe
4480	Ieeimlep.exe
1504	Ihceigec.exe
4604	Jnnnfalp.exe
2792	Jbijgp32.exe
1172	Jehfcl32.exe
728	Jlanpfkj.exe
2568	Jblflp32.exe
3964	Janghmia.exe
4600	Jdmcdhhe.exe
3872	Jhhodg32.exe
1532	Jjgkab32.exe
2152	Jbncbpqd.exe
4136	Jelonkph.exe
3912	Jhkljfok.exe
2572	Jlfhke32.exe
220	Jnedgq32.exe
2220	Jeolckne.exe
4016	Jhmhpfmi.exe
112	Jjkdlall.exe
1932	Jbbmmo32.exe
2308	Jaemilci.exe
3488	Jhoeef32.exe
4484	Koimbpbc.exe
4420	Kahinkaf.exe
4124	Khabke32.exe
3132	Kkpnga32.exe
4204	Koljgppp.exe
4392	Kajfdk32.exe
1480	Kdhbpf32.exe
404	Kkbkmqed.exe
2216	Kbjbnnfg.exe
4336	Kdkoef32.exe
1192	Kkegbpca.exe
2240	Kopcbo32.exe
652	Kaopoj32.exe
2784	Kdmlkfjb.exe
3520	Klddlckd.exe
836	Kocphojh.exe
3152	Kaaldjil.exe
2344	Kemhei32.exe
5128	Khkdad32.exe
5176	Lkiamp32.exe
5208	Lbqinm32.exe
5260	Leoejh32.exe
5292	Lhmafcnf.exe
5332	Lklnconj.exe
5376	Logicn32.exe
5416	Laffpi32.exe
5456	Lddble32.exe
5496	Lknjhokg.exe
5536	Lbebilli.exe
5576	Ledoegkm.exe
5616	Lhbkac32.exe
5656	Lolcnman.exe
5696	Lajokiaa.exe
5736	Ldikgdpe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lklnconj.exe	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Lhbkac32.exe	Ledoegkm.exe
File created	C:\Windows\SysWOW64\Koljgppp.exe	Kkpnga32.exe
File created	C:\Windows\SysWOW64\Kkbkmqed.exe	Kdhbpf32.exe
File created	C:\Windows\SysWOW64\Khkdad32.exe	Kemhei32.exe
File created	C:\Windows\SysWOW64\Koimbpbc.exe	Jhoeef32.exe
File created	C:\Windows\SysWOW64\Kaaldjil.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Eqfnqg32.dll	Kocphojh.exe
File created	C:\Windows\SysWOW64\Hiocnbpm.dll	Ieeimlep.exe
File opened for modification	C:\Windows\SysWOW64\Jelonkph.exe	Jbncbpqd.exe
File created	C:\Windows\SysWOW64\Afgfhaab.dll	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Jelonkph.exe	Jbncbpqd.exe
File opened for modification	C:\Windows\SysWOW64\Jjkdlall.exe	Jhmhpfmi.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Kaaldjil.exe
File created	C:\Windows\SysWOW64\Gdqeooaa.dll	Jeolckne.exe
File created	C:\Windows\SysWOW64\Kkpnga32.exe	Khabke32.exe
File opened for modification	C:\Windows\SysWOW64\Khkdad32.exe	Kemhei32.exe
File opened for modification	C:\Windows\SysWOW64\Lolcnman.exe	Lhbkac32.exe
File created	C:\Windows\SysWOW64\Jbijgp32.exe	Jnnnfalp.exe
File created	C:\Windows\SysWOW64\Jlanpfkj.exe	Jehfcl32.exe
File created	C:\Windows\SysWOW64\Jlfhke32.exe	Jhkljfok.exe
File opened for modification	C:\Windows\SysWOW64\Kopcbo32.exe	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Aomqdipk.dll	Kopcbo32.exe
File created	C:\Windows\SysWOW64\Ofnfbijk.dll	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Lkiamp32.exe	Khkdad32.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Laffpi32.exe
File created	C:\Windows\SysWOW64\Ckdlidhm.dll	Jehfcl32.exe
File created	C:\Windows\SysWOW64\Kahinkaf.exe	Koimbpbc.exe
File opened for modification	C:\Windows\SysWOW64\Kdkoef32.exe	Kbjbnnfg.exe
File created	C:\Windows\SysWOW64\Bkclkjqn.dll	Laffpi32.exe
File created	C:\Windows\SysWOW64\Jlbngnmk.dll	Jelonkph.exe
File opened for modification	C:\Windows\SysWOW64\Jbbmmo32.exe	Jjkdlall.exe
File created	C:\Windows\SysWOW64\Gedkhf32.dll	Koljgppp.exe
File created	C:\Windows\SysWOW64\Kopcbo32.exe	Kkegbpca.exe
File opened for modification	C:\Windows\SysWOW64\Lajokiaa.exe	Lolcnman.exe
File opened for modification	C:\Windows\SysWOW64\Ihaidhgf.exe	da3575b5b45a3d61becabc2585550060N.exe
File created	C:\Windows\SysWOW64\Ieeimlep.exe	Ijpepcfj.exe
File created	C:\Windows\SysWOW64\Jjgkab32.exe	Jhhodg32.exe
File opened for modification	C:\Windows\SysWOW64\Lhmafcnf.exe	Leoejh32.exe
File created	C:\Windows\SysWOW64\Kknikplo.dll	da3575b5b45a3d61becabc2585550060N.exe
File opened for modification	C:\Windows\SysWOW64\Jblflp32.exe	Jlanpfkj.exe
File created	C:\Windows\SysWOW64\Dodipp32.dll	Jnedgq32.exe
File opened for modification	C:\Windows\SysWOW64\Kbjbnnfg.exe	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Leoejh32.exe	Lbqinm32.exe
File opened for modification	C:\Windows\SysWOW64\Jdmcdhhe.exe	Janghmia.exe
File created	C:\Windows\SysWOW64\Balfdi32.dll	Jdmcdhhe.exe
File created	C:\Windows\SysWOW64\Oacmli32.dll	Kkpnga32.exe
File opened for modification	C:\Windows\SysWOW64\Jlfhke32.exe	Jhkljfok.exe
File created	C:\Windows\SysWOW64\Jhoeef32.exe	Jaemilci.exe
File created	C:\Windows\SysWOW64\Kemhei32.exe	Kaaldjil.exe
File created	C:\Windows\SysWOW64\Kdmlkfjb.exe	Kaopoj32.exe
File opened for modification	C:\Windows\SysWOW64\Kdmlkfjb.exe	Kaopoj32.exe
File created	C:\Windows\SysWOW64\Fcnhog32.dll	Khkdad32.exe
File opened for modification	C:\Windows\SysWOW64\Jaemilci.exe	Jbbmmo32.exe
File created	C:\Windows\SysWOW64\Khabke32.exe	Kahinkaf.exe
File created	C:\Windows\SysWOW64\Cboleq32.dll	Kbjbnnfg.exe
File opened for modification	C:\Windows\SysWOW64\Kkpnga32.exe	Khabke32.exe
File created	C:\Windows\SysWOW64\Kdhbpf32.exe	Kajfdk32.exe
File created	C:\Windows\SysWOW64\Ndnoffic.dll	Kajfdk32.exe
File created	C:\Windows\SysWOW64\Llfgke32.dll	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Laffpi32.exe	Logicn32.exe
File created	C:\Windows\SysWOW64\Jehfcl32.exe	Jbijgp32.exe
File created	C:\Windows\SysWOW64\Ijaaij32.dll	Jbbmmo32.exe
File opened for modification	C:\Windows\SysWOW64\Jhoeef32.exe	Jaemilci.exe

Program crash 1 IoCs

pid	pid_target	Process
5876	5736	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmlkfjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leoejh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehfcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jelonkph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeolckne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kopcbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da3575b5b45a3d61becabc2585550060N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnnnfalp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhbkac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lajokiaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijpepcfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaemilci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laffpi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjgkab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lolcnman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbqinm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlfhke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koljgppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdhbpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkiamp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkpnga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihaidhgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblflp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjkdlall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koimbpbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbjbnnfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbebilli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ledoegkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieeimlep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlanpfkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jnedgq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhoeef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklnconj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbijgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kahinkaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khkdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klddlckd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Janghmia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jdmcdhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkljfok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkbkmqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocphojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khabke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaaldjil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihceigec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbncbpqd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhmhpfmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbbmmo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfdklc32.dll"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnedgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnedgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbojb32.dll"	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkegbpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaopoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koljgppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdlmhj32.dll"	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbijgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lddble32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhoeef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkcnp32.dll"	Kaopoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkojhm32.dll"	Ihceigec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbijgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdmcdhhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kajfdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hopaik32.dll"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijpepcfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhkljfok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khecje32.dll"	Kahinkaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Balfdi32.dll"	Jdmcdhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjkdlall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkqcmb.dll"	Kaaldjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lolcnman.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihceigec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnnnfalp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eloeba32.dll"	Jaemilci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oacmli32.dll"	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	da3575b5b45a3d61becabc2585550060N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihaidhgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aannbg32.dll"	Janghmia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bibokqno.dll"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekdaogi.dll"	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lknjhokg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblflp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlfhke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijaaij32.dll"	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lddble32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjejmalo.dll"	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbqinm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbebilli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeolckne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhodke32.dll"	Khabke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbjbnnfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomqdipk.dll"	Kopcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbebilli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhhodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbbmmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koljgppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbqinm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfooh32.dll"	Lknjhokg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kknikplo.dll"	da3575b5b45a3d61becabc2585550060N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboleq32.dll"	Kbjbnnfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 840	4084	da3575b5b45a3d61becabc2585550060N.exe	90
PID 4084 wrote to memory of 840	4084	da3575b5b45a3d61becabc2585550060N.exe	90
PID 4084 wrote to memory of 840	4084	da3575b5b45a3d61becabc2585550060N.exe	90
PID 840 wrote to memory of 2800	840	Ihaidhgf.exe	91
PID 840 wrote to memory of 2800	840	Ihaidhgf.exe	91
PID 840 wrote to memory of 2800	840	Ihaidhgf.exe	91
PID 2800 wrote to memory of 4480	2800	Ijpepcfj.exe	92
PID 2800 wrote to memory of 4480	2800	Ijpepcfj.exe	92
PID 2800 wrote to memory of 4480	2800	Ijpepcfj.exe	92
PID 4480 wrote to memory of 1504	4480	Ieeimlep.exe	93
PID 4480 wrote to memory of 1504	4480	Ieeimlep.exe	93
PID 4480 wrote to memory of 1504	4480	Ieeimlep.exe	93
PID 1504 wrote to memory of 4604	1504	Ihceigec.exe	95
PID 1504 wrote to memory of 4604	1504	Ihceigec.exe	95
PID 1504 wrote to memory of 4604	1504	Ihceigec.exe	95
PID 4604 wrote to memory of 2792	4604	Jnnnfalp.exe	96
PID 4604 wrote to memory of 2792	4604	Jnnnfalp.exe	96
PID 4604 wrote to memory of 2792	4604	Jnnnfalp.exe	96
PID 2792 wrote to memory of 1172	2792	Jbijgp32.exe	97
PID 2792 wrote to memory of 1172	2792	Jbijgp32.exe	97
PID 2792 wrote to memory of 1172	2792	Jbijgp32.exe	97
PID 1172 wrote to memory of 728	1172	Jehfcl32.exe	98
PID 1172 wrote to memory of 728	1172	Jehfcl32.exe	98
PID 1172 wrote to memory of 728	1172	Jehfcl32.exe	98
PID 728 wrote to memory of 2568	728	Jlanpfkj.exe	99
PID 728 wrote to memory of 2568	728	Jlanpfkj.exe	99
PID 728 wrote to memory of 2568	728	Jlanpfkj.exe	99
PID 2568 wrote to memory of 3964	2568	Jblflp32.exe	100
PID 2568 wrote to memory of 3964	2568	Jblflp32.exe	100
PID 2568 wrote to memory of 3964	2568	Jblflp32.exe	100
PID 3964 wrote to memory of 4600	3964	Janghmia.exe	101
PID 3964 wrote to memory of 4600	3964	Janghmia.exe	101
PID 3964 wrote to memory of 4600	3964	Janghmia.exe	101
PID 4600 wrote to memory of 3872	4600	Jdmcdhhe.exe	102
PID 4600 wrote to memory of 3872	4600	Jdmcdhhe.exe	102
PID 4600 wrote to memory of 3872	4600	Jdmcdhhe.exe	102
PID 3872 wrote to memory of 1532	3872	Jhhodg32.exe	103
PID 3872 wrote to memory of 1532	3872	Jhhodg32.exe	103
PID 3872 wrote to memory of 1532	3872	Jhhodg32.exe	103
PID 1532 wrote to memory of 2152	1532	Jjgkab32.exe	104
PID 1532 wrote to memory of 2152	1532	Jjgkab32.exe	104
PID 1532 wrote to memory of 2152	1532	Jjgkab32.exe	104
PID 2152 wrote to memory of 4136	2152	Jbncbpqd.exe	105
PID 2152 wrote to memory of 4136	2152	Jbncbpqd.exe	105
PID 2152 wrote to memory of 4136	2152	Jbncbpqd.exe	105
PID 4136 wrote to memory of 3912	4136	Jelonkph.exe	106
PID 4136 wrote to memory of 3912	4136	Jelonkph.exe	106
PID 4136 wrote to memory of 3912	4136	Jelonkph.exe	106
PID 3912 wrote to memory of 2572	3912	Jhkljfok.exe	107
PID 3912 wrote to memory of 2572	3912	Jhkljfok.exe	107
PID 3912 wrote to memory of 2572	3912	Jhkljfok.exe	107
PID 2572 wrote to memory of 220	2572	Jlfhke32.exe	108
PID 2572 wrote to memory of 220	2572	Jlfhke32.exe	108
PID 2572 wrote to memory of 220	2572	Jlfhke32.exe	108
PID 220 wrote to memory of 2220	220	Jnedgq32.exe	109
PID 220 wrote to memory of 2220	220	Jnedgq32.exe	109
PID 220 wrote to memory of 2220	220	Jnedgq32.exe	109
PID 2220 wrote to memory of 4016	2220	Jeolckne.exe	110
PID 2220 wrote to memory of 4016	2220	Jeolckne.exe	110
PID 2220 wrote to memory of 4016	2220	Jeolckne.exe	110
PID 4016 wrote to memory of 112	4016	Jhmhpfmi.exe	111
PID 4016 wrote to memory of 112	4016	Jhmhpfmi.exe	111
PID 4016 wrote to memory of 112	4016	Jhmhpfmi.exe	111
PID 112 wrote to memory of 1932	112	Jjkdlall.exe	112

C:\Users\Admin\AppData\Local\Temp\da3575b5b45a3d61becabc2585550060N.exe
"C:\Users\Admin\AppData\Local\Temp\da3575b5b45a3d61becabc2585550060N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\Ihaidhgf.exe
  C:\Windows\system32\Ihaidhgf.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\Ijpepcfj.exe
    C:\Windows\system32\Ijpepcfj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\SysWOW64\Ieeimlep.exe
      C:\Windows\system32\Ieeimlep.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\Ihceigec.exe
        
        C:\Windows\system32\Ihceigec.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1504
      - C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:112
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4420
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4124
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1480
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2784
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3152
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 400
        60⤵
        Program crash
        
        PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5736 -ip 5736
1⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4508,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ieeimlep.exe

Filesize
465KB

MD5
13f31c3ec83b2ecdacf94f362733b535

SHA1
01a1fe1d482217c954db446f16e746c0778605e5

SHA256
d491355090e8c82d11eb37ffda199eea365cb33f0a60b638f36970f5268b7d55

SHA512
efe70e2324bdb232625d4ee05ca4b1517c6e6489df5c073e6c074435c8d4292a77219f36ed4af3f97225eb97eeac1bbf8a32c95053436cd1e8e6e32d02d160ab

Download Submit
C:\Windows\SysWOW64\Ihaidhgf.exe

Filesize
465KB

MD5
8ee632ad88a3e5918948d03b8cff02af

SHA1
6e2df17fe4b2182ed9f845c58c8fbd6a8c405f82

SHA256
1a2231eb7542dbdddb4cb80b608a77ec5e9441c2bf226a56a7aa5de4e4d0f0da

SHA512
e1840c8782e05c95266dcebd4035532cb7c1c8e87273747775f2ea1cafb851e8e2419287ae357a8ffeac6d197c4cc59ef6080783176a18450b726c7c9391bfad

Download Submit
C:\Windows\SysWOW64\Ihceigec.exe

Filesize
465KB

MD5
9d59d466b5490f93751be8acffec78fd

SHA1
4064ad41a2ec22cdbe319c428702220814964c99

SHA256
ec693f89dfac2bacbfc3a7e5e6dac9eacd0a3ce459668e05d3f238dab3905372

SHA512
c6f7bc343ce7d4239627fe11f41b15d06680c43fa19edb88eb6848cafeb1bd23b72a07982cef4c9a779d24bcc16b3d5fadd465d0f3a698fb72769aff4635bf85

Download Submit
C:\Windows\SysWOW64\Ijpepcfj.exe

Filesize
465KB

MD5
67dd63788051504a3d42d3bf9f37312b

SHA1
a1424640c26ea460fa5c4449f693d8f72b9dcd77

SHA256
4023c73d992a2fc3d004e661225d47748204595d04cb47b16dae2265c1cfd35a

SHA512
b05fd0dada4105654a921e48ea41cfafa989b69593a0f1c2ceeca6570305164af418d5ecf2889d96bdbf3de35facd2815e9e19095995f0e2995097f354b55ff7

Download Submit
C:\Windows\SysWOW64\Jaemilci.exe

Filesize
465KB

MD5
3a0e2194ee824807564ffc7e05288552

SHA1
4cdeed3521764f513cf5c82d8e222f8d62d43a99

SHA256
4e3ca512ede6c8b15cb3f37cb1f5a892bbfa619dd7597d2927be50e64eec1c64

SHA512
33512c768a82b1a3d5574e8bf380b64279ab97c77ab0ad0680df5f012a75b4aada32a609fadabf5ce59cafb4949ad5d7a085b1c72339a0a1921b15349fd99202

Download Submit
C:\Windows\SysWOW64\Janghmia.exe

Filesize
465KB

MD5
6da7e1b9c8215ccb48328bc3d71f8b03

SHA1
0aa8f8009188dc4ce55d9a13478d05385b319fae

SHA256
9279ec091b75f8f7f19d79ce8e8d681ffaab5a6b59f72717d8dfc0d39ce5210e

SHA512
d36bd0defdc3f48e20f9d12c3f57866da6c914c7cb6880ebf1a68e68cbb09b2e2982278a57ec5cbd8e69cf8b21d7e268e4e892f44d9afb8662579febbf4ec548

Download Submit
C:\Windows\SysWOW64\Jbbmmo32.exe

Filesize
465KB

MD5
53e27d0cf3ce552f11c3a87fc2e99078

SHA1
05324e725ffe369b74cba30d5b7e89e472504f2d

SHA256
0d1a3216e0e173902b4013b9b9dda7ab7f01914dffba7052445eb1e1fb55be3c

SHA512
45585a0f0f0302536f28a5db2646e0f947bc6b42f4872b3c0c38664af3894ead4e7fc937d48a9936b460b88e4f7679702e6ab813607a8c4667108945d5be4c6f

Download Submit
C:\Windows\SysWOW64\Jbijgp32.exe

Filesize
465KB

MD5
3c78269736082bb46966a35ccc2c87f1

SHA1
42fcfe56ca6f620141efee0ca99fd008a089e2e7

SHA256
27df330aade907429ad5f41286c9a4dfbda5c3777ec651813389036e735595eb

SHA512
d163d0391d1f1f905ba9766e21da980f6a5ad12da5a6c437124e897fdacaf7e84f99e400b8130201f7579e63af42a63d3deaff94c93072b8d86d78984a256ead

Download Submit
C:\Windows\SysWOW64\Jblflp32.exe

Filesize
465KB

MD5
2456a9637b683cc6e220c2fec1785cd7

SHA1
25a38f77c96944749dd234853e0787b440fda21f

SHA256
421dc4e4754292606f8736f79e7c46fba2056c7751d0a8538246ca142968da74

SHA512
a5ba7396d321d60538a61c3ccd64a0edc134468b81f9c3c8abf66d2c2c4910c1da18581e38631402a5bf6ce3c68cc814505e9eaa058075a242e46abcd3ad6471

Download Submit
C:\Windows\SysWOW64\Jbncbpqd.exe

Filesize
465KB

MD5
19e78e77b763dc0b4f2c6c4a6a8dd49f

SHA1
1e24cd2cf930fb4b0d34a387f88804b92a1f6885

SHA256
68466d9f9c52e43c2478f820ff3e11d7681342daede30169a7d99992b38ade6e

SHA512
8ad6dddad5e522ce2caabd5de2dfb651fb3a4d6596ddc71e40c63055b48efc86f7897d43c85937219a85545857c8e308099ae17aa3dd8b246f41b389ea6f3695

Download Submit
C:\Windows\SysWOW64\Jdmcdhhe.exe

Filesize
465KB

MD5
862a23c94af2c777377f17d5c494bfcd

SHA1
fe8b86cb3968f1bcef8446b4fc6d3a06880928b6

SHA256
2ff76a7f9c9117271e3a58ca0d89730c969c7f4adfa642fb846dab23a0f66593

SHA512
3405e19a57b9c5f62f5fc94dd1dab3ce51ab2819ac4e2e389eb84d5b8846f85d6a4c748a180e1c2c65c5c9e8eec38080f4206ba64f822b750c937a53b46d95ea

Download Submit
C:\Windows\SysWOW64\Jehfcl32.exe

Filesize
465KB

MD5
5630fb3fc53302f29b5ca33302976459

SHA1
54e2ba8daf5d7c4e1b01cf5ad407a61ad35d280f

SHA256
dd49f273204ebe91af78d8b6b6ca49df04ad8645cca6ebcac407e807a7ce53af

SHA512
99c459038d7733b747531c53363045a5aa01d0a087849ee3c0bc6e466bd43db454c05a4078ed578f8f7af5ee3c6cebc212ed959aff63a9ac02dd8289d0d3a9f8

Download Submit
C:\Windows\SysWOW64\Jelonkph.exe

Filesize
465KB

MD5
03e15394e4a4424cff91b86306b80d2c

SHA1
862482c2788b52933328ec0a76501fb35934a835

SHA256
d30f24b74eb615e2308a9c840ce858a29623f2498f763954885561d8aee34a06

SHA512
238465c35a2e30b708039bfe9f8ae13c97b3dbef6d0b386bb28f09bb1da0f942c842cb672fe74527b44a523c4b1ec5abaea39fa364585690373794110e21d470

Download Submit
C:\Windows\SysWOW64\Jeolckne.exe

Filesize
465KB

MD5
66050d1a6404a15ceb7274614d713f26

SHA1
f21866eca0f21b1b7125798ea94615e0c4ea79c9

SHA256
e211963e457aa5836da53d3fe1bbc65e8b0d26bab22d527988ea35f4437549d9

SHA512
2a6d58ae5a2403ec440ffbfdc56c7b3c63f73b53517cffc49c890f528ece47eb39c0b39f3a66c2d939ab9d3d74b9ea24ae55046bfdd35cd46d60c44c0e0f3160

Download Submit
C:\Windows\SysWOW64\Jhhodg32.exe

Filesize
465KB

MD5
d2f1e008eb39614707bd17d2c924ed7f

SHA1
dcabdf317a9a0e4311b7b1036764de24eaf0b4e6

SHA256
04c395bab5bb7be8211f4ada8ee888c8273d59ee346369116802e8e4b03b07f7

SHA512
1cb52cac1d4bac6b87644a5475e489d33ee784c50752048b0dc0bb21f39aa7cdb4d1381e8e8bfeacf54e4c33b3c7182cddc7e0aaadbccb0cac82174a9021784a

Download Submit
C:\Windows\SysWOW64\Jhkljfok.exe

Filesize
465KB

MD5
96007ff96f8c20eb6d7240fb61aa89e9

SHA1
610e78edda02b8054ad5167d8834c62636e52669

SHA256
cc9e31f045dd5d2247de3dac936e619ce4e059ad4ad2388b635f341265d84f42

SHA512
2097fda23a3ae2e4a92d28f31789b35bf7adb71eb84abb22889b70a54773b1f4c27e25f7a71a38b710d0a9130adbe461bda456980f05d2399adf8df57ed8aea0

Download Submit
C:\Windows\SysWOW64\Jhmhpfmi.exe

Filesize
465KB

MD5
a039659dce06bf4ce2a5c963bc0b838b

SHA1
03c75c0762980d3d989519d2055dd6be7a045ef6

SHA256
a9aede55d91c5fcad081bf1c8a9e2fb5bc7c122f03a9b870bf60456be14a7ad0

SHA512
942357dc285c7c7874749708e0bdb2b0c659bb3631e80c050fb4a5bcf9aaec754a7b2914d86d641c56b9736bb66d87d61d78be88788185934dca9e9682fb6692

Download Submit
C:\Windows\SysWOW64\Jhoeef32.exe

Filesize
465KB

MD5
cf1294da692da49e5b7e6ccf8ae54440

SHA1
5003bb81c7c27bf661f111f93e70cff48e91c11b

SHA256
6063db8a402de31e56f09a1f52ec193198499ebb7699ba7dbfa50a9d2bad4f85

SHA512
6f6dd429252fe5d5af53c119ff5253dbab0345d36470a3461bfe9d778d122cc1c2faf4ad1d556458dcf10129019b297f3a418fac9521b34bf4cbc52b0c093022

Download Submit
C:\Windows\SysWOW64\Jjgkab32.exe

Filesize
465KB

MD5
c92c4a5084fa872189f1290ee8a8c908

SHA1
7333541efcb305bdd8cb0e2719678c8107bc8449

SHA256
4b745521dafb8753a28c792180747e076847984ff7c1d6d73a39b3585065891b

SHA512
55fd46c92fdfaefc22790f4c1ad7ae16b4c6825248b3d3ab502e622ba5575445f2a2c377fbb4156cc4514d41fa71a7ef35d1be912d838258565e6fe5904d838f

Download Submit
C:\Windows\SysWOW64\Jjkdlall.exe

Filesize
465KB

MD5
cfa70c3f3b8465e29bbff952a210b36d

SHA1
94a3a9bbc511afe44494c99de84512486126ecb7

SHA256
403b941fe8d79793e60899ac7246f168eb6d60718153ee7929f2f0c5bbf4cf9c

SHA512
d3e30a082a708c7a475b739a968874214ca6c45f863c6aaa585499f0fa046411c50b590b881a2912c36d378708887db5be23e084b326a66be1c00f5862ca1821

Download Submit
C:\Windows\SysWOW64\Jlanpfkj.exe

Filesize
465KB

MD5
0d5cef5dc1b5d35a0b5a341725d87a5a

SHA1
a2e553e6cf5b7089f7b928c4bed058aeacace71f

SHA256
5135e6e5b5c9a855d4861ba15f1427e1a99a91bd020b42f2f5029c2b7ed153c1

SHA512
161fd1e533979822a03d3e97711c501663443a6feb4ceb636c5782de2d880183f0f6fb2c0b89c8f7c908a53f39cbe5f0877455ea2e6d77c511aabf8be6408736

Download Submit
C:\Windows\SysWOW64\Jlfhke32.exe

Filesize
465KB

MD5
d05235204ee52cf8522a41a8d2b4532e

SHA1
8a4b083637f40b805ba29842f54da762803d2e12

SHA256
5982706ecea6979e472b6f6b82846124c6e840bd83631a34104580b5953ad0b9

SHA512
482495bd05af4df0ce93b0186f6890795fd035a058f42c552ff793e21b23acba9d226c0a81525ddcea934565711e5aac2b45ce04ebfcc624ddbdb086565602ff

Download Submit
C:\Windows\SysWOW64\Jnedgq32.exe

Filesize
465KB

MD5
19684109f10c332cf76642dd1f486fa4

SHA1
d2826e2f7d959657d854e0f8b45d6f6033813690

SHA256
b99366a5296020347ef85c11a95a54c9f212c20a68163d4fb279095abc9b76cf

SHA512
5441fd793b8d2078fc186da659695be1f01ff7222836ac11b3f41c0711a22aa87e5c65cf99f8329d9904f624c772a7994021cf42f0b3c8682639bbb85d81bc4d

Download Submit
C:\Windows\SysWOW64\Jnnnfalp.exe

Filesize
465KB

MD5
0501e9be562b4fbe915ff9c8c63523f5

SHA1
25764c3351992424bc3986b7c061f050c0f7ca3e

SHA256
d901c1c5a9ea738479227d089df752e8cac4d5cd70508f47b96e3822e95491f6

SHA512
83121fb5c8763eef384f088477a0ab2eefc55d1e8f88bcb3c8005439c73c5046072a5d0b2d6cef994496d9f41de3b9a0d1cee025ed6bcb77e1580e29ae130294

Download Submit
C:\Windows\SysWOW64\Kahinkaf.exe

Filesize
465KB

MD5
22945a3376ab7cc19257cfebaa6b3a9b

SHA1
46e5effc079e3dd30745a0a0f9f2bbdb87d15d52

SHA256
35a18c0af3c5934e8e15795f2032587e76e389e286d0676212f5941cc0b0a462

SHA512
00b75a491a03043bba84347a0f0ecf66faa70288868145f4a938d73f683df14e1b62b5543ae55ee4f8e56750980a8bbd053d1d8d3c20d3d5b93a81e0949085ed

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
465KB

MD5
17c1861352d9c215a3c4810b5b7921a4

SHA1
d395882d258ab1c2e3e2c686d918bab4afd6aa40

SHA256
5a166221e9dc6fc705da0c89c37974f73a4e5ffc4ae2778eefdd9a7e919e272f

SHA512
67aa00d6f60587c8932997b18d8c819951eb05cb11d63eb71a3e851026f9b2e1bbb8af794dce18aaeca3cb25e548efb9348823130a0c782b5f2f058dfb170a7e

Download Submit
C:\Windows\SysWOW64\Kdhbpf32.exe

Filesize
465KB

MD5
828e6c8dc1e66d682deae00821a92077

SHA1
629d8d5fedb5247e1ccf6eb47284096a70350480

SHA256
a6d8d7ff9eda592b67c4f39c612754dd9fa990512e8677db894b13e756fe8631

SHA512
a8a53fdd133146bdb04e8051e6f9d5191982a0b26a1718fa1d816a9603fbbd544ccbb57e5567d229e77a3da8ed3ecb7dcbcc1eaf865e84963ea7b3b1065ca18e

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
465KB

MD5
18b72783dc4bba1622eff63ac985b453

SHA1
b9b139817699af3e3da4f1b60ea868a4240ef090

SHA256
be13dfdf518124d370bb1945d43d7640c0c3f0ab00190792f79d2cbacb95b7ad

SHA512
38e6cfe6775418ba5b4579675fd807cd8a96649d78e2b7db56be9049985a270404e74d27a1e736e71390dbe2a8153788457af9351893366627981e3b22ea29ce

Download Submit
C:\Windows\SysWOW64\Kkbkmqed.exe

Filesize
465KB

MD5
7bcc6a41902c192ec4f653123600af3e

SHA1
fa58eaeb02dd63f2ae1a96e9c7ab27c0078788ce

SHA256
abdf0902dc4c8a77ba22b561bdc7b4298af5d7ef54da4098ff803a82ea1b7321

SHA512
94c6cc57ae15c18f786baeb75d786d3d340933d9245a76b95b8344b51d515169b027944793648698ddbc0563cf5e6baa07102056e0fc3329e286b798273b32bc

Download Submit
C:\Windows\SysWOW64\Kkpnga32.exe

Filesize
465KB

MD5
c074ee6aeaecc0946796b6acc7182210

SHA1
648332dfdb5fe92d4911f07f6e0e0b86eb643f04

SHA256
30cdf721dab7fbd2306b62bf88bfbde2abe95a34c03cc9a34bb7c72be6217122

SHA512
599f0e770636d8a275097a1bd5d39bb726fc3c7d7dae7dd64d0fdd915ab9c3a471ef65203575422937bd50bfee6aa4f3b6fc113968ea9d0aa917ec7b8263c931

Download Submit
C:\Windows\SysWOW64\Koimbpbc.exe

Filesize
465KB

MD5
d97fa5e381082061e7d7b3b71a6b596e

SHA1
e403c159efcc9749da5235773f4e62aa1cfeb28a

SHA256
06d3ab45bae54cb82ece23261714f3dbcbccd6f921dce96141b3d26f9927ed50

SHA512
dd71241331ddc6dc64ded8460f8978fa1f9d8b8ca3e7288d9e7b3180e67db3ddec4e4944ff431386784ec1b92abb461d303b4231b3dc11ce3371a765634eb73a

Download Submit
C:\Windows\SysWOW64\Koljgppp.exe

Filesize
465KB

MD5
b06183e5fefd55443023970b1005b1ce

SHA1
d9efe5ec7b36b77ae973fe953e144b0c88f56fce

SHA256
1bb9442b7b834eaca7d9a339d1e30fed8f14cfc1c21c12b97646881bef7441da

SHA512
9bdad31d2ad8a1cb899d45a7448436bc36c31725739c7ae663e0be780f04fba8fd791e58b10b1ae275d6f4ef0f611e05f0637fdfca6575f7771de7ba2eda2cab

Download Submit
memory/112-174-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/220-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/652-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/836-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/840-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/840-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1172-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1192-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1480-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1504-38-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2152-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2240-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2568-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2784-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2800-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3488-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3872-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3912-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3964-85-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4016-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4084-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-476-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4204-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4336-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4600-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5128-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5176-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5208-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5260-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5292-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5332-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5376-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5416-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5456-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5496-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5536-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5576-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5616-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5656-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5696-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5736-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads