340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
Size

304KB
MD5

df92793310a429cfd7e801f4ee8a0d40
SHA1

7f3b074be4ec2a8e72288930012bdfbd7d9fc1bb
SHA256

340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81
SHA512

48979b23b051dfd142ee8d004f9c31abe097bd47e49bb671752362cadd06a97616816c5873f4f20e98cb2030aac21593fefce9e7ace08528745296268f6632d3
SSDEEP

6144:uf6jdNoB3Yt3XbaHJUByvZ6Mxv5Rar3O6B9fZSLhZmzbByvZ6MxE:uuM6t3XGCByvNv54B9f01ZmHByvNE

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilnlom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhmjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kefiopki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqaiecjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mofmobmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilibdmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofckhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocgbend.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Modpib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likhem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppnenlka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Objkmkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefiopki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibegfglj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ihdldn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ilibdmgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Modpib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofckhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opbean32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihdldn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbhgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oiccje32.exe

Executes dropped EXE 59 IoCs

pid	Process
624	Ihkjno32.exe
4232	Iijfhbhl.exe
1540	Ilibdmgp.exe
3628	Ibegfglj.exe
3504	Ilnlom32.exe
2076	Ihdldn32.exe
3732	Jidinqpb.exe
1872	Jekjcaef.exe
4548	Jldbpl32.exe
2352	Jhkbdmbg.exe
1120	Jeocna32.exe
2988	Johggfha.exe
2340	Jllhpkfk.exe
5016	Kefiopki.exe
1508	Kapfiqoj.exe
4600	Kocgbend.exe
3052	Klggli32.exe
1760	Likhem32.exe
3180	Lebijnak.exe
3992	Lcfidb32.exe
980	Lomjicei.exe
5100	Lplfcf32.exe
2080	Lhgkgijg.exe
5072	Mfkkqmiq.exe
2180	Modpib32.exe
2208	Mofmobmo.exe
3900	Mohidbkl.exe
4076	Mqhfoebo.exe
5068	Mhckcgpj.exe
3584	Njbgmjgl.exe
4520	Nbnlaldg.exe
4908	Noblkqca.exe
1068	Nqaiecjd.exe
3512	Njjmni32.exe
4648	Nofefp32.exe
640	Niojoeel.exe
2536	Ooibkpmi.exe
4572	Ofckhj32.exe
3820	Oqhoeb32.exe
5104	Objkmkjj.exe
4120	Oiccje32.exe
2476	Oonlfo32.exe
3064	Ojcpdg32.exe
2712	Oophlo32.exe
4016	Opbean32.exe
4668	Ojhiogdd.exe
4456	Ppdbgncl.exe
3776	Pjjfdfbb.exe
3008	Ppgomnai.exe
4952	Pjlcjf32.exe
3724	Ppikbm32.exe
3216	Pbhgoh32.exe
1684	Piapkbeg.exe
2944	Paihlpfi.exe
3692	Pbjddh32.exe
1800	Pidlqb32.exe
2084	Ppnenlka.exe
3720	Pfhmjf32.exe
644	Pififb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hobbfhjl.dll	Mfkkqmiq.exe
File created	C:\Windows\SysWOW64\Niojoeel.exe	Nofefp32.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pbjddh32.exe
File created	C:\Windows\SysWOW64\Olekop32.dll	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
File created	C:\Windows\SysWOW64\Iijfhbhl.exe	Ihkjno32.exe
File opened for modification	C:\Windows\SysWOW64\Jekjcaef.exe	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Jicchk32.dll	Lcfidb32.exe
File created	C:\Windows\SysWOW64\Njbgmjgl.exe	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Njjmni32.exe	Nqaiecjd.exe
File created	C:\Windows\SysWOW64\Pififb32.exe	Pfhmjf32.exe
File opened for modification	C:\Windows\SysWOW64\Johggfha.exe	Jeocna32.exe
File created	C:\Windows\SysWOW64\Pekihfdc.dll	Johggfha.exe
File created	C:\Windows\SysWOW64\Pjlcjf32.exe	Ppgomnai.exe
File opened for modification	C:\Windows\SysWOW64\Pbhgoh32.exe	Ppikbm32.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Piapkbeg.exe
File created	C:\Windows\SysWOW64\Npmknd32.dll	Jekjcaef.exe
File created	C:\Windows\SysWOW64\Npakijcp.dll	Modpib32.exe
File created	C:\Windows\SysWOW64\Ppgomnai.exe	Pjjfdfbb.exe
File opened for modification	C:\Windows\SysWOW64\Paihlpfi.exe	Piapkbeg.exe
File created	C:\Windows\SysWOW64\Nofefp32.exe	Njjmni32.exe
File created	C:\Windows\SysWOW64\Ooibkpmi.exe	Niojoeel.exe
File created	C:\Windows\SysWOW64\Ilibdmgp.exe	Iijfhbhl.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Leboon32.dll	Kefiopki.exe
File created	C:\Windows\SysWOW64\Lplfcf32.exe	Lomjicei.exe
File created	C:\Windows\SysWOW64\Lhgkgijg.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Nbnlaldg.exe	Njbgmjgl.exe
File created	C:\Windows\SysWOW64\Gggikgqe.dll	Niojoeel.exe
File created	C:\Windows\SysWOW64\Knnele32.dll	Kocgbend.exe
File opened for modification	C:\Windows\SysWOW64\Likhem32.exe	Klggli32.exe
File created	C:\Windows\SysWOW64\Ijcomn32.dll	Lhgkgijg.exe
File opened for modification	C:\Windows\SysWOW64\Ofckhj32.exe	Ooibkpmi.exe
File opened for modification	C:\Windows\SysWOW64\Oiccje32.exe	Objkmkjj.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Oophlo32.exe
File created	C:\Windows\SysWOW64\Ghaeocdd.dll	Oqhoeb32.exe
File created	C:\Windows\SysWOW64\Lfgnho32.dll	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Mgccelpk.dll	Mohidbkl.exe
File created	C:\Windows\SysWOW64\Nqaiecjd.exe	Noblkqca.exe
File opened for modification	C:\Windows\SysWOW64\Nofefp32.exe	Njjmni32.exe
File opened for modification	C:\Windows\SysWOW64\Ojcpdg32.exe	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Dblamanm.dll	Ppikbm32.exe
File created	C:\Windows\SysWOW64\Ihdldn32.exe	Ilnlom32.exe
File opened for modification	C:\Windows\SysWOW64\Lplfcf32.exe	Lomjicei.exe
File opened for modification	C:\Windows\SysWOW64\Modpib32.exe	Mfkkqmiq.exe
File created	C:\Windows\SysWOW64\Nhoped32.dll	Pjjfdfbb.exe
File opened for modification	C:\Windows\SysWOW64\Ihdldn32.exe	Ilnlom32.exe
File opened for modification	C:\Windows\SysWOW64\Jldbpl32.exe	Jekjcaef.exe
File created	C:\Windows\SysWOW64\Lebijnak.exe	Likhem32.exe
File created	C:\Windows\SysWOW64\Alapqh32.dll	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Pfhmjf32.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Fllhjc32.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Ppdbgncl.exe	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Iijfhbhl.exe	Ihkjno32.exe
File created	C:\Windows\SysWOW64\Ohlemeao.dll	Jldbpl32.exe
File opened for modification	C:\Windows\SysWOW64\Kocgbend.exe	Kapfiqoj.exe
File opened for modification	C:\Windows\SysWOW64\Mfkkqmiq.exe	Lhgkgijg.exe
File created	C:\Windows\SysWOW64\Mohidbkl.exe	Mofmobmo.exe
File created	C:\Windows\SysWOW64\Noblkqca.exe	Nbnlaldg.exe
File created	C:\Windows\SysWOW64\Ppikbm32.exe	Pjlcjf32.exe
File created	C:\Windows\SysWOW64\Hlkbkddd.dll	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Oophlo32.exe	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Lodabb32.dll	Ojcpdg32.exe
File created	C:\Windows\SysWOW64\Deocpk32.dll	Iijfhbhl.exe
File created	C:\Windows\SysWOW64\Iaejqcdo.dll	Jidinqpb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4532	644	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhkbdmbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jllhpkfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbjddh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lebijnak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhgkgijg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofckhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mohidbkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjfdfbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhiogdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pidlqb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Johggfha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppnenlka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhmjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oonlfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oophlo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jidinqpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klggli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mofmobmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqaiecjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilibdmgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihdldn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqhfoebo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojcpdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooibkpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjlcjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piapkbeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kapfiqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhckcgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnlaldg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihkjno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilnlom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likhem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modpib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldbpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfkkqmiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jekjcaef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeocna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Noblkqca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opbean32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcfidb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njbgmjgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofefp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niojoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Objkmkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paihlpfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefiopki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocgbend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lomjicei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiccje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbhgoh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npakijcp.dll"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqkplq32.dll"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkbkddd.dll"	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fefmmcgh.dll"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnknop32.dll"	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohlemeao.dll"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllhjc32.dll"	Opbean32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eapjpi32.dll"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnele32.dll"	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnllm32.dll"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Noblkqca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahhjomjk.dll"	Oonlfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mfkkqmiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lomjicei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mofmobmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debcil32.dll"	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Niojoeel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njjmni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqhfoebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nofefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppdbgncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfgnho32.dll"	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jhkbdmbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lodabb32.dll"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jicchk32.dll"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leboon32.dll"	Kefiopki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hapfpelh.dll"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lplfcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jldbpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjjkejin.dll"	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egcpgp32.dll"	Mqhfoebo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhqamj.dll"	Noblkqca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ooibkpmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oqhoeb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 624	1056	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe	87
PID 1056 wrote to memory of 624	1056	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe	87
PID 1056 wrote to memory of 624	1056	340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe	87
PID 624 wrote to memory of 4232	624	Ihkjno32.exe	88
PID 624 wrote to memory of 4232	624	Ihkjno32.exe	88
PID 624 wrote to memory of 4232	624	Ihkjno32.exe	88
PID 4232 wrote to memory of 1540	4232	Iijfhbhl.exe	89
PID 4232 wrote to memory of 1540	4232	Iijfhbhl.exe	89
PID 4232 wrote to memory of 1540	4232	Iijfhbhl.exe	89
PID 1540 wrote to memory of 3628	1540	Ilibdmgp.exe	90
PID 1540 wrote to memory of 3628	1540	Ilibdmgp.exe	90
PID 1540 wrote to memory of 3628	1540	Ilibdmgp.exe	90
PID 3628 wrote to memory of 3504	3628	Ibegfglj.exe	91
PID 3628 wrote to memory of 3504	3628	Ibegfglj.exe	91
PID 3628 wrote to memory of 3504	3628	Ibegfglj.exe	91
PID 3504 wrote to memory of 2076	3504	Ilnlom32.exe	92
PID 3504 wrote to memory of 2076	3504	Ilnlom32.exe	92
PID 3504 wrote to memory of 2076	3504	Ilnlom32.exe	92
PID 2076 wrote to memory of 3732	2076	Ihdldn32.exe	93
PID 2076 wrote to memory of 3732	2076	Ihdldn32.exe	93
PID 2076 wrote to memory of 3732	2076	Ihdldn32.exe	93
PID 3732 wrote to memory of 1872	3732	Jidinqpb.exe	94
PID 3732 wrote to memory of 1872	3732	Jidinqpb.exe	94
PID 3732 wrote to memory of 1872	3732	Jidinqpb.exe	94
PID 1872 wrote to memory of 4548	1872	Jekjcaef.exe	95
PID 1872 wrote to memory of 4548	1872	Jekjcaef.exe	95
PID 1872 wrote to memory of 4548	1872	Jekjcaef.exe	95
PID 4548 wrote to memory of 2352	4548	Jldbpl32.exe	96
PID 4548 wrote to memory of 2352	4548	Jldbpl32.exe	96
PID 4548 wrote to memory of 2352	4548	Jldbpl32.exe	96
PID 2352 wrote to memory of 1120	2352	Jhkbdmbg.exe	97
PID 2352 wrote to memory of 1120	2352	Jhkbdmbg.exe	97
PID 2352 wrote to memory of 1120	2352	Jhkbdmbg.exe	97
PID 1120 wrote to memory of 2988	1120	Jeocna32.exe	98
PID 1120 wrote to memory of 2988	1120	Jeocna32.exe	98
PID 1120 wrote to memory of 2988	1120	Jeocna32.exe	98
PID 2988 wrote to memory of 2340	2988	Johggfha.exe	99
PID 2988 wrote to memory of 2340	2988	Johggfha.exe	99
PID 2988 wrote to memory of 2340	2988	Johggfha.exe	99
PID 2340 wrote to memory of 5016	2340	Jllhpkfk.exe	100
PID 2340 wrote to memory of 5016	2340	Jllhpkfk.exe	100
PID 2340 wrote to memory of 5016	2340	Jllhpkfk.exe	100
PID 5016 wrote to memory of 1508	5016	Kefiopki.exe	101
PID 5016 wrote to memory of 1508	5016	Kefiopki.exe	101
PID 5016 wrote to memory of 1508	5016	Kefiopki.exe	101
PID 1508 wrote to memory of 4600	1508	Kapfiqoj.exe	102
PID 1508 wrote to memory of 4600	1508	Kapfiqoj.exe	102
PID 1508 wrote to memory of 4600	1508	Kapfiqoj.exe	102
PID 4600 wrote to memory of 3052	4600	Kocgbend.exe	103
PID 4600 wrote to memory of 3052	4600	Kocgbend.exe	103
PID 4600 wrote to memory of 3052	4600	Kocgbend.exe	103
PID 3052 wrote to memory of 1760	3052	Klggli32.exe	104
PID 3052 wrote to memory of 1760	3052	Klggli32.exe	104
PID 3052 wrote to memory of 1760	3052	Klggli32.exe	104
PID 1760 wrote to memory of 3180	1760	Likhem32.exe	105
PID 1760 wrote to memory of 3180	1760	Likhem32.exe	105
PID 1760 wrote to memory of 3180	1760	Likhem32.exe	105
PID 3180 wrote to memory of 3992	3180	Lebijnak.exe	106
PID 3180 wrote to memory of 3992	3180	Lebijnak.exe	106
PID 3180 wrote to memory of 3992	3180	Lebijnak.exe	106
PID 3992 wrote to memory of 980	3992	Lcfidb32.exe	107
PID 3992 wrote to memory of 980	3992	Lcfidb32.exe	107
PID 3992 wrote to memory of 980	3992	Lcfidb32.exe	107
PID 980 wrote to memory of 5100	980	Lomjicei.exe	108

C:\Users\Admin\AppData\Local\Temp\340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe
"C:\Users\Admin\AppData\Local\Temp\340f0de5444b3847f1de25477565895e85abca2809c3cc55a167577528cf2d81N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\Ihkjno32.exe
  C:\Windows\system32\Ihkjno32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\Iijfhbhl.exe
    C:\Windows\system32\Iijfhbhl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\Ilibdmgp.exe
      C:\Windows\system32\Ilibdmgp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3628
      - C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2180
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4076
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1068
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4572
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2476
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2712
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3776
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 412
        61⤵
        Program crash
        
        PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 644 -ip 644
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ibegfglj.exe

Filesize
304KB

MD5
a316487a2594a0b8cca62085d8acb3d5

SHA1
742ec56bcae512849074201316df0bbe09a57a32

SHA256
ff4fe26aabd1c892cea83fc50893ab9459da21e914ba2addec45e75a17c36b26

SHA512
61a1bba66e3406724a69e17b7c38c0fd2ae66d62b34df005355d4b1c6f6a0cb2799ef0e296b4f0de35fd07059d0e916cfa43ce966721bfa1675269b8a312f867

Download Submit
C:\Windows\SysWOW64\Ihdldn32.exe

Filesize
304KB

MD5
2c7c47e18b26e762895b4c9c22a8f939

SHA1
dd2d72e0fc781c56f8a8032e2046d84873ea4b5a

SHA256
d681800d6438aa37aa0ba5a5f268a48a903674f1dff366ed5e2bf87189bd0c37

SHA512
54f7a5a7f2902440d9c44fc63ee1ab2426cdccab09ce4727cd39500d7c90dfe8b4e270c48a5feb3fbfce5852d6d87ebd073c9c68bc44a827225a6e3b9476c959

Download Submit
C:\Windows\SysWOW64\Ihkjno32.exe

Filesize
304KB

MD5
25e9cc261694d7947b51834ee846eca7

SHA1
76380fe335c609daa1ea250d048ba1e01ca68744

SHA256
9b9f007633eeeb8d704205606efc2baa5162eaf5054c3dfe587ee706fda1a8b5

SHA512
09c2f6e2007bbdde31e49e638d5a275127679d577b46cc754a9f63676932d985581d4ec6aa295590c97d01ee0d2f53e8eab8ab43b9390580c1cde884155b3c52

Download Submit
C:\Windows\SysWOW64\Iijfhbhl.exe

Filesize
304KB

MD5
4805f85f56fa54bf9b75f191b57125b0

SHA1
dfdba6e2ed4075544d3741ac15c70a04210ef266

SHA256
ebefb74f4b444b3e040c9fb61f5202f32a61417fa69abc50a61fb82d2cbb3f22

SHA512
94c5e1e6ebc9ee40a1bd777c06bca95f9683f32e823710bb24160c17242c1617595ef85c3570112f82e92fee84be4e2e6196831dd36082da1f9b76f4fa95801d

Download Submit
C:\Windows\SysWOW64\Ilibdmgp.exe

Filesize
304KB

MD5
0228fb82ba4ccc8838d44ddb4334c2dc

SHA1
4d87059f2800900d0fc14edab76bf5bc67026b9f

SHA256
230bce64c0a211033d50c5423cd7e72c0bbb080fc0ea2f293afa3ead460be3d6

SHA512
1ec10cd453ca8440d45946c4cd4e53cd2d3363fbc087894f1cbe9c090db23343688924032041aac1ac150cc30cfa083a803356736c76df14f35ce1f07daad667

Download Submit
C:\Windows\SysWOW64\Ilnlom32.exe

Filesize
304KB

MD5
f50cdd58b77355e84ed99949dab5ed49

SHA1
20e03078f02ff088bcc3effeeff47ed9a6899d44

SHA256
9286f42e5ae5d4a13660c7e0a1ee424b0bb489bf4259ffdae054d1c32bdee9de

SHA512
99d6d9fd5f52854f8fc42566ab06ca65e5e048b723dcb5a95797c24ef7b32ed421236faf07e0bd1f779f07b2650da0c1266ae4c353efdbc966283b121295dc8f

Download Submit
C:\Windows\SysWOW64\Jekjcaef.exe

Filesize
304KB

MD5
8aa2ee9963e8839fff116834ea2ca118

SHA1
6795af847cd2f2f14cf091d232801374afe71f4f

SHA256
5211259b0e9efe3b9859f260c4b4604b0e263a2d706927c106c9b5fad6f65516

SHA512
4957f3d8ed56a8be3b77bfdc900daba115bf7a5a16099a2ba892641d161e82a0ea0e048f50fb79aa8d3239222d383ba766984a25bda8c71a4d7057a4c4b75857

Download Submit
C:\Windows\SysWOW64\Jeocna32.exe

Filesize
304KB

MD5
a5fdc3c68accdd5bc60cec65bddc61c6

SHA1
398b535c02ebcc405f95ed74f071118a6d6b1875

SHA256
a8a5ac9e130ee0031bf95eecf45e94329ce8d0670ef59069f4e6e7ddc57cbf8b

SHA512
34ea6bbe09da4ed93f24e7aba3c8e1cba22dffb5205a634b46be9e781452cb3927b71a75a4dfaf5129407bfbc226b5476bfc5fab8bd928619163a7de04b32192

Download Submit
C:\Windows\SysWOW64\Jhkbdmbg.exe

Filesize
304KB

MD5
ee6959c35eda768b834426f5143c186e

SHA1
5e34a769e34ecca0e36c1a8a7713978cf07c0910

SHA256
7dfc408314587e718a709ff861fe40ba01b8b61c77f660c029ce32b451cd6ed5

SHA512
9d154e3e4d68b300b9d5d8c221038ca0e174db98f510743cee52cc389d570c077a9849996889b7ebe91071595a15eb83637a842bfa2364cacb31c9b4104ac277

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
304KB

MD5
0344d56e08a9c0346b7d1721aec30d2c

SHA1
eb65dcd040f6442fd32e03e9a1bda81ece75d1cb

SHA256
bcad14d81c90d3fdf511d0e7a821e09ffedd6f3f7eb69be534fb53e1bd5b7bff

SHA512
e9986a332a13c84072ce4486e061c7187ae551bf679db6ea3575dad02c4874b8ae279fb5bf4ff6db5b585eafe751641624ce320a968a3e33a307870064b276a1

Download Submit
C:\Windows\SysWOW64\Jldbpl32.exe

Filesize
304KB

MD5
6def613761229b9042464a71ea786a5a

SHA1
57078fb5c15bf3b4d08ecdeb0972f572f3efd191

SHA256
06ea3acd68ce977fdfa25e83f1224b2ffc670644b210a4010b272727435c1b7a

SHA512
6a1eb5e97217366f037ec440c065d4abe8f918ba6e5752bf69c66218fd89c0161834c068d8f0976ae3a03a6853895849a40fe1734d34e50e26c1de45cc027285

Download Submit
C:\Windows\SysWOW64\Jllhpkfk.exe

Filesize
304KB

MD5
01be1bd2b71082c94d81a45aa4066331

SHA1
7e0ec0291cee5bfd0054ee89e6523b82cbe38ccf

SHA256
7795ff57f0111001ac97136b29ea73e4f6ece9b09dd75253c47b96e194dd3531

SHA512
844cc604da04a920f154f001f3bcb7b006879d08e9ee645558dd29c55ecba779600d7f784beeeaea6ff921fa100baf7657b2323215d3467ec88478f1e568de17

Download Submit
C:\Windows\SysWOW64\Johggfha.exe

Filesize
304KB

MD5
340414ce37a023f4e2c8252cf15253b6

SHA1
6721addcf054d955a0fff21803b5e8ec37db0aa2

SHA256
06ece0c4c7e22fc52aab79b788994c0af100bd09d06f3a93e613d684e6dbeece

SHA512
de8167ab6d746a801c483cd903436d803de99390065068ae93082883571ad4e88dcd533e58fdca73b8e0a3d9f13724e8cc3734939cac1dcd5434dc43df59a563

Download Submit
C:\Windows\SysWOW64\Kapfiqoj.exe

Filesize
304KB

MD5
05c23ddc95e195f6aa1357935dffdd72

SHA1
0a3973e85deb31f15a7a86e97d20c0a0e417a54a

SHA256
105bd10f3b5a171c5738ea3e48dee914e100061533eeb1b5c1de29dad897e1d0

SHA512
6a2beb81a62869896940d7c6459b3cd1dc42686b248fb67f973ebbba12623f511250d98f8a8a7a26a21c0b416829c15ae8593657ad7388436bff62bbc05a946f

Download Submit
C:\Windows\SysWOW64\Kefiopki.exe

Filesize
304KB

MD5
2934fc1b28fdea1021117373c905e881

SHA1
45bd8407d4d69ba62d1d6759a6c18b07e05a1516

SHA256
ba4959360bc8c982d881933c29aa4e188d3b136b1221a467419f7b7b38c2bf3a

SHA512
213c865b9ee5a7f3be32aa189dd0ca8135b1042aa309fd3e88e7a6f5b1280459897d88012abf7e1b5dd397804b12461dd2dc6b6bda56a593a9775dbe7061ede5

Download Submit
C:\Windows\SysWOW64\Klggli32.exe

Filesize
304KB

MD5
90d35ecec6b1f174b50d04c380ad69fd

SHA1
1263a4e4c30b4312163b1912bd45f9103d866bfb

SHA256
5f60d41bc84751ec3fd03982bdafc40fc8cfd2fbd947659a96671676ddad85a8

SHA512
2d0c9d94528659229d0871a1b7b1b07273233c6c12983b7ae674216f6f418a207dfd2ff86e641c13bfdfbd2fd4b9ea78262f768ae10cb4e99cd75c96076915ce

Download Submit
C:\Windows\SysWOW64\Kocgbend.exe

Filesize
304KB

MD5
4833c09ed41604add00aee67c3448e25

SHA1
9db6d0e0b2887092b1b072fed7ed3dcfbd39b526

SHA256
fd07a2e6fb33a682872a0c99de56fc696ae71b2d99316d4ca7b7d961e0ef8213

SHA512
bc1581889337aa3faddc2616231c68dbdfa023715339655723eb36be1ecc4e46549f0add2d2af1bcc05d31a4f50c578998b001a87b7c17976c3b329b997ab8cb

Download Submit
C:\Windows\SysWOW64\Lcfidb32.exe

Filesize
304KB

MD5
c95110dd6c6627f2aac7fb6e1353103c

SHA1
906c170f04b4c5f2440f277df287f82ecd415a25

SHA256
e59b78105915bd8cfc6f5801fd269615702976edd7be0a18f0904a9d6d4cea02

SHA512
0d037a50abe307a3afbc15b0db89633e18cd325063fa9422932447a1fc76f816413804bfa4761ed9ea2c87dc4fc7f123dc2254f76c8e8bfdf9d7af8d563bfb45

Download Submit
C:\Windows\SysWOW64\Lckggdbo.dll

Filesize
7KB

MD5
b3a884f448a66b6cbceb05e95f754c48

SHA1
e030975c51df5c67b0aba4ee84cbb52d9fe379c5

SHA256
eb464d2dab126e4b3f6bf4a68efc5773c4f33616f968d6af508380a04b3bc155

SHA512
1a6083ef7a055acb4c5aa718cf6dc930ae16f3ffcef0ea20439d7d8133b9a845d3d8ded67d25f3d5a2d58acefcce38b582117e190c8888113d931ba2e276de5d

Download Submit
C:\Windows\SysWOW64\Lebijnak.exe

Filesize
304KB

MD5
c620a71eb28efcdc212a921c08f74fdc

SHA1
4f5d51164669b577a5caeaeb63d6b97c5b8faa02

SHA256
58e64e613aa71517634b9111e7eaf77b1c2af468a6c6b7cc108ae55e3592f6f1

SHA512
758054beb48344f7874bfb1eca40ec79a773485b5d0e503ecc5e808e95ef982e83674fd502e142328ea96d84e1e5a986b200e74772136027ac71258726d0bee9

Download Submit
C:\Windows\SysWOW64\Lhgkgijg.exe

Filesize
304KB

MD5
955cb108429d9fa0c065e5e2e6024546

SHA1
52795f74355930660c7c23365b893c5db4d64468

SHA256
d7a3c4db88fdc09eede355a6f7eaf9a71f8d9875f38a6dc7086ebb99cd488722

SHA512
ef303d0a93ada7a0383104c7ff465bdcfc5d37aa003ed093b31b4b0808b4eb4dd9506a4ad7ca72fac7ac92e5f1e4e041da54ff19d6a4c20a8ee6649e53f25d34

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
256KB

MD5
4b11b74f65861c5ba488a0c34f5d896f

SHA1
516fbff2c5b63a2a4903f19a0750b1d1db382c01

SHA256
645dd9382e46de17962b79d45ce3e2704fd38dc3c75d80decc93612d31a6899e

SHA512
c2c4e94c44cfb0feb2923a3c19798ec1e40186ccb47f1a5a46108588940c978b1bef5d3f6b0c5721e00ec1266c7ba2a842c07e5bb4448cd43905bf09a0e1d762

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
304KB

MD5
ef3b4a990aefc4e2f895e62099c8ded4

SHA1
b2a115f351dd046ce3c6ada7728c8dbbef1ce353

SHA256
1702f39d7d16db5633d3ed9b3025e806f95887f7b269592f874cf6db1d52f4a9

SHA512
1d20177abfe3eb44539bf2bb781dcb9d3e3c3f79554f61f032cb6f3da903769bd4eea2fa865d19bb2016eff9965bb7bf4d5a811eb4737987b2efca00732420e7

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
304KB

MD5
991436704ac473f65c8241b883f322a2

SHA1
3aad2dc7fb406d40443cad50bc6649bb5c53375a

SHA256
56814c3d1d3ecda979b1674d530dd9e7c6d8be7c9f869c22c17d3a017944af1f

SHA512
b7b4e77aba617bf447498358325fba50ce0490967fd9af486238467a1e1c331da075f440e1d8b62d2ecb335d5356afd8c1d8c671118a44f2ef0da5379caf5205

Download Submit
C:\Windows\SysWOW64\Lplfcf32.exe

Filesize
304KB

MD5
0c5c33076ac955ba346df139734bb455

SHA1
8aa0fbbea6bd3aba75fa6e6078d09f4ccb86f590

SHA256
73ed92880a27a816e980ede67221d62bbbb76687bef2beed44b346672967575c

SHA512
30c15a5d3fde5dae9f1104f62e4bf3c346cb75ce132db618b9f1d99cf51e8b0c5147e2feaf7ce82cbeb87753f52d87ec10931bb2e616f0014f78a7d3b31e5e8a

Download Submit
C:\Windows\SysWOW64\Mfkkqmiq.exe

Filesize
304KB

MD5
122672b9ceb2a996b4ec4d951ee65346

SHA1
968f718096a1611b90a2c6ae6eab0dcd904786af

SHA256
d6d288532afdb0c6e57e3b60437114b93c7cf0ceb5374b84deb262ce9f83902e

SHA512
bc13d93451f1c83d87631c495091b525a49f8be7e92d89a55d290cff68d170c5c9a108182ac48db2dcf7f3f5c003e4259df6ad05041b4577fc3aca3559983ac8

Download Submit
C:\Windows\SysWOW64\Mhckcgpj.exe

Filesize
304KB

MD5
e5a0d57a93b6b0e18e8ad7bfc0b24f7f

SHA1
51be7b8f9194f122502983d782b77cd93de7217d

SHA256
8288c5efb0a61cc3f3c7f4f0fe2ef2a1a2ff474b9096ed662701cd947e3a2e47

SHA512
c46e6382011682072e8d56ea7ef1a12e575a861444b6fa7dadc387efa008c4cda24ad55abe4c078a2c53f400136ad23f75421ef09591c489f300c9bd70a43417

Download Submit
C:\Windows\SysWOW64\Modpib32.exe

Filesize
304KB

MD5
e2027a9b4dc10f99f24845f6a82e2373

SHA1
4682cdb65729713fc72667f1b5bb1b6b103248d6

SHA256
65c90cae3310e01d2295932ca549a910997843d32cefbd77a66fbd203f159a83

SHA512
e8e9fcb256a5cd063135bb3f04892e20a45cb712a83e5b3b662e24009fa3215dcfc1ceabf4b5fd89506fc0860e2d30cfea35519e60236f749aa1d1d88571a185

Download Submit
C:\Windows\SysWOW64\Mofmobmo.exe

Filesize
304KB

MD5
0d3787505067a9070e838fb994cf2c50

SHA1
621adc554915e06978b6b89db4db0cc55ae026d1

SHA256
ebf1797f7b5e26356b4dba82ebf9a332d3dc6288b49dd043bafe521f5be072a1

SHA512
571c972f52f9b9624517339f101fec3605432e1f65dad1079f116abe90afb3a6f0e03cdb1faa28d33c3ac3922453e6db89da511d7695ff87bf31b31ae0b549ca

Download Submit
C:\Windows\SysWOW64\Mohidbkl.exe

Filesize
304KB

MD5
2682fef03527388c7c170e2998f49498

SHA1
8e3e6a0af63c4066a1813fb642d3c6d7eef9eff4

SHA256
1fafc27cc931323ecd4d04af0cc8b718107e9d37343a824fddbe9884b9875ba4

SHA512
60790ff1f8b32507f5be13c6bda6fbc8f2adf20274e4fb0511927e8f50ac46ca06647858cf0b35ab065d0c6324e71c81b81fa5ffebae73d3e2675be509ef84c3

Download Submit
C:\Windows\SysWOW64\Mqhfoebo.exe

Filesize
304KB

MD5
87aa966c403ace49b282587443611773

SHA1
1cee01eaa058acf6a61f0271a0c839dc23410935

SHA256
23e27ede1429284f0ea5dd0aaaa68d5cd37ab48559004df6c6a22e4e97028799

SHA512
8df3b52d50f5e96eb001a7d9a671a204db1350dcadc078171365f6a4190438c488a4dc8b86640216b60e5d6a776229a2e1c94b03e87fab4705c9a5dc2ca47271

Download Submit
C:\Windows\SysWOW64\Nbnlaldg.exe

Filesize
304KB

MD5
034664ffd593b343087f8ceb4e5aa914

SHA1
dac95258d5bbaa71a2057ff454ab38976ba92b7a

SHA256
40a5fdec96c563da143eb5b415308a801e3b0e03f6bd58a6e331af71b2647bd4

SHA512
f4dc7245517d11de0d9b50cc9a2232436daf4a3813d9f90722a137662a82d13de8934676d23ddddc633e13eca969ac9451bf91654b0eff16e003f4f983dfe868

Download Submit
C:\Windows\SysWOW64\Njbgmjgl.exe

Filesize
304KB

MD5
e662138454a4675d82fe8137fcf9514b

SHA1
4473731514e4838a53a6629065701a29354a31e3

SHA256
e160f9e13912bc0c96e051d242b35e5fde2b08d8a14445d16bb93655c54c378e

SHA512
b100b5ad32f40f765b5fa21d78df4fcbbec3c3307ad86ed9e52a4a1536e4e90c737ee7ba1a53ebcc7841d7f6fefe337dcefe31e50389552a1bb0560e30837f43

Download Submit
C:\Windows\SysWOW64\Noblkqca.exe

Filesize
304KB

MD5
0173f0260b497b1619b5bfb224edc353

SHA1
eb74a6026b647262d695ba64100c9cbcb5bb7480

SHA256
a37bd297e01dc8730baead6a8d2dc8d907d497e26d0437d687877d44703dc03e

SHA512
f3d73b7efd4198dc37c5d50f026dee67e031545c7d5fa64794001c999719960c3bf1373d093fcdaa05bad4f3a927379c8cc0ef87a6ca9b03af01763ba5282ba1

Download Submit
C:\Windows\SysWOW64\Oophlo32.exe

Filesize
304KB

MD5
cb0ab0e9e20edc9a5a1476104f066383

SHA1
510aab4e82103ee72618ecea9bcda5db566391c1

SHA256
91a4f90e19872402f81f16b3cdf6dc5e975b3e097b9e0c35b938abfde678d2cd

SHA512
0e441f4eb26e9e6643aa5bf2b720495fc8c5aceb2a7f654329a313435663cfe56948924980a5355210d378603907a2e079bdd3e1b3b1335d06f80187bfc8a045

Download Submit
C:\Windows\SysWOW64\Opbean32.exe

Filesize
304KB

MD5
d19debbe3290a90f5da38ff8b252a595

SHA1
79111ad3775018ca17005234968edbf12e278095

SHA256
8e7a1b2f4ca9b05cc6cd233c1e579785e1e4f36082652f8484b926834558b7ad

SHA512
9d07e5eb64ed12e142a34df2ff380759b0c9fad03ca49ba8bf904c5c627c8888adea13110a4c7939c091a81dc9d0b9391ed9dbdd191e5c53332abaafd331f4ec

Download Submit
C:\Windows\SysWOW64\Ppgomnai.exe

Filesize
304KB

MD5
574b6d04492aa2066f1f67dc7cdd1cfa

SHA1
9ec8ab40e9705e5272ed57f55de08a52b8c13e5f

SHA256
8b3d86fe3838129337113b55c4f428bc0f07bb423e7092d4f65ae94e39d94d8d

SHA512
045d3246b5bbad0e45ccd8e801134ebbad6b29fa73de9301a76b7b521b8153ebae91192df5150525b78b7830a5e1854c069f0ac92ec98503de842e5672d5f630

Download Submit
memory/624-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/640-280-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/644-419-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/644-418-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/980-167-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/980-454-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1056-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1068-262-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1068-442-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1120-87-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1508-119-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1540-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1684-382-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1684-424-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1760-143-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1800-423-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1800-401-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1872-64-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2076-47-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2080-452-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2080-183-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2084-411-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2180-199-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2180-450-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2208-207-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2208-449-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2340-103-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2352-80-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2476-433-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2476-316-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2536-286-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2536-438-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-431-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-328-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2944-388-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2944-422-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2988-95-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3008-358-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3008-426-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3052-135-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3064-322-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3064-432-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3180-152-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3216-381-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3504-39-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3512-268-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3512-441-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3584-239-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3584-445-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3628-31-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3692-421-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3692-394-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3720-420-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3720-412-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3724-370-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3724-425-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3732-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3776-427-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3776-352-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3820-298-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3820-436-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3900-216-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3900-448-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3992-159-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4016-430-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4016-334-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4076-223-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4076-447-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4120-434-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4120-310-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4232-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4456-428-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4456-346-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4520-247-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4520-444-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4548-72-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4572-437-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4572-292-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4600-128-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4648-440-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4648-274-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4668-340-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4668-429-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4908-443-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4908-255-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4952-364-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4952-439-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5016-111-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5068-446-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5068-231-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5072-451-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5072-191-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5100-453-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5100-175-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5104-435-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5104-304-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads