85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9d

Analysis

max time kernel
113s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe
Size

391KB
MD5

e21b0e6961a82d4e16653aa236356500
SHA1

e15f1472ff0da2cb7c35d5ee5837f87745fc1cb4
SHA256

85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9d
SHA512

0ac3d2e3db696c48c61c8188a2da40b3f397315182d251cd7ac086c5e3bc1d22f2d906c849265fc125b0d668bcad95b56a7760fe9e5769698616bea5a3eb0d22
SSDEEP

6144:Vu/SJnWku8XoaAfbAfNtTAfMAfFAfNPUmKyIxLfYeOO9UmKyIxL:VuaNW3rmNtuhUNP3cOK3

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nofoki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oheienli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcdqhecd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oflfdbip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbimjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdghhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pofhbgmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpbgnecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkhfek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Obidcdfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkholi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfncia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piolkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aealll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qelcamcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhlfoodc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcdqhecd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okceaikl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbddobla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocmjhfjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oheienli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okceaikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oomelheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okmpqjad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohkai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pilpfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pofhbgmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qifbll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mahklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfknmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qckfid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfgfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abcppq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkcmjlio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obfhmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qelcamcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhnjna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pijcpmhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfncia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkabbgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mklfjm32.exe

Executes dropped EXE 64 IoCs

pid	Process
4300	Mdpagc32.exe
1152	Mhnjna32.exe
1036	Mklfjm32.exe
1588	Mllccpfj.exe
1220	Mahklf32.exe
2540	Mdghhb32.exe
1704	Ndidna32.exe
4412	Nkcmjlio.exe
2624	Nkeipk32.exe
3012	Nfknmd32.exe
3148	Nkhfek32.exe
3628	Nhlfoodc.exe
2672	Nofoki32.exe
4844	Nbdkhe32.exe
1580	Ohncdobq.exe
4604	Okmpqjad.exe
560	Oohkai32.exe
3812	Obfhmd32.exe
628	Odedipge.exe
4864	Ohqpjo32.exe
3076	Okolfj32.exe
3160	Obidcdfo.exe
2416	Odgqopeb.exe
4724	Oloipmfd.exe
1216	Oomelheh.exe
4856	Ochamg32.exe
2444	Ofgmib32.exe
2452	Oheienli.exe
1888	Okceaikl.exe
4428	Ocknbglo.exe
3872	Ofijnbkb.exe
3476	Ohhfknjf.exe
3804	Okfbgiij.exe
4512	Ocmjhfjl.exe
2032	Oflfdbip.exe
3708	Pijcpmhc.exe
1608	Pkholi32.exe
2852	Pcpgmf32.exe
2780	Pfncia32.exe
4244	Pilpfm32.exe
3052	Pkklbh32.exe
224	Pofhbgmn.exe
4756	Pbddobla.exe
1224	Piolkm32.exe
2968	Pkmhgh32.exe
4960	Pcdqhecd.exe
3464	Pfbmdabh.exe
452	Piaiqlak.exe
2684	Pkoemhao.exe
3388	Pokanf32.exe
4624	Pbimjb32.exe
4344	Pehjfm32.exe
3976	Pkabbgol.exe
4148	Pomncfge.exe
928	Qfgfpp32.exe
3540	Qifbll32.exe
4888	Qkdohg32.exe
2004	Qckfid32.exe
3896	Qelcamcj.exe
408	Qmckbjdl.exe
4880	Qpbgnecp.exe
3120	Abpcja32.exe
4104	Aeopfl32.exe
1488	Amfhgj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pfbmdabh.exe	Pcdqhecd.exe
File created	C:\Windows\SysWOW64\Qelcamcj.exe	Qckfid32.exe
File opened for modification	C:\Windows\SysWOW64\Abcppq32.exe	Apddce32.exe
File created	C:\Windows\SysWOW64\Aealll32.exe	Abcppq32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmjlio.exe	Ndidna32.exe
File created	C:\Windows\SysWOW64\Ochamg32.exe	Oomelheh.exe
File opened for modification	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Odpldj32.dll	Obidcdfo.exe
File created	C:\Windows\SysWOW64\Pbimjb32.exe	Pokanf32.exe
File created	C:\Windows\SysWOW64\Pkabbgol.exe	Pehjfm32.exe
File created	C:\Windows\SysWOW64\Piolkm32.exe	Pbddobla.exe
File opened for modification	C:\Windows\SysWOW64\Pbimjb32.exe	Pokanf32.exe
File opened for modification	C:\Windows\SysWOW64\Pbddobla.exe	Pofhbgmn.exe
File created	C:\Windows\SysWOW64\Odgqopeb.exe	Obidcdfo.exe
File created	C:\Windows\SysWOW64\Pilpfm32.exe	Pfncia32.exe
File created	C:\Windows\SysWOW64\Cojaijla.dll	Qkdohg32.exe
File created	C:\Windows\SysWOW64\Abpcja32.exe	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Nkeipk32.exe	Nkcmjlio.exe
File opened for modification	C:\Windows\SysWOW64\Odedipge.exe	Obfhmd32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhfknjf.exe	Ofijnbkb.exe
File created	C:\Windows\SysWOW64\Ihbdmc32.dll	Qfgfpp32.exe
File created	C:\Windows\SysWOW64\Codncb32.dll	Nofoki32.exe
File opened for modification	C:\Windows\SysWOW64\Pijcpmhc.exe	Oflfdbip.exe
File created	C:\Windows\SysWOW64\Pkoemhao.exe	Piaiqlak.exe
File created	C:\Windows\SysWOW64\Ohqpjo32.exe	Odedipge.exe
File opened for modification	C:\Windows\SysWOW64\Pkabbgol.exe	Pehjfm32.exe
File opened for modification	C:\Windows\SysWOW64\Aealll32.exe	Abcppq32.exe
File created	C:\Windows\SysWOW64\Pcpgmf32.exe	Pkholi32.exe
File created	C:\Windows\SysWOW64\Mpaflkim.dll	Pkklbh32.exe
File opened for modification	C:\Windows\SysWOW64\Mahklf32.exe	Mllccpfj.exe
File opened for modification	C:\Windows\SysWOW64\Pehjfm32.exe	Pbimjb32.exe
File created	C:\Windows\SysWOW64\Pofhbgmn.exe	Pkklbh32.exe
File opened for modification	C:\Windows\SysWOW64\Oohkai32.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Okolfj32.exe	Ohqpjo32.exe
File opened for modification	C:\Windows\SysWOW64\Okolfj32.exe	Ohqpjo32.exe
File opened for modification	C:\Windows\SysWOW64\Qckfid32.exe	Qkdohg32.exe
File created	C:\Windows\SysWOW64\Ifoglp32.dll	Abpcja32.exe
File created	C:\Windows\SysWOW64\Nkhfek32.exe	Nfknmd32.exe
File created	C:\Windows\SysWOW64\Nnmmnbnl.dll	Okceaikl.exe
File created	C:\Windows\SysWOW64\Ncloojfj.dll	Pfncia32.exe
File created	C:\Windows\SysWOW64\Qmckbjdl.exe	Qelcamcj.exe
File created	C:\Windows\SysWOW64\Lchfjc32.dll	Oohkai32.exe
File opened for modification	C:\Windows\SysWOW64\Okmpqjad.exe	Ohncdobq.exe
File opened for modification	C:\Windows\SysWOW64\Okfbgiij.exe	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Jkiigchm.dll	Piolkm32.exe
File opened for modification	C:\Windows\SysWOW64\Pfbmdabh.exe	Pcdqhecd.exe
File opened for modification	C:\Windows\SysWOW64\Pkoemhao.exe	Piaiqlak.exe
File created	C:\Windows\SysWOW64\Dbooabbb.dll	Qifbll32.exe
File created	C:\Windows\SysWOW64\Jbkeki32.dll	Mhnjna32.exe
File created	C:\Windows\SysWOW64\Kpdejagg.dll	Ndidna32.exe
File created	C:\Windows\SysWOW64\Nhlfoodc.exe	Nkhfek32.exe
File opened for modification	C:\Windows\SysWOW64\Qpbgnecp.exe	Qmckbjdl.exe
File created	C:\Windows\SysWOW64\Mahklf32.exe	Mllccpfj.exe
File created	C:\Windows\SysWOW64\Ohhfknjf.exe	Ofijnbkb.exe
File created	C:\Windows\SysWOW64\Qfgfpp32.exe	Pomncfge.exe
File created	C:\Windows\SysWOW64\Hfqgoo32.dll	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Kmqbkkce.dll	Okolfj32.exe
File created	C:\Windows\SysWOW64\Mdghhb32.exe	Mahklf32.exe
File created	C:\Windows\SysWOW64\Nkcmjlio.exe	Ndidna32.exe
File created	C:\Windows\SysWOW64\Ohncdobq.exe	Nbdkhe32.exe
File created	C:\Windows\SysWOW64\Pgoikbje.dll	Ochamg32.exe
File opened for modification	C:\Windows\SysWOW64\Pfncia32.exe	Pcpgmf32.exe
File opened for modification	C:\Windows\SysWOW64\Mdpagc32.exe	85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe
File created	C:\Windows\SysWOW64\Pqoppk32.dll	Ofijnbkb.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocknbglo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocmjhfjl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piaiqlak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeopfl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oheienli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohncdobq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfbgiij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkeipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odgqopeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkmhgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbdkhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkcmjlio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdpagc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbddobla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pomncfge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfgfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ochamg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mahklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oohkai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohqpjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pijcpmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkholi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhnjna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofijnbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfncia32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qckfid32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfknmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okmpqjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoemhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkabbgol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nkhfek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okceaikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbgnecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdghhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piolkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qelcamcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amhdmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obfhmd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndidna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obidcdfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apddce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllccpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloipmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oomelheh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfbmdabh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcppq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okolfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofgmib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohhfknjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmckbjdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mklfjm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pofhbgmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhlfoodc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pilpfm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oohkai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgoikbje.dll"	Ochamg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pilpfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbkeki32.dll"	Mhnjna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mahklf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apddce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nhlfoodc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oohkai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofgmib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapijd32.dll"	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amfhgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mhnjna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndidna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfncia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmckbjdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkabbgol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qkdohg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oloipmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qpbgnecp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mklfjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clpkdlkd.dll"	Oflfdbip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcmpceo.dll"	Mllccpfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkhfek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohncdobq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pilpfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmoikj32.dll"	Mdpagc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aealll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbimjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdpagc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnggfhnm.dll"	Nkcmjlio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmqbkkce.dll"	Okolfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oheienli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ocknbglo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll"	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mklfjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kncgmcgd.dll"	Ofgmib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qckfid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nkcmjlio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pomncfge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ochamg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okceaikl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkbdql32.dll"	Ocknbglo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pofhbgmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbddobla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggociklh.dll"	Abcppq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpaflkim.dll"	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Okceaikl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4300	4164	85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe	87
PID 4164 wrote to memory of 4300	4164	85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe	87
PID 4164 wrote to memory of 4300	4164	85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe	87
PID 4300 wrote to memory of 1152	4300	Mdpagc32.exe	89
PID 4300 wrote to memory of 1152	4300	Mdpagc32.exe	89
PID 4300 wrote to memory of 1152	4300	Mdpagc32.exe	89
PID 1152 wrote to memory of 1036	1152	Mhnjna32.exe	90
PID 1152 wrote to memory of 1036	1152	Mhnjna32.exe	90
PID 1152 wrote to memory of 1036	1152	Mhnjna32.exe	90
PID 1036 wrote to memory of 1588	1036	Mklfjm32.exe	92
PID 1036 wrote to memory of 1588	1036	Mklfjm32.exe	92
PID 1036 wrote to memory of 1588	1036	Mklfjm32.exe	92
PID 1588 wrote to memory of 1220	1588	Mllccpfj.exe	93
PID 1588 wrote to memory of 1220	1588	Mllccpfj.exe	93
PID 1588 wrote to memory of 1220	1588	Mllccpfj.exe	93
PID 1220 wrote to memory of 2540	1220	Mahklf32.exe	94
PID 1220 wrote to memory of 2540	1220	Mahklf32.exe	94
PID 1220 wrote to memory of 2540	1220	Mahklf32.exe	94
PID 2540 wrote to memory of 1704	2540	Mdghhb32.exe	95
PID 2540 wrote to memory of 1704	2540	Mdghhb32.exe	95
PID 2540 wrote to memory of 1704	2540	Mdghhb32.exe	95
PID 1704 wrote to memory of 4412	1704	Ndidna32.exe	96
PID 1704 wrote to memory of 4412	1704	Ndidna32.exe	96
PID 1704 wrote to memory of 4412	1704	Ndidna32.exe	96
PID 4412 wrote to memory of 2624	4412	Nkcmjlio.exe	97
PID 4412 wrote to memory of 2624	4412	Nkcmjlio.exe	97
PID 4412 wrote to memory of 2624	4412	Nkcmjlio.exe	97
PID 2624 wrote to memory of 3012	2624	Nkeipk32.exe	98
PID 2624 wrote to memory of 3012	2624	Nkeipk32.exe	98
PID 2624 wrote to memory of 3012	2624	Nkeipk32.exe	98
PID 3012 wrote to memory of 3148	3012	Nfknmd32.exe	99
PID 3012 wrote to memory of 3148	3012	Nfknmd32.exe	99
PID 3012 wrote to memory of 3148	3012	Nfknmd32.exe	99
PID 3148 wrote to memory of 3628	3148	Nkhfek32.exe	100
PID 3148 wrote to memory of 3628	3148	Nkhfek32.exe	100
PID 3148 wrote to memory of 3628	3148	Nkhfek32.exe	100
PID 3628 wrote to memory of 2672	3628	Nhlfoodc.exe	101
PID 3628 wrote to memory of 2672	3628	Nhlfoodc.exe	101
PID 3628 wrote to memory of 2672	3628	Nhlfoodc.exe	101
PID 2672 wrote to memory of 4844	2672	Nofoki32.exe	102
PID 2672 wrote to memory of 4844	2672	Nofoki32.exe	102
PID 2672 wrote to memory of 4844	2672	Nofoki32.exe	102
PID 4844 wrote to memory of 1580	4844	Nbdkhe32.exe	103
PID 4844 wrote to memory of 1580	4844	Nbdkhe32.exe	103
PID 4844 wrote to memory of 1580	4844	Nbdkhe32.exe	103
PID 1580 wrote to memory of 4604	1580	Ohncdobq.exe	104
PID 1580 wrote to memory of 4604	1580	Ohncdobq.exe	104
PID 1580 wrote to memory of 4604	1580	Ohncdobq.exe	104
PID 4604 wrote to memory of 560	4604	Okmpqjad.exe	105
PID 4604 wrote to memory of 560	4604	Okmpqjad.exe	105
PID 4604 wrote to memory of 560	4604	Okmpqjad.exe	105
PID 560 wrote to memory of 3812	560	Oohkai32.exe	106
PID 560 wrote to memory of 3812	560	Oohkai32.exe	106
PID 560 wrote to memory of 3812	560	Oohkai32.exe	106
PID 3812 wrote to memory of 628	3812	Obfhmd32.exe	107
PID 3812 wrote to memory of 628	3812	Obfhmd32.exe	107
PID 3812 wrote to memory of 628	3812	Obfhmd32.exe	107
PID 628 wrote to memory of 4864	628	Odedipge.exe	108
PID 628 wrote to memory of 4864	628	Odedipge.exe	108
PID 628 wrote to memory of 4864	628	Odedipge.exe	108
PID 4864 wrote to memory of 3076	4864	Ohqpjo32.exe	109
PID 4864 wrote to memory of 3076	4864	Ohqpjo32.exe	109
PID 4864 wrote to memory of 3076	4864	Ohqpjo32.exe	109
PID 3076 wrote to memory of 3160	3076	Okolfj32.exe	110

C:\Users\Admin\AppData\Local\Temp\85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe
"C:\Users\Admin\AppData\Local\Temp\85ae58c21ae41a4330371023c00a6ec2cbbaa39381ab7ccd3ae0a0032f2cba9dN.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\Mdpagc32.exe
  C:\Windows\system32\Mdpagc32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\Mhnjna32.exe
    C:\Windows\system32\Mhnjna32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\Mklfjm32.exe
      C:\Windows\system32\Mklfjm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
      - C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:560
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1888
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4428
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4512
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3708
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4244
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Pofhbgmn.exe
        
        C:\Windows\system32\Pofhbgmn.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3464
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4624
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Amhdmi32.exe
        
        C:\Windows\system32\Amhdmi32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Flcmpceo.dll

Filesize
7KB

MD5
516d6419c89af7b162efc3eb6faa5057

SHA1
3ac3bd9de59015687472eec63cd28326be46a533

SHA256
91fad22e3d3f72ae44bc5b964ea55acb6953e0ae46e1c5aa4685a192999c0631

SHA512
82d78964a384bdaa663e7713ac8970cd696e901c684f958f713e472b9225e368ede57cfb302cdcf661398c7c156fcf990a50c1ac0da617e676022636c3c7114c

Download Submit
C:\Windows\SysWOW64\Mahklf32.exe

Filesize
391KB

MD5
c554a699974169f1d1cfe0b3d1824756

SHA1
c2316ac0f33656eceee976dceadc8694bcdba26d

SHA256
6c4c290661c32d9b94d7528b7ae4099350e848c884bf2f52623a296064a29007

SHA512
dd148d3b26b3fab2c6c66fb9ea953bdc53a09d7bd24e3dcac98ce9ac9976c80a14a3da56d6105c893804e1fb35affbf730f3faeca0838b6d856322ba1e9d4b77

Download Submit
C:\Windows\SysWOW64\Mdghhb32.exe

Filesize
391KB

MD5
6fd27cbe5732db374f436bad4e845b1d

SHA1
25e70bb618ce8e9d5cc7a209bff533892ee82c6a

SHA256
86a6e02f5dc16a10dd46a5aaf480bef79b68bcf39bd54fe8fc72b80a0a5a2deb

SHA512
08c2f71ae9d4d80abea6e26ae5dc381aa2b9479c97944c5b2146536903db561e98a87dec9b575942be29c1a77cddad0a4e0c67775a7b413f85b04441ca21481a

Download Submit
C:\Windows\SysWOW64\Mdpagc32.exe

Filesize
391KB

MD5
d90ca9fe03dc6bd16806f682d08c07d5

SHA1
714b9152d7698460759bdffb2d45c9b1b006d301

SHA256
acd758ac0093bbeb6de15485512e35c743bc8001ea05df340fd3830f3e9b1497

SHA512
d15dc81ba6178ec4267207ee4d9d3687a3fb11ff68eab0e40daf8dbaee29f321335e194c08a613904084992dd8f9233aa6cdc8fb48e451c2d77fc813e2131de1

Download Submit
C:\Windows\SysWOW64\Mhnjna32.exe

Filesize
391KB

MD5
2fdd390cffd0f3a5ba925d9855e19228

SHA1
06980d00d7dcbbd8b3ef6d43cb879b2eb428f0ef

SHA256
6cf05610d272ab2d566c4b4bca75ca546bd957156fd350f2515b04fdc4babd93

SHA512
df4c226e30fe921f3fb5450d230576675dbf2bf5ee1a2a16b1a4d799dea751d81c0ce50ede92811de918a9587a78cf0b2b30ef29d1b56856141efa8819b59292

Download Submit
C:\Windows\SysWOW64\Mklfjm32.exe

Filesize
391KB

MD5
89a4846b81ee37a36ad9fc660840a68c

SHA1
a27bcc51967ba77888ec90f26504c1a2b7876588

SHA256
376a63f4b3a5b171d7b81201b1c08a7c2ae1efdbac62e596bedadecee4c0c36b

SHA512
e4517e55f2acec5285b62db18ae8a3f99ba6a09a18442ae937cafd59b8be4f740c25fe23b0aef9fa55585b11a56782ea40961fa6e8efca9a6888ac7666a9ed6a

Download Submit
C:\Windows\SysWOW64\Mllccpfj.exe

Filesize
391KB

MD5
ec6e214d0007152e71e6ad2b1e8b1a96

SHA1
4cd82625c03f03edfaf512cc91a1e7206e7fd87f

SHA256
0cbadb673f1a9aa6e2e1111baf13072be21378149da7044c0ad29af352889440

SHA512
d1d2ac7324c4eafd1dd5e5ebd1009864c7811f8e99793a84262c7513c25d082c2db365e563446f64ab46b9347451ead8d041b824fab543235b5bf3c7eeaea92a

Download Submit
C:\Windows\SysWOW64\Nbdkhe32.exe

Filesize
391KB

MD5
7d88fd4087043f117c9303fb698b5b26

SHA1
abffdd01e128922fc0ec7c83a588bc0854aee5d2

SHA256
9780468b99c9562fd41889e1743a330a518ced23d05bb51f9f1b1260e35b70f3

SHA512
50b2b9e6dfd1ba19266068ec12ec726466863e5e0fa13c63ef88a6796f5ea1edc9f775c1608ca8d1552aeee5fa915408f2a053e1311aa165aa3cc9cb67584470

Download Submit
C:\Windows\SysWOW64\Ndidna32.exe

Filesize
391KB

MD5
dcce86ebbafc6500986ae7b1b3b8bc4e

SHA1
18bbaa4544fbeb0a9cb790c30d2e476ad2d37f86

SHA256
746258707f6c61ddad35af959565166fb89f52bb2786a6e792bfdd1aae907d8d

SHA512
222807d1454daf5f49423b13ea34006b530a152905ef8b266641ba383d41682185d5bf4ab5ff23f2baaea77b06a004d996008f2ef08e78bef29485851d708f4f

Download Submit
C:\Windows\SysWOW64\Nfknmd32.exe

Filesize
391KB

MD5
9916c95e0cbccbfcbd79ad24b28f7520

SHA1
34c4ad2beb13a7ac97232367b1eab70b5bfe06a6

SHA256
735bf68d3044b9e6da27ad97ffacbb35da7bbfbc78e85a702ec19180313925ab

SHA512
0abf1dcdfa801d9e933c85651f156a46ecb16b11a9bce631c5ec0c1b33aea7844f6b04ebbfcc37be6f44dbcb14499060ff6ac6ad076576a1bec4c4ecbc512bb3

Download Submit
C:\Windows\SysWOW64\Nhlfoodc.exe

Filesize
391KB

MD5
7874aebde5698eff3367b6d5f4af7e7f

SHA1
5901b994bcecb3052e8936572def767c8e40b511

SHA256
c940ae1ea4cd8313d20af41509d21623d3a3cac14e610219ccf7380fa62a7aa5

SHA512
496e544195131f193e0818d9fa85ea0d43abbe217c40df8e056bc382298c4d238eb071a43ac1a5bd6308507551ca8c325c5072f9166c2037895bc32282740133

Download Submit
C:\Windows\SysWOW64\Nkcmjlio.exe

Filesize
391KB

MD5
f33544f4c219b727047166180286c2b6

SHA1
82507da1d6dd3d9a57e608e76aff244bd1fb50e6

SHA256
621cd1217957d6bbef226ca2c34f71e069fd1ca8a578765d2064f5cca11a041e

SHA512
5811a938ead57f6f79bb1cb77973c670a7753dfcc65cf6284396340a262e332d08cfab3b1f6b7144a5f4ea631b7aaf9b1581318650225e718dcb03c3ba9e7b43

Download Submit
C:\Windows\SysWOW64\Nkeipk32.exe

Filesize
391KB

MD5
2732f7f1fa1d01b8e2c4035b40986c9a

SHA1
63697597f54f38b772bd9b118bb28249a8918971

SHA256
f1726931b9accabaaeb3f7535325e4999b6613ff2f018f95384ac774daae1452

SHA512
c072a88065981f9f9024eda85ea15e5ba871c758abbdeb6757452f4ff26198391e0a3fc2ea51dfee924ef8d1473ca48b988507ca98b566e5f7ce4d7667a83ab3

Download Submit
C:\Windows\SysWOW64\Nkhfek32.exe

Filesize
391KB

MD5
c466562615c9922bd177dbdffa924061

SHA1
43f17f8f840024eaf8c427a56dd0007acdf5ade8

SHA256
51f25dcab523e72199029796f7efe4d4b4697d42bd30dbbd0a98a46785958f76

SHA512
3286eba085e2c830ac3b29b1318f58c75b7ef8813f498fcc1e642a66b2e20356e35f420e155431397fc3d59f467ff586e0074a81e5ddb9d52bf3eda90e5f94ed

Download Submit
C:\Windows\SysWOW64\Nofoki32.exe

Filesize
391KB

MD5
b8c5b4d96bf43413794197eaa24ac60a

SHA1
6a4fdf8724e08277f959669cf6d156193ca4be48

SHA256
e516b556218e670a3dde69855cb4f5ec37535b8e2eb19201f8fd8b2fcbb067ec

SHA512
9b41d6f7b128e05c0a2e23576dc7b79cfcd50b7378fcddf00724c2cc039071ea36dbf60e1076179b09ab220db2ad4e99cd3d090dc720e02b77482beedbd5a030

Download Submit
C:\Windows\SysWOW64\Obfhmd32.exe

Filesize
391KB

MD5
b40cb1f6d9e08adbe5762bda5e8dfffe

SHA1
6a01659e6f0612cd4e69817bb3fd8eeccde59b1f

SHA256
9bbb0b0e06255060719fa64013143e9e1e2d10af6a8d5f94812f1c22a5906036

SHA512
423f29026c27d01467997b42cfc61075b90d21700a37eb91919abb56e607233a5fa40d3031b0d232ca64ab422ae084211e4dc1caa75e3f2b1573079adf007c24

Download Submit
C:\Windows\SysWOW64\Obidcdfo.exe

Filesize
391KB

MD5
0de895e0aca4e701d5f677603e3bc765

SHA1
f8e4a6be2f3421d5239a79a0f0152e8f87bde180

SHA256
adcb869368631d762b694d38868277ffe25d9e2127590f0506217ea0a82a11e0

SHA512
98e3690410648b536a119f6dd0721687ccf7f062f68fac6590a7a82f2e5074dba5ce296f0910f3e3def095868ae76d07eb1e06a32a185482e0cb7273d9979ded

Download Submit
C:\Windows\SysWOW64\Ochamg32.exe

Filesize
391KB

MD5
5541e08ca874d6b1f001027269267f7e

SHA1
fa7e757496a19cb4dd3a2b85b8c5d0b9e978927f

SHA256
496ced2bba987426334ae3ab0859b68f8e7a7631b9af94ccb8f229e49f8d6ebd

SHA512
a4a238761cf8c5239b9533cebbfb4a4beed21717da7c109f07f2d49de92547ef9300dda48be63cffa839b55c1d9679c8b2245bb14482f63a46a1ab9e2b61afdb

Download Submit
C:\Windows\SysWOW64\Ocknbglo.exe

Filesize
391KB

MD5
7b34f364964f193c83cd95fd47f1441b

SHA1
e5e8dc727b667c05ee7b1044d1ca5219bf1f35a2

SHA256
8f002d1ea7f3385fb9d363bc9db4b887261191430c58ba071224e86a2412ffec

SHA512
8ed51acceb07fdac3c363da9792c56b0b25ad5013184428afe533edf1de5735ec4b0072459dd08ebc28a01a0c46c4fc8848bcf7ea00eaacecabd024b8962e7b8

Download Submit
C:\Windows\SysWOW64\Odedipge.exe

Filesize
391KB

MD5
2f44b4323c34d2038b86456a14593e2f

SHA1
4710dac093b4f085b1df89802532f09986ec1c43

SHA256
e3f416b1a72d1c2b42b21ec9146da6073540b9d09327bc2cd1424787859745bb

SHA512
ebbb6d2432532b7dc883e55ce24b6c03ea0294793496e70d6a34275e3d28fbb1e11d647d1076773de8795f26d770ea844675dea37161fbeae124fa1d1bc0c979

Download Submit
C:\Windows\SysWOW64\Odgqopeb.exe

Filesize
391KB

MD5
498d391fce6e0dfa1133514fa932e975

SHA1
eb58f7194aa303cbc7bb9b1d9db09239625cc909

SHA256
338ba02a5e8378297d0dc2a6e9afa8df6715cdefadab2f67aaae731b0a3f27f6

SHA512
1707398ebf8f5a406f8109b5002cd128f4f396afd06ba9af3265af2a88e90292065ee33aa514a3d291dc5420927fb142e60f3d33fedb494d0221d3d65ba12b11

Download Submit
C:\Windows\SysWOW64\Ofgmib32.exe

Filesize
391KB

MD5
8bcdda3ae04cc811ccb621e71b68b5a0

SHA1
3d4f582acd57b39b88f48762d50414dbca4d47e4

SHA256
34b4fcb735940acceb115c8ccf4557d70c6276687a6dd7d503c502071edd0cdb

SHA512
864924c8f48c7ebacafd3d2b2131d3a46bffba9887a3d355f64db8e8bd89cc394884e43b6b8de08696b84de7f8ffa29409f246952394847d8d00b6452723972a

Download Submit
C:\Windows\SysWOW64\Ofijnbkb.exe

Filesize
391KB

MD5
344d0354284570f82a20e24c3110f462

SHA1
39e711c7786234a936502901baf203fd54215d14

SHA256
2b517806b2d304d13895bbfefd62bb1335b5d0b407858b35278f5b286f36eae9

SHA512
cf8e06c06333c073381399532f221769ff0ab54b555e58cdd9c8b32a686a4fd5da1baaebe909d533e601eeb64630e4550bcb184cd9005dc82c3bab3d146e3a21

Download Submit
C:\Windows\SysWOW64\Oheienli.exe

Filesize
391KB

MD5
7c7224b6b726c0e3e73ed465631c6ef2

SHA1
4459575303be003d935a609b1d3e3d5164c16f9e

SHA256
c6926887920dc5680bfd301d146c6b04556f7a950f4fe42de6193091263f207b

SHA512
0dceddea7fca01b47484751a44f57243bc0c3180de210a6ef07fa4dba91db432dbedb965c436d568e38c03d059a1d353ee7548d86efdebe7e1b6ab13603e75bb

Download Submit
C:\Windows\SysWOW64\Ohhfknjf.exe

Filesize
391KB

MD5
fc482c9cec71c69d1bfe3958fa52df04

SHA1
e1b02b703b10735a8471789bbd865525add4b7a2

SHA256
59e592d92fed5b38e6cb94e8928737bd43c0d699a806d4b50e18916f08b603e8

SHA512
a044e599a74be7bb3a2335a9a0c70b2499003113fe78fdf4c90ca3c0df233b8a2415a6414b77004fc4e95cef58358a155c10bb3c55b48d3bd9c5bb9dd6ed9263

Download Submit
C:\Windows\SysWOW64\Ohncdobq.exe

Filesize
391KB

MD5
a8d1631c78bde1e3cd62d4846e9dc398

SHA1
a3b2a7f4b3d79e2ea819d199987373200745c5bc

SHA256
c2d305b929fcc27ef6ee2e33c17d0ff1709e0810c5466e02dcefeb1b72398f24

SHA512
9ea65f1f91ed7eff0e0544e257ef9cccd7f2e01773f951104249fd3cc104a4b3ce3b7e62fdad40868e350176db4c1a150631ed4a2a17082af7950ffa06386c36

Download Submit
C:\Windows\SysWOW64\Ohqpjo32.exe

Filesize
391KB

MD5
53a234aa5f8f088a98faeb94cc04e2fb

SHA1
84ccc112a01f73431f60fe3a0f4b72bf5faa01de

SHA256
ef51053bab6e32e9a19e00920f67ec4b8e4a87d7b7091533beabf61e8dff466c

SHA512
8c99eb1589d5fe443556bc96dfe241cbc72d1e265b7dd3f326eb6ade4bcddbb60d405d553a7ba6ed23036054f1751ff1f127aa86bce8888bc88ea8453598049a

Download Submit
C:\Windows\SysWOW64\Okceaikl.exe

Filesize
391KB

MD5
abb6a52cd21d8c6d0294e36c219ecf7d

SHA1
5bdf9b398eda0417347594d586e34e6f59560743

SHA256
c594799acaabff876912a150942a83feb716ce22c70cabab543ff57e4a233377

SHA512
86c04a18a307135226c01df196aa019d0d1066d92840e236cef48566dde26fc84e1e31b9f1a9e1b79c10f99e959bc341b888394b258118ecdfdd4467ff1a7522

Download Submit
C:\Windows\SysWOW64\Okmpqjad.exe

Filesize
391KB

MD5
ef63c7f61d88428eb5b8545306d9c6f8

SHA1
7b07668918389d4674cd9e1f4fe898ba509e1f73

SHA256
c58abc5457a5df839e1c7fe07379cbe3d7938cbc31c9dea585d8e8777bbb7612

SHA512
bdb4d5b32748753163e7993b3736b799fd14ffc5135cc71f1260951b1d6ddc956b2bf54b1143eeac8b8deb026716b67d13b12568335a3bdac386125f7079ba35

Download Submit
C:\Windows\SysWOW64\Okolfj32.exe

Filesize
391KB

MD5
ce817c0667d149d425885285011eb79a

SHA1
4b81c0d84ec29e86bd45e67a495d9c27540a1171

SHA256
5031cb433632840238a7d8a2f7db2855042c4ba4c499bf297e497d48e2e2798a

SHA512
a36629b278001905f33d9015825452f3774049056f054c39171aa44c64553c57b55d611a7434bdee31d221e91e3efdbea6552e84ae89399b2b2e3776ed7c752e

Download Submit
C:\Windows\SysWOW64\Oloipmfd.exe

Filesize
391KB

MD5
2514cea29999582e861698c25e281613

SHA1
b2cf03bb53376b6962c87c3e7e7559fef8f0caaa

SHA256
670907b24fd9ff40ee1b0f42ec2eb20e0bc6aadb2f066b884d6db5a0ef51baf9

SHA512
d650b137e1bf7a28ad7bddc9dcdd40ff6cd729eb73d15b1f66229f8c330c1ede589c163fdf0946ad91ab8fb04d4b8b208a963166f9e38dd18c2d580a9f3278b3

Download Submit
C:\Windows\SysWOW64\Oohkai32.exe

Filesize
391KB

MD5
bd15b895d0bb2ee68e1e5c2cfeb5e5f5

SHA1
76926ea4fe218f7e54783c555dcd1a92c065b3e2

SHA256
a93e936d33574933b5a4aed2c0d8991059bf0268aa1f9d141ac0ef69287e64c7

SHA512
71bd60ff5067f45d6becff06c1aef20e526b0c2fc121cfb77c0e6c0eb5bcf8e8656205416f8cadb55f0a26759cd8d26800b2644c35443bd01383ee246b3948f5

Download Submit
C:\Windows\SysWOW64\Oomelheh.exe

Filesize
391KB

MD5
49f569a6ed5b15fcca152110e55d52e9

SHA1
8e7d8bb2131ba84a3bd84d3d017ad433c698b81e

SHA256
cc72f15fc37631b50066af924e786c5fc79adb23985e02f43c41e33ae7fb9224

SHA512
fcd2958942c70248b658c72362d65798da3c4b3dd92bc8b557f2f2343373995855a6df188fd26417a656789f165bc5b314e18fabff4a77bc6c2f74e281053344

Download Submit
memory/224-314-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/408-417-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/452-349-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/452-733-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/560-601-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/560-140-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/560-602-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/628-604-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/928-389-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/960-457-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1036-23-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1036-547-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1036-493-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1152-545-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1152-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1152-492-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1220-496-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1220-551-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1220-44-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1224-725-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1224-326-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1488-440-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1580-124-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1580-539-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1580-596-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1588-549-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1588-494-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1588-32-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1608-286-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1704-580-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1704-529-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1704-56-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2004-405-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2032-274-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2416-612-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2416-187-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2444-218-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2452-226-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2452-621-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2540-47-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2540-553-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2540-509-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2624-584-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2624-71-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2624-531-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2672-592-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2672-108-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2672-535-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2684-355-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2852-713-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2968-332-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2968-727-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3012-80-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3012-532-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3012-586-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3052-308-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3076-171-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3076-608-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3076-607-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3120-763-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3120-428-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3148-588-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3148-533-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3148-87-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3160-610-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3160-179-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3388-361-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3476-256-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3628-590-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3628-534-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3628-96-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3708-280-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3804-262-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3812-148-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3812-600-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3872-248-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3896-411-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3976-378-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4104-434-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4104-761-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4148-745-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4164-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4164-490-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4164-541-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4244-717-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4244-302-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4300-8-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4300-491-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4300-543-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4344-741-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4412-582-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4412-64-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4412-530-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4512-268-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4604-571-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4604-132-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4604-598-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4624-739-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4624-367-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4724-195-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4724-614-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4756-320-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4844-112-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4844-594-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4844-536-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4856-210-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4864-163-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4864-606-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4960-338-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads