c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe
Size 56KB
Sample241113-tcatdatrey
SHA256 c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a
MD5 a688abb2b4f41423d9b16492ea975a8c
SHA1 632bfb490298fb114a3f0f49fd77b4549526fd80
SHA512 2b0e579b25d320085f5e8989309cf2cc0cf7e5435f77bde18a7847a75ade4f624b93671914d396c9d933379b494a2f0ac8eb8ff553b6ebe14c7ab39b79749696
SSDEEP 768:+5eyVL4edy0/LWt1NGofQJs6EqXR/KF6UuoIERZ/1H5e2zXdnhA:+5+6CbNGofQaqB/KF6ULIER7A2xm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ompfej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pccahbmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmkmjjaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahfmpnql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caageq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjfmkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmblagmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paiogf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amjbbfgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhbebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cggimh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opqofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmblagmf.exe

Executes dropped EXE 64 IoCs

pid	Process
4724	Nfjola32.exe
2748	Nnafno32.exe
4528	Npbceggm.exe
4584	Ncnofeof.exe
3364	Njhgbp32.exe
3672	Nmfcok32.exe
4264	Ncqlkemc.exe
4928	Nmipdk32.exe
4052	Npgmpf32.exe
4640	Nfaemp32.exe
4268	Nmkmjjaa.exe
2720	Npiiffqe.exe
2920	Ojomcopk.exe
3108	Oplfkeob.exe
1004	Offnhpfo.exe
1744	Ompfej32.exe
324	Ogekbb32.exe
4012	Oanokhdb.exe
4516	Opqofe32.exe
992	Oaplqh32.exe
468	Ogjdmbil.exe
3732	Oabhfg32.exe
692	Ohlqcagj.exe
3412	Pjkmomfn.exe
3484	Pccahbmn.exe
4992	Pjmjdm32.exe
4840	Pmlfqh32.exe
1328	Pdenmbkk.exe
3652	Pfdjinjo.exe
4440	Paiogf32.exe
1556	Pplobcpp.exe
4008	Phcgcqab.exe
3696	Pffgom32.exe
4376	Pjbcplpe.exe
2092	Palklf32.exe
2156	Ppolhcnm.exe
5076	Pdjgha32.exe
2660	Pfiddm32.exe
4172	Pjdpelnc.exe
428	Pnplfj32.exe
3644	Pmblagmf.exe
5028	Panhbfep.exe
5036	Ppahmb32.exe
4336	Pdmdnadc.exe
1324	Qhhpop32.exe
1072	Qjfmkk32.exe
1864	Qobhkjdi.exe
4216	Qmeigg32.exe
4136	Qpcecb32.exe
2940	Qpcecb32.exe
1332	Qdoacabq.exe
2372	Qfmmplad.exe
3176	Qjiipk32.exe
4468	Qodeajbg.exe
4576	Qmgelf32.exe
4252	Qacameaj.exe
820	Qpeahb32.exe
1192	Ahmjjoig.exe
5088	Afpjel32.exe
4960	Akkffkhk.exe
2164	Aogbfi32.exe
4428	Amjbbfgo.exe
4076	Aphnnafb.exe
2116	Adcjop32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Opqofe32.exe	Oanokhdb.exe
File opened for modification	C:\Windows\SysWOW64\Pplobcpp.exe	Paiogf32.exe
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Aopemh32.exe	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ckbemgcp.exe	Cggimh32.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Qjfmkk32.exe
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Qdoacabq.exe
File created	C:\Windows\SysWOW64\Bklomh32.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Bjlfmfbi.dll	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Dgihjf32.dll	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Nmfcok32.exe	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Flbfjl32.dll	Ompfej32.exe
File created	C:\Windows\SysWOW64\Godcje32.dll	Qdoacabq.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bddcenpi.exe
File opened for modification	C:\Windows\SysWOW64\Ojomcopk.exe	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Ahfmpnql.exe	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Bgpcliao.exe	Bdagpnbk.exe
File opened for modification	C:\Windows\SysWOW64\Pdjgha32.exe	Ppolhcnm.exe
File opened for modification	C:\Windows\SysWOW64\Qmgelf32.exe	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bnoddcef.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Cgifbhid.exe
File created	C:\Windows\SysWOW64\Npgmpf32.exe	Nmipdk32.exe
File created	C:\Windows\SysWOW64\Cjceejee.dll	Paiogf32.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Ahofoogd.exe	Adcjop32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Apaadpng.exe
File created	C:\Windows\SysWOW64\Domdocba.dll	Boihcf32.exe
File created	C:\Windows\SysWOW64\Adcjop32.exe	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Aokkahlo.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Onahgf32.dll	Ahfmpnql.exe
File opened for modification	C:\Windows\SysWOW64\Apaadpng.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Bljlpjaf.dll	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Ckbemgcp.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Caageq32.exe	Cocjiehd.exe
File opened for modification	C:\Windows\SysWOW64\Npbceggm.exe	Nnafno32.exe
File opened for modification	C:\Windows\SysWOW64\Pjkmomfn.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Afpjel32.exe	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Akblfj32.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Amqhbe32.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Bkamodje.dll	Bmjkic32.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Paiogf32.exe	Pfdjinjo.exe
File created	C:\Windows\SysWOW64\Pfiddm32.exe	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Ppahmb32.exe	Panhbfep.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Aoioli32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Aopemh32.exe
File created	C:\Windows\SysWOW64\Cnffoibg.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Lmnbjama.dll	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Pmblagmf.exe	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Panhbfep.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Egilaj32.dll	Ahmjjoig.exe
File opened for modification	C:\Windows\SysWOW64\Ckjknfnh.exe	Caageq32.exe
File created	C:\Windows\SysWOW64\Qhhpop32.exe	Pdmdnadc.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Okhbek32.dll	Cdkifmjq.exe
File opened for modification	C:\Windows\SysWOW64\Agimkk32.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Palklf32.exe
File created	C:\Windows\SysWOW64\Pnplfj32.exe	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Pnplfj32.exe	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Qhhpop32.exe	Pdmdnadc.exe
File opened for modification	C:\Windows\SysWOW64\Qpeahb32.exe	Qacameaj.exe
File opened for modification	C:\Windows\SysWOW64\Aphnnafb.exe	Amjbbfgo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5728	5556	WerFault.exe	211

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjkmomfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boihcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qacameaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npiiffqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahfmpnql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dnmaea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmipdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afpjel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pffgom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aopemh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caageq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmlfqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adhdjpjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cklhcfle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogekbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohlqcagj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npbceggm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncnofeof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Panhbfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjiipk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgnddp32.dll"	Coqncejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npbceggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogekbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgfpihkg.dll"	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mioaanec.dll"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfdjinjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pplobcpp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcccepbd.dll"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baegibae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpolbbim.dll"	Npbceggm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npgmpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flbfjl32.dll"	Ompfej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccoecbmi.dll"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojomcopk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnokgcbe.dll"	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okddnh32.dll"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijikdfig.dll"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfdqcn32.dll"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjlfmfbi.dll"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmodnoo.dll"	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmjdm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekgliip.dll"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncnofeof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkcaoef.dll"	Nnafno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjamidgd.dll"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkoaeldi.dll"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmdnadc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4724	1672	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe	83
PID 1672 wrote to memory of 4724	1672	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe	83
PID 1672 wrote to memory of 4724	1672	c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe	83
PID 4724 wrote to memory of 2748	4724	Nfjola32.exe	84
PID 4724 wrote to memory of 2748	4724	Nfjola32.exe	84
PID 4724 wrote to memory of 2748	4724	Nfjola32.exe	84
PID 2748 wrote to memory of 4528	2748	Nnafno32.exe	85
PID 2748 wrote to memory of 4528	2748	Nnafno32.exe	85
PID 2748 wrote to memory of 4528	2748	Nnafno32.exe	85
PID 4528 wrote to memory of 4584	4528	Npbceggm.exe	86
PID 4528 wrote to memory of 4584	4528	Npbceggm.exe	86
PID 4528 wrote to memory of 4584	4528	Npbceggm.exe	86
PID 4584 wrote to memory of 3364	4584	Ncnofeof.exe	87
PID 4584 wrote to memory of 3364	4584	Ncnofeof.exe	87
PID 4584 wrote to memory of 3364	4584	Ncnofeof.exe	87
PID 3364 wrote to memory of 3672	3364	Njhgbp32.exe	88
PID 3364 wrote to memory of 3672	3364	Njhgbp32.exe	88
PID 3364 wrote to memory of 3672	3364	Njhgbp32.exe	88
PID 3672 wrote to memory of 4264	3672	Nmfcok32.exe	89
PID 3672 wrote to memory of 4264	3672	Nmfcok32.exe	89
PID 3672 wrote to memory of 4264	3672	Nmfcok32.exe	89
PID 4264 wrote to memory of 4928	4264	Ncqlkemc.exe	90
PID 4264 wrote to memory of 4928	4264	Ncqlkemc.exe	90
PID 4264 wrote to memory of 4928	4264	Ncqlkemc.exe	90
PID 4928 wrote to memory of 4052	4928	Nmipdk32.exe	91
PID 4928 wrote to memory of 4052	4928	Nmipdk32.exe	91
PID 4928 wrote to memory of 4052	4928	Nmipdk32.exe	91
PID 4052 wrote to memory of 4640	4052	Npgmpf32.exe	92
PID 4052 wrote to memory of 4640	4052	Npgmpf32.exe	92
PID 4052 wrote to memory of 4640	4052	Npgmpf32.exe	92
PID 4640 wrote to memory of 4268	4640	Nfaemp32.exe	93
PID 4640 wrote to memory of 4268	4640	Nfaemp32.exe	93
PID 4640 wrote to memory of 4268	4640	Nfaemp32.exe	93
PID 4268 wrote to memory of 2720	4268	Nmkmjjaa.exe	94
PID 4268 wrote to memory of 2720	4268	Nmkmjjaa.exe	94
PID 4268 wrote to memory of 2720	4268	Nmkmjjaa.exe	94
PID 2720 wrote to memory of 2920	2720	Npiiffqe.exe	96
PID 2720 wrote to memory of 2920	2720	Npiiffqe.exe	96
PID 2720 wrote to memory of 2920	2720	Npiiffqe.exe	96
PID 2920 wrote to memory of 3108	2920	Ojomcopk.exe	97
PID 2920 wrote to memory of 3108	2920	Ojomcopk.exe	97
PID 2920 wrote to memory of 3108	2920	Ojomcopk.exe	97
PID 3108 wrote to memory of 1004	3108	Oplfkeob.exe	98
PID 3108 wrote to memory of 1004	3108	Oplfkeob.exe	98
PID 3108 wrote to memory of 1004	3108	Oplfkeob.exe	98
PID 1004 wrote to memory of 1744	1004	Offnhpfo.exe	99
PID 1004 wrote to memory of 1744	1004	Offnhpfo.exe	99
PID 1004 wrote to memory of 1744	1004	Offnhpfo.exe	99
PID 1744 wrote to memory of 324	1744	Ompfej32.exe	100
PID 1744 wrote to memory of 324	1744	Ompfej32.exe	100
PID 1744 wrote to memory of 324	1744	Ompfej32.exe	100
PID 324 wrote to memory of 4012	324	Ogekbb32.exe	101
PID 324 wrote to memory of 4012	324	Ogekbb32.exe	101
PID 324 wrote to memory of 4012	324	Ogekbb32.exe	101
PID 4012 wrote to memory of 4516	4012	Oanokhdb.exe	102
PID 4012 wrote to memory of 4516	4012	Oanokhdb.exe	102
PID 4012 wrote to memory of 4516	4012	Oanokhdb.exe	102
PID 4516 wrote to memory of 992	4516	Opqofe32.exe	103
PID 4516 wrote to memory of 992	4516	Opqofe32.exe	103
PID 4516 wrote to memory of 992	4516	Opqofe32.exe	103
PID 992 wrote to memory of 468	992	Oaplqh32.exe	104
PID 992 wrote to memory of 468	992	Oaplqh32.exe	104
PID 992 wrote to memory of 468	992	Oaplqh32.exe	104
PID 468 wrote to memory of 3732	468	Ogjdmbil.exe	105

C:\Users\Admin\AppData\Local\Temp\c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe
"C:\Users\Admin\AppData\Local\Temp\c7fab3d606caa822426418017ee6eeffc0c4d8f811c0935e74446f8ab335381a.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\Nfjola32.exe
  C:\Windows\system32\Nfjola32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\Nnafno32.exe
    C:\Windows\system32\Nnafno32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\SysWOW64\Npbceggm.exe
      C:\Windows\system32\Npbceggm.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
      - C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:324
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:692
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        29⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3652
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        35⤵
        Executes dropped EXE
        
        PID:4376
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2660
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4172
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:428
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2940
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1332
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        53⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1192
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2116
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2488
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        69⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        71⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3208
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1388
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        75⤵
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        83⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1728
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2840
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        91⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        93⤵
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        96⤵
        Modifies registry class
        
        PID:2188
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        100⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        103⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        112⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        114⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        115⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        117⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        118⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        122⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 400
        127⤵
        Program crash
        
        PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5556 -ip 5556
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Boenhgdd.exe

Path C:\Windows\SysWOW64\Boenhgdd.exe
Size 56KB
SHA256 3678708d9c1b335990d2a19c1115ee7e85e8340f15de4b84398d3d7b810c9cb3
MD5 7cafa559e3bfabd65aa3c118ad1e9f6f
SHA1 10de6e5a1b31a95a04908afa09c3bb9efa811de6
SHA512 a979a2c79c4dab55eacae1e8ec6c55a27022aad8d0c2b36395d31542a175782fab37b05c72fc129bbedb813b2bba7766a46ea914177b52123c3c14152000aae3
SSDEEP 768:+plkBLGYYioAkMQt7MV7PEKKYFNvu1RI15yy9Itu3RdYZ4vhoxbRJSJ5e/1H509g:+QBPYNMQADEKXNByy9Fw4vhsJI50ym
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dpkmal32.exe

Path C:\Windows\SysWOW64\Dpkmal32.exe
Size 56KB
SHA256 e3b5cd3ce27e12ad0af101bed713dc61c1fde9da2370c8fffbf57735bfd3076d
MD5 0b68ba1d1cb645393db9624659adfe2a
SHA1 b86617e6741d61787ee694c4e4dbd11148c22979
SHA512 6edbfe8c3659f2bcebb8bd2def89536c94cf45faddc37bb98959eefba16f022079d9be19fac192c4b366c8b3b3e73373e4fad0cb3d7fa4eca2f2c6d63ca18ea5
SSDEEP 768:+p3JaiaIEmOcH+Ntbb6/Ag+hV87JTjZCaFlffqM/1H5lXdnhA:+hda/E+NtXeAxhcJwaTpdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncnofeof.exe

Path C:\Windows\SysWOW64\Ncnofeof.exe
Size 56KB
SHA256 4a38c97812eab37dbd02a07617e43eaf0871298981140c97f04e5497e937ad10
MD5 878b324ec04d955ce374ed3a29a8f7b6
SHA1 50146fd87ee43b9f6920fc20a633c68cf1e9b73e
SHA512 2e746a03e73e433a265663636ccab24c3daa6a1103191b421b18aab9fa7cd572b5b0d8101674103e8066aa94fdf0347f113c1889bce9c7ec6c541188b6a1d03b
SSDEEP 768:+CDeX0tr8txyNOGSifjffjvsfrGsAoWtchdPoXljGlJ51zwKx9fcT/1H5Y0zXdnm:+meXmuUjfrkfKoWtsAoD4Mei0xm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncqlkemc.exe

Path C:\Windows\SysWOW64\Ncqlkemc.exe
Size 56KB
SHA256 7510b72728134d8b9ffce0efd8bdea5041514aafd8f4f9aaf3954b3c11513fc4
MD5 53ee6b5182ff0dfc65697d18deb9f232
SHA1 248b64499e66cd99b2bec8fb40053db69eebe2c3
SHA512 6dd12b46f062e91f2dcdad9555b501c474576d0bf35427a552035cc89b2756f7a277b6f2aa21ee3f906023354c8d96aad955cb75d4fd213cb85924855d054ccc
SSDEEP 1536:+Wqw91pz05iZqu7kUARmQN3L7WaF6sJ2222VDg2z5m:H1pz05ivPQ5L7WaF6sJ2222VM85m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfaemp32.exe

Path C:\Windows\SysWOW64\Nfaemp32.exe
Size 56KB
SHA256 923cc558bf4f778832eca82ad7c0f7bb55b0a92908ecb31130b97522b609c8f4
MD5 e8fb8c836c4b3cb5b5131400204b9190
SHA1 389f79fc51d3fe3cd36391217b28474851bf70a0
SHA512 af93125f177115eb31aefdd8890a70086b8cd039e0e70f3a0f8d8142ebf9523c1cb0828c7e22729935f9a76734cb8191910f48a7cdb57f3f1cc2403a50d538ae
SSDEEP 768:+02dhWeOncB0/3KUdp0uxtHqC9DiQEb9xRLBFcEPDS8BmdNrQXZul/1H57rXdnhA:+02TWeE3KUJHqCxiQ6xBXSomdNj/1pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nfjola32.exe

Path C:\Windows\SysWOW64\Nfjola32.exe
Size 56KB
SHA256 fcf87e082da185a3107ef8ce50eb3ea44b98e2769079082332beaafaef1c8ab2
MD5 715f8e87d64d87a1008e5ab385bf6fec
SHA1 25f982bd6eaa67a8d82cf920fce45f21c9c36735
SHA512 6700be5fdfbc5df5c0fdfff2132316dab796c6f1e307e8e5d787353aaf4d03e92e1830b573adfb967dfcb7c202188459ff21baf8aa1032c0b49837018e0208f4
SSDEEP 768:+WIdwfGHJK4Kk0vCBQvRNwWTqL9RIEMKArWhsF2J9/r1SolIc/1H5vMzXdnhA:+DSfGzaYQvRNHqXMKArWu2J9B/IetMxm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njhgbp32.exe

Path C:\Windows\SysWOW64\Njhgbp32.exe
Size 56KB
SHA256 128c969c3ac1b296883a029ed791936345cb02f2054ef1f1ee99e2345fc5ce61
MD5 c0fef28ff9b90fb6d52f3806707bb2ec
SHA1 7c2cbb6f8bc7f0fb2c4836c01008e10fbe673991
SHA512 a865895ec58c2fd237a0d1c6adb19a91e2cccaaf39c207c2e14a357727ce1451fbace67beaf97982eb80b9848c870ec4279ab50822fff86b56d674699f2020f0
SSDEEP 1536:+Xhm95l3OdKnxbUrmB7gBeCWKZXKrDOah/Cm:35FOkxbPEBeCH+Cm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nmfcok32.exe

Path C:\Windows\SysWOW64\Nmfcok32.exe
Size 56KB
SHA256 76ee87aa59d92c0282ea3a815209eb807d59d2de0a6f53fa437c70bc957b1105
MD5 f261f54f510b7a5e06a711f7cd5a5d65
SHA1 12f0860640daf5d54fdd692df2283a3bfbe79e58
SHA512 d149fcea665eb65e0db3148442637acb63957bf23ab7f523101cb72e5f48ffb081e3eab1b686c517c947c9040c50696541c184e9e1341bd9e6e49ac24f648f12
SSDEEP 768:+7LAMwIhY+XZSFqUS6rOqjidHA8UaW1jw8GxvcQvvJ9i3NXCyktz/1H5eXdnhA:+7L8IhjXaFSCZjmPIw5xvRvvJk9knam
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nmipdk32.exe

Path C:\Windows\SysWOW64\Nmipdk32.exe
Size 56KB
SHA256 b15e91df3df635abea13d06ec74775037e722b6119a8150f806535cbc347e9d3
MD5 b6547f276edfba5d57ce45c5083d3a54
SHA1 14b6daed24f940efeab8d30c3d7796386bd45d7b
SHA512 70337b4e3cbb03a1a880eacfb1b64e87fdf42edf6744a443784b436f5aa061451174951b864baa729c9a7c8851e69aca4b7eb4d1766b0bbd6a44816a35b08c33
SSDEEP 768:+93wSObhhGQYdfsv9m0KBX0J408ssfoX6438rzPuA/1H51HXdnhA:+AWw9mXQ40M4MrzVVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nmkmjjaa.exe

Path C:\Windows\SysWOW64\Nmkmjjaa.exe
Size 56KB
SHA256 484281fdf0d5d29ff936c5d114bedfde27884022bd6b3a65de8793dfeeb59a04
MD5 321f2b948ab105a5774c722f120b2168
SHA1 3f60ae0da764cd584d9f90598a03d31263d0b0e8
SHA512 f46a535ad2e773a5b6df9ed267c5ba453057a5a79e4d2e71b81a23d873fb189631434dd89e65f4dcc57535999a49b19e3a9b3c551be732589bf3e88befb0c020
SSDEEP 768:+V904rnMKi6GgRe5WM1Uvah0anvuXD46diu6pjXnsg/1H5wXdnhA:+X04GgRe5WM+ah0avuXD46dJcnwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnafno32.exe

Path C:\Windows\SysWOW64\Nnafno32.exe
Size 56KB
SHA256 5afe25dfa4248072b0a88385db75e2c723433d729504f0ba68a08d0ad6ec9376
MD5 e84fba9fbab780c27250eb79c509b38f
SHA1 8b6ba604f51ef88d4046166433d07eb27e09fa72
SHA512 61799ad3490cb6bae692e4d765aa2f772967be5c84da48327f7ce57200294a1ad84296867c2d4c18ba0e54380cefe9c248bbdbedf5506b2038eccd92d65a74fe
SSDEEP 768:+1lwtgvJ4hWVKdDU9SHgVp6N3rbXksk+5DJxFOjJLoCf3jBKT3X78mLrBn7O3JRd:+1lwtgBRKzIOHZDz7v/B74R8EMRjxm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npbceggm.exe

Path C:\Windows\SysWOW64\Npbceggm.exe
Size 56KB
SHA256 4960b78e234bc36ed214d90392289a3be9450c0afe11a2301d3f64175ac2641e
MD5 82032c5825394e873dcd13115a61df4d
SHA1 a17db6674bdd147c9a889c821d5c8dd871722b41
SHA512 6e33b1a76b28a2e4f18df07491190d23a492629b68d104f826cffded44661d3d5e8ac62bf13f80f4fa9f7bba0d69f946776d1da3e89a4bf650893ff46d25cb14
SSDEEP 768:+A83k5LBgFO7vQyGvzmIVzSzdXExdAJZCS00mz/PGUy5f7NLo/1H5gjPzXdnhA:+AFNiFIYzvzmIViOPAlAjGUajNLi8xm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npgmpf32.exe

Path C:\Windows\SysWOW64\Npgmpf32.exe
Size 56KB
SHA256 fdb4dfd8eb70de9e46d2d6e79a114242111e0160fe5c74144778e827bff985a4
MD5 35280e25482ef54a69770214aea75d10
SHA1 9be97d1403e37783e5e502f56a7dad8e9516cb36
SHA512 d163fef72f322d7853e93d0f7504d226030d50c35737ef8b6d362212504a09a1ce87c3660eb2d2b364cb52ec038b6b3c4abbf2e1b4f6ae7ea6d7840a65df699f
SSDEEP 1536:+ohK2LSy9bbexxjtqT639EANEyv1HiPloly+Bm:/Km9b2xjLld+u7Bm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npiiffqe.exe

Path C:\Windows\SysWOW64\Npiiffqe.exe
Size 56KB
SHA256 6a91309d7494cd001fd0d8254affd371295166cf316b11342aab6f32ac328f8f
MD5 bceeb4d78c9e8bca4f81f0f568828ca9
SHA1 4d6622f631e95f0382e3c3540338aad5f4404a7e
SHA512 f322af5cab992dd966edd5b1977098d9d268ba6427bba7d64355c2e76b758d7d2ebded7f0b8491ae23e56c63c2f54009e71995eb6367a00cccd8d902eb6f3621
SSDEEP 768:+3KyqzU4jiMt/lt6DI9w/WE677BTR3eb2AW5QNTIehd44Zd23JPRYDec/1H5XaXw:+65gR0/x9lL3i2jwd4WdKPRle5gm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oabhfg32.exe

Path C:\Windows\SysWOW64\Oabhfg32.exe
Size 56KB
SHA256 96936b52d1d3f9f91669db7cbddeb75c5d6c56a8f0f263d80ead353b01032b79
MD5 8413a3360975ae6055491e25ee994f68
SHA1 4911127ed1f1fc1359fb1fc3d164e0ce9fc0ba23
SHA512 97db44cf7fedc1cac4e449d07f8b56451e8edca7f1e123ea17c08ea721f61d720675e944d512755779f98ba494f8044f430fd60e9cd0a60701eafabf95e09f9c
SSDEEP 1536:+nV6qoW9aJ6KAoOrLlAiPpvTOZgRe5EmM5sm:m6DYgdgAG1TG6e5S5sm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oanokhdb.exe

Path C:\Windows\SysWOW64\Oanokhdb.exe
Size 56KB
SHA256 0fe748e0fe04c0f02b5506a3ca0c45310769f567126041ad32b16ea57cadd69e
MD5 e0f8d0d4c4a87a04111236251422a314
SHA1 95cd307c2ad8f73b4c8c1b5c5c36b8711655f0e7
SHA512 ce413064ff34aead64201bdd1c1f7b8a04a719e0be65c2290f4dbc2b463b37779f1fc385657a12a9a811f77247de62ae400e58e1ca67feb1ec024f2a9e6f5566
SSDEEP 768:+N9hJkwRMmNoSXTHNkJTICWg7k1lpnlpIAry8+ZGb/VZCKF/1H5iXdnhA:+NuqDwJI/Ukn5NrynZITCKf2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oaplqh32.exe

Path C:\Windows\SysWOW64\Oaplqh32.exe
Size 56KB
SHA256 5f8c4f8e89ad2cf68b7bdcf09c40d890def17aa59bd4460e668631407ebedfd5
MD5 7c3a00f2877829d5ba4518dbb502059c
SHA1 4a95da55829893ca44e34d781364112776b4d603
SHA512 9d8ac5ca59eb8a045b14c3331c7d29ce943a5456a1b3b8eec103d11b2931c187161adef0c1a8aa3d01173d443d84cc3350cf57d54d15e246ba5161f71bb0075d
SSDEEP 768:+HC+WpENZvfKmkWKhYrOf0gUDIu3KPvKw7KcPKj3aiD4m2UfYDdFSuVwO5GJHARH:+QkJ0qZgkl6fgJBfYDd3cgwfGiMqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Offnhpfo.exe

Path C:\Windows\SysWOW64\Offnhpfo.exe
Size 56KB
SHA256 973ba543c249752f3c9b4acc2bfac322481e173aa6cba1ad621533f704eec42c
MD5 ae5f50fa88d4e2ac1fc3ef410baac5bd
SHA1 a2f74c8464ae79e73367ece0ec493841bc07f78a
SHA512 be71150979d3dbce4b8e5d757e98edb2d2081e082251b84f0fac3b0c39d1cb65d84c5191b3eb951f1f244fd829849c27c5f6cd5b19f15e507341acda8cee4c6c
SSDEEP 1536:+E4IZzjXJ5BriDqoLB3L7hUDDzBSZJSc2Pum:7jzF2x13LYDFSJSc2Pum
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogekbb32.exe

Path C:\Windows\SysWOW64\Ogekbb32.exe
Size 56KB
SHA256 203419aa0c361afe537da6efa9d8170ca35320cb9aae36e3bc065bf5925565d6
MD5 cd380c80ed76ad7cdb8d922ecc0a3c42
SHA1 ea102e90e58c53dd65f8e5dc14ca1a772161a349
SHA512 ee0684eb49c437f436360b2eec36324d99155f99b2b9e629d2fadc3d15af0263910f4ee503893822b875da826ddf2d1a8141aa9a5b65f8f10b6419c17e7f03b9
SSDEEP 768:+7KsXsR0B1m9YikQyhOnHwzUN5ThoFe3RoprcDr/euekK7y/1H5LXdnhA:+7hO0BYTkqwzUNOh2rpekBHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ogjdmbil.exe

Path C:\Windows\SysWOW64\Ogjdmbil.exe
Size 56KB
SHA256 453de43100d11156356225883a39eb9ff9ee70ca4cdc06fc9e1fa9e055f2ea10
MD5 4020a506aeac594ed9d6e194c3ffde35
SHA1 48fcec2ffe859af91bb6a1cf3599f2a1f06de50b
SHA512 6a63d6ec419416bfcf0d297a0ef5006509f976aa087701921a67d43c065d9bf44cb50bd8b3a7134fa9a9d9ebde9f6c6de3b1555d8e3ae6815fa108ea0d359a02
SSDEEP 768:+iTHXqqaiKJ3aiYKD7OMkENdyj1lJdKfRO6nulW0pycWsJykH/1H5LXdnhA:+8HX+ic3aBKLdNdyjpIRO6XuXR8kt3m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ohlqcagj.exe

Path C:\Windows\SysWOW64\Ohlqcagj.exe
Size 56KB
SHA256 b000cc7b0b152795e2e28abca17f2be2159f433fbe2d6f5e67df1049851d36f5
MD5 29d3cb4374bc47879c7468e1954ccf56
SHA1 cae980db6002574399e94e65f59bdf20e0692fd5
SHA512 69d306406001850e845611764935cbebb35da654ed5da709bb2e0a0b0a6e4416a308f28e69151d59068cbd0faee33d6828e603e3183f2a635cfcc172d3948ca0
SSDEEP 768:+SkCunXMje3za1xPkzFCisdwDkAJChfVdEA5PHHHQx/1H5xXdnhA:+SkZAem2CiOVPEuHWhm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojomcopk.exe

Path C:\Windows\SysWOW64\Ojomcopk.exe
Size 56KB
SHA256 67e7c54095b6005f030a18b1dfc0b1e3ab76ab192d6adb4128fc5fa83b89eafc
MD5 053c364240fd2b7e45a302eb0e6b8449
SHA1 9149641ac327c4948b63b6f17728976514098453
SHA512 eda0754bf701037c4da04979a22dcfc56769de2de5b65bed38f2680a5b7fbf01fc817bc182a06884877e8e6eca6714561b796f1aefe40d0808947eecc17e7ede
SSDEEP 1536:+itV8X38V7FM8YoJ0rmSqcX2RrbvG/9Em:b8HEGbrmX7RrbvG1Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ompfej32.exe

Path C:\Windows\SysWOW64\Ompfej32.exe
Size 56KB
SHA256 b255a4fdb6515b0383b516bb22c3624900cbc72ce876548cad8af590755bbe19
MD5 f8e1dd413223f2387ed43e8013f0ca70
SHA1 f6bb9945463972c057b2c59e29b50f40361c3fa3
SHA512 eda211067de871799a9cb5d919e3e6c7f4d6f854817d4655e794efba0f1c758d769081b8f14b8c4e66903fd906448df26a5cba7840767fe24c6641a0ccc3525e
SSDEEP 768:+PHUMzF1rQ/0USF9btaSuXaHj/d6e5C0ufZJxUrYquzHW2JkFCnH/1H5ZsXdnhA:+/R19z/d6EuwYqEftjGm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oplfkeob.exe

Path C:\Windows\SysWOW64\Oplfkeob.exe
Size 56KB
SHA256 111c9f3219cb6e0c9875f71ea306d5cb108c972df099d5035ed2987b1d7997dd
MD5 7da0e79e1c105e49dce7e70aa2904c35
SHA1 5b1e5b59687070880f7c72dd0238428278263662
SHA512 adbe3893a94905ab465667f5ba129c511724d0c7098ba1640b59856eff559faae3b767f9f2c951ab4a2b2dd4249ca05b827d5e468ba52a1fac1fbe82886eec41
SSDEEP 768:+Z+UlDsnvukhDAHOLpU1HITmx+Aqw8pA8T/TecAAwEsbfY8dOtO0E/1H5ClXdnhA:+QYxu/LOHOAh8p5/TecAAwXbXdOt64m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opqofe32.exe

Path C:\Windows\SysWOW64\Opqofe32.exe
Size 56KB
SHA256 5d095a8e32272c98aa2a35135ec43ce4a5e80dd5d9de2218b5d9a5433dcf4dc0
MD5 17dd1660d3c2ae8567bb27dc0bba402c
SHA1 46e9329bce4ec0e2b90054719d3ca5911e972bde
SHA512 604bcac7ae14a3df9b02ff6d5ec673c2213abafa3a057fad368f05372b94976daefb4eaeb24046c360dd9f84bbfb2e134063f0d4b0b8c584f1883feb8f14ca73
SSDEEP 1536:+zNrALoJvEaCYNWX3gYCBwMPTOFz9XO2Km:SNr5BfC2WExPTwxVKm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Paiogf32.exe

Path C:\Windows\SysWOW64\Paiogf32.exe
Size 56KB
SHA256 6b3960c1cdf155ef33af15205e9775d7bcb54172f29f21725fc24db034d4076d
MD5 2f6e430fdd0549c746552f5aaf7b2d12
SHA1 b668b5a5ad61752a7687007c74d2ec341314603b
SHA512 3ef3f240b4ccb86f03f0759cca7f218d057e1d4a94d85e71dfc25390bb77ef62a6130337e1e58f865efb9969c4bdf980637484745f1b6e0d399e3dbae9a0ced2
SSDEEP 1536:+/DjaxDagJyG1VerEZINn3f/pEUYG7DktB2xofrocUZWm:ciagJL1OKK3pE7G7DktB2xozUZWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pccahbmn.exe

Path C:\Windows\SysWOW64\Pccahbmn.exe
Size 56KB
SHA256 8a19deb6781ef91837da96a04bb5a219ddb9fdefb34580a450baaedcde8e7854
MD5 42bee94a255d4b7173be28f1388f43f7
SHA1 e8dc024785c5ca23259490e065c4d48276e38db4
SHA512 566dd76255a6e4cc4339237e282b56bbe74a32b7c82b35b3012f4912c968a3dc7e2f75852566677ec697810bf6c9320ef9e7489a42034ba48f5a20a7ccc393d5
SSDEEP 1536:+1DYyJPzWJGlaAazfr/NYmghBWLEaMb22ZPqkBifXm:WFJPzWJ0aAazfbNYmghBWLEabsBifm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pdenmbkk.exe

Path C:\Windows\SysWOW64\Pdenmbkk.exe
Size 56KB
SHA256 d09649776b98265db0830c0b5fe3a433b2b8b0d65abb08da55eb973af8abbed5
MD5 7e052765fec6b0d0b1d793cfc0bb29e9
SHA1 af44c287bb169abe3262dccf76f9dcba46fddc77
SHA512 6a713c1c73634843369c4cecb1c907d944ece737cd2908e5f771b24d009b30746609301120eff6eeda4213092af2db7ce6365aca6e0fd1278ba5fc42906e8914
SSDEEP 768:+LU7STYuUM9qYb0ASy8f2pETr1RSYpgvyV0cU+/poqNJ/89hC9lqK/1H5h0XdnhA:+UaoM341gYpgGJU+/poqNJ/89holFLOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pfdjinjo.exe

Path C:\Windows\SysWOW64\Pfdjinjo.exe
Size 56KB
SHA256 733c808e6b3f904ab9d16c527a3f0d0681e8eb0f8adf3d3978a960e973d46a10
MD5 b8541956e15b8c4d487c6bb5060b4509
SHA1 a1c504903620a8a29735c087984678fdcbabe9e7
SHA512 033a47d469c5994092dcebffbc4e7ef7597e584633d8f03aa67eb0f81bd91a886a77615b394499c2d85dc666dfbe6e407f468fc377492cdded2cde7d630f471f
SSDEEP 768:+gv6BTbWzYdAxBnw2X3UiuhSwVxtq+EYaTTthq7JzrWWDAB5wPnzdii/1H5pFXdm:+gv6BTojDXBmSi0+ERTT7q7ZyoLfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Phcgcqab.exe

Path C:\Windows\SysWOW64\Phcgcqab.exe
Size 56KB
SHA256 27cd17aeed7958a92853094183bf008f027098b27f0b6902f151de9c31eb6ebb
MD5 afc02c876fe33dc1a81fbd6d5d82a8b3
SHA1 5d27e85d4dae1ebc94453c21bc69fd90d6d0ea48
SHA512 6473155a20c9f16fc83b5a72262fa63669eb8056a87a67da904bf43eb30eeee5dcb3e9686f450d5911548f10362622ae52fbb32c64559801fa86b805e5907822
SSDEEP 1536:+PaGxZAj9NnlrusXRLu1Cd796LYUargKm:slxOlSe1R96LygKm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjkmomfn.exe

Path C:\Windows\SysWOW64\Pjkmomfn.exe
Size 56KB
SHA256 96d2002cd24ec1c82a8b796847847058f0006076f2a17c67e6643978342e5d10
MD5 cb2277c7604a6f2576df9c8ceb0d2aae
SHA1 d475717b46ca2113b39292cec9e72082527f482a
SHA512 d6e8caf3f06fc2b4c784b4946002d4497315403a78b560f2eedd352ff1786e5fc35266ecc60c124fbba846a0e0faead8e9305e8a1729b551264a5b98f8364121
SSDEEP 768:+TkE8bU/xoQuLR8oBt2pqfdkp9mV4zjsOa55JV+e6wl0rtR/1H5fcXdnhA:+TkXbU/KCoBcyd89XK5JV0wl6Vsm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjmjdm32.exe

Path C:\Windows\SysWOW64\Pjmjdm32.exe
Size 56KB
SHA256 925cb5d000e6f105c41417977a2e7d784fb3025f6f17dc36e8bf06f19e72857d
MD5 a25d030bbbc2df0bcdb1e487513bdb08
SHA1 c7d48d522f1c44a6cf7abf932eb543f2d8dadd9e
SHA512 b9a3d78859d56b86fcb58fae0b42db571bbd6ac901530c3cddfd222619074d545e0d9b65237a843d7b607ba46b06917e24cb7cfd6b6f524b5d600b0fd403bb5e
SSDEEP 1536:+WwLvdThvOII61kTgcgDWHLrz1NsUYx6+S80dv+m:dwLvTvz1d4bsdx6+S7+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmlfqh32.exe

Path C:\Windows\SysWOW64\Pmlfqh32.exe
Size 56KB
SHA256 390ffdc5bb8a1f4feab7eef0befd754aab4d60f23e6b98078e537a994fe56bd7
MD5 f9f3e0cd1e4ee2ebd13e44d28480e23e
SHA1 3b7c7e99bda547d38a0d3b1ba4a2dd5df40fca2d
SHA512 af7616cea75f2fb5202c62f3eca793e39ce911d4ecd9b137cd9c9412796d2932797db158cbd8f611a176240b797f19ab53ec3e6c133f00c1b34e1a003b8d17fa
SSDEEP 1536:+1g9SofIwzKX9FMzO4dyjCXT4pUkal3K+DLiJ8m:z90YkvecCY+DLiJ8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pplobcpp.exe

Path C:\Windows\SysWOW64\Pplobcpp.exe
Size 56KB
SHA256 af2d5d85e54cbd798fcaf88f6dfeb7d35fed9c42a0500b7edc007bbf307d135b
MD5 33055e0a6c0ca10dfbc6f37a8bed5dd6
SHA1 5d745c192cd07d5b862c00519aa6b1e9f387364a
SHA512 2ccf6d10cc8f31e9f937870e31334896b24350c7c03fae1f798d642300bbda1180d9d3febe36f8e35c171fc6071995d1ad6b8438b8f4e643b1c3aa1363bdf9da
SSDEEP 768:+KqU2t9k1HBhXyPwoVioxw5oHL/DO/+GN9qaMlE6IJhtqFP2BxOhM/1H5gxXdnhA:+Kqht9I7X2iqO/W9IJuF+B3Em
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-144-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/324-234-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/428-338-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/468-274-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/468-180-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/692-199-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/692-291-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/820-437-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/992-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/992-172-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1004-127-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1004-215-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1072-374-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1192-442-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1324-368-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1328-324-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1328-244-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1332-401-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1556-275-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1672-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1672-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1672-72-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1744-229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1744-136-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1864-380-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2092-305-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2116-478-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2156-312-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2164-460-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2240-484-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2372-406-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2660-325-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2720-100-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2720-188-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2748-17-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2748-99-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2920-108-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2920-198-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2940-394-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3108-206-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3108-117-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3176-412-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3364-126-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3412-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3412-207-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3484-216-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3484-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3644-344-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3652-258-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3672-49-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3672-135-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3696-292-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3732-283-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3732-189-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4008-284-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4012-243-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4012-154-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4052-73-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4052-161-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4076-472-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4136-389-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4172-332-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4216-387-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4252-430-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4264-57-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4264-143-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4268-91-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4268-179-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4336-362-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4376-299-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4428-466-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4440-331-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4440-266-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4468-418-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4516-257-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4516-162-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4528-25-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4528-107-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4576-424-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4584-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4584-116-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4640-81-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4640-170-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4724-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4724-90-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-317-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4840-235-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4928-153-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4928-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4960-455-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4992-231-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5028-351-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5036-356-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5076-318-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5088-449-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6124-901-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads