3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7

Analysis

max time kernel
138s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Size

327KB
MD5

66279bee22c5d76677a02c4d9dee31b2
SHA1

c7def451f4edac9ae1900eb94016553dcb5ac166
SHA256

3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7
SHA512

2a85ec1d5c5e7ac3b6d82fe4e5de82be4da1082378e62904914e77fdaab6446c07adb78ff381fb5c3b4d03c312034582563db2f1185d070d69990542c99a7ad4
SSDEEP

3072:TYM/ftdzvcJWGz4hPYCcrWPOECEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESLjb5T:cM/T4YgCcr8O4j0+r+Mds9BY

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afbgkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkndie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaenbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqlcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgelgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cacckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amnlme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apjkcadp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aggpfkjj.exe

Executes dropped EXE 45 IoCs

pid	Process
672	Pdmdnadc.exe
4496	Qobhkjdi.exe
1296	Qpcecb32.exe
2008	Qfmmplad.exe
1276	Qodeajbg.exe
4876	Qpeahb32.exe
3152	Akkffkhk.exe
3000	Aaenbd32.exe
3788	Afbgkl32.exe
4008	Aoioli32.exe
3080	Apjkcadp.exe
856	Amnlme32.exe
2204	Aggpfkjj.exe
4940	Agimkk32.exe
4696	Amcehdod.exe
3272	Bhhiemoj.exe
2616	Bmeandma.exe
244	Bdojjo32.exe
1868	Boenhgdd.exe
3104	Bhmbqm32.exe
1232	Bmjkic32.exe
5052	Bhpofl32.exe
1928	Bnlhncgi.exe
4676	Bgelgi32.exe
4188	Bajqda32.exe
388	Cdimqm32.exe
760	Cnaaib32.exe
1676	Cdkifmjq.exe
4448	Ckebcg32.exe
1580	Caojpaij.exe
4312	Cdmfllhn.exe
3988	Cglbhhga.exe
4020	Cnfkdb32.exe
2276	Chkobkod.exe
4064	Cgnomg32.exe
4540	Cacckp32.exe
696	Cdbpgl32.exe
1404	Cgqlcg32.exe
2956	Cnjdpaki.exe
3472	Dddllkbf.exe
1248	Dhphmj32.exe
3360	Dkndie32.exe
3648	Dahmfpap.exe
4212	Ddgibkpc.exe
4776	Dkqaoe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Agimkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Cdkifmjq.exe
File created	C:\Windows\SysWOW64\Eignjamf.dll	Aaenbd32.exe
File created	C:\Windows\SysWOW64\Bmeandma.exe	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Cacckp32.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cacckp32.exe
File created	C:\Windows\SysWOW64\Aggpfkjj.exe	Amnlme32.exe
File opened for modification	C:\Windows\SysWOW64\Bdojjo32.exe	Bmeandma.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
File created	C:\Windows\SysWOW64\Hlohlk32.dll	Amcehdod.exe
File created	C:\Windows\SysWOW64\Pjllddpj.dll	Boenhgdd.exe
File opened for modification	C:\Windows\SysWOW64\Cdkifmjq.exe	Cnaaib32.exe
File opened for modification	C:\Windows\SysWOW64\Dkndie32.exe	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Qpeahb32.exe	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Ejphhm32.dll	Aoioli32.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Agimkk32.exe
File created	C:\Windows\SysWOW64\Epopbo32.dll	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Aamebb32.dll	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Bhmbqm32.exe	Boenhgdd.exe
File created	C:\Windows\SysWOW64\Kolfbd32.dll	Bajqda32.exe
File created	C:\Windows\SysWOW64\Cggkemhh.dll	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Qodeajbg.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Akkffkhk.exe	Qpeahb32.exe
File created	C:\Windows\SysWOW64\Apjkcadp.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Amnlme32.exe	Apjkcadp.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Ddgibkpc.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Pdmdnadc.exe
File created	C:\Windows\SysWOW64\Kdebopdl.dll	Apjkcadp.exe
File created	C:\Windows\SysWOW64\Cdmfllhn.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Mgnddp32.dll	Caojpaij.exe
File created	C:\Windows\SysWOW64\Cnjdpaki.exe	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Akkffkhk.exe	Qpeahb32.exe
File created	C:\Windows\SysWOW64\Bnlhncgi.exe	Bhpofl32.exe
File opened for modification	C:\Windows\SysWOW64\Bgelgi32.exe	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Jgddkelm.dll	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Afbgkl32.exe
File created	C:\Windows\SysWOW64\Agimkk32.exe	Aggpfkjj.exe
File opened for modification	C:\Windows\SysWOW64\Bmjkic32.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Ehojko32.dll	Bhpofl32.exe
File opened for modification	C:\Windows\SysWOW64\Cgqlcg32.exe	Cdbpgl32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dkndie32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dahmfpap.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Apjkcadp.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cgqlcg32.exe
File created	C:\Windows\SysWOW64\Ddgibkpc.exe	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Godcje32.dll	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Qfoaecol.dll	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Cglbhhga.exe	Cdmfllhn.exe
File opened for modification	C:\Windows\SysWOW64\Cacckp32.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Mnpofk32.dll	Dhphmj32.exe
File created	C:\Windows\SysWOW64\Nchkcb32.dll	Dahmfpap.exe
File created	C:\Windows\SysWOW64\Qfmmplad.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Bhhiemoj.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Ebggoi32.dll	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Lelgfl32.dll	Cnaaib32.exe
File opened for modification	C:\Windows\SysWOW64\Caojpaij.exe	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Aaenbd32.exe	Akkffkhk.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2280	4776	WerFault.exe	131

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddgibkpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkndie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cglbhhga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhphmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhiemoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agimkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caojpaij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afbgkl32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjllddpj.dll"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpagon.dll"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aaenbd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekppjn32.dll"	Dddllkbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdebopdl.dll"	Apjkcadp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caojpaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apjkcadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Agimkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plikcm32.dll"	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfoaecol.dll"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keiifian.dll"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcaaeme.dll"	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Apjkcadp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjlfmfbi.dll"	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cklgfgfg.dll"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhpofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejphhm32.dll"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkicbhla.dll"	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdkifmjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nflnbh32.dll"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aamebb32.dll"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbkkam32.dll"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 672	4804	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe	84
PID 4804 wrote to memory of 672	4804	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe	84
PID 4804 wrote to memory of 672	4804	3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe	84
PID 672 wrote to memory of 4496	672	Pdmdnadc.exe	85
PID 672 wrote to memory of 4496	672	Pdmdnadc.exe	85
PID 672 wrote to memory of 4496	672	Pdmdnadc.exe	85
PID 4496 wrote to memory of 1296	4496	Qobhkjdi.exe	86
PID 4496 wrote to memory of 1296	4496	Qobhkjdi.exe	86
PID 4496 wrote to memory of 1296	4496	Qobhkjdi.exe	86
PID 1296 wrote to memory of 2008	1296	Qpcecb32.exe	87
PID 1296 wrote to memory of 2008	1296	Qpcecb32.exe	87
PID 1296 wrote to memory of 2008	1296	Qpcecb32.exe	87
PID 2008 wrote to memory of 1276	2008	Qfmmplad.exe	88
PID 2008 wrote to memory of 1276	2008	Qfmmplad.exe	88
PID 2008 wrote to memory of 1276	2008	Qfmmplad.exe	88
PID 1276 wrote to memory of 4876	1276	Qodeajbg.exe	89
PID 1276 wrote to memory of 4876	1276	Qodeajbg.exe	89
PID 1276 wrote to memory of 4876	1276	Qodeajbg.exe	89
PID 4876 wrote to memory of 3152	4876	Qpeahb32.exe	90
PID 4876 wrote to memory of 3152	4876	Qpeahb32.exe	90
PID 4876 wrote to memory of 3152	4876	Qpeahb32.exe	90
PID 3152 wrote to memory of 3000	3152	Akkffkhk.exe	91
PID 3152 wrote to memory of 3000	3152	Akkffkhk.exe	91
PID 3152 wrote to memory of 3000	3152	Akkffkhk.exe	91
PID 3000 wrote to memory of 3788	3000	Aaenbd32.exe	92
PID 3000 wrote to memory of 3788	3000	Aaenbd32.exe	92
PID 3000 wrote to memory of 3788	3000	Aaenbd32.exe	92
PID 3788 wrote to memory of 4008	3788	Afbgkl32.exe	93
PID 3788 wrote to memory of 4008	3788	Afbgkl32.exe	93
PID 3788 wrote to memory of 4008	3788	Afbgkl32.exe	93
PID 4008 wrote to memory of 3080	4008	Aoioli32.exe	94
PID 4008 wrote to memory of 3080	4008	Aoioli32.exe	94
PID 4008 wrote to memory of 3080	4008	Aoioli32.exe	94
PID 3080 wrote to memory of 856	3080	Apjkcadp.exe	95
PID 3080 wrote to memory of 856	3080	Apjkcadp.exe	95
PID 3080 wrote to memory of 856	3080	Apjkcadp.exe	95
PID 856 wrote to memory of 2204	856	Amnlme32.exe	96
PID 856 wrote to memory of 2204	856	Amnlme32.exe	96
PID 856 wrote to memory of 2204	856	Amnlme32.exe	96
PID 2204 wrote to memory of 4940	2204	Aggpfkjj.exe	97
PID 2204 wrote to memory of 4940	2204	Aggpfkjj.exe	97
PID 2204 wrote to memory of 4940	2204	Aggpfkjj.exe	97
PID 4940 wrote to memory of 4696	4940	Agimkk32.exe	98
PID 4940 wrote to memory of 4696	4940	Agimkk32.exe	98
PID 4940 wrote to memory of 4696	4940	Agimkk32.exe	98
PID 4696 wrote to memory of 3272	4696	Amcehdod.exe	99
PID 4696 wrote to memory of 3272	4696	Amcehdod.exe	99
PID 4696 wrote to memory of 3272	4696	Amcehdod.exe	99
PID 3272 wrote to memory of 2616	3272	Bhhiemoj.exe	100
PID 3272 wrote to memory of 2616	3272	Bhhiemoj.exe	100
PID 3272 wrote to memory of 2616	3272	Bhhiemoj.exe	100
PID 2616 wrote to memory of 244	2616	Bmeandma.exe	101
PID 2616 wrote to memory of 244	2616	Bmeandma.exe	101
PID 2616 wrote to memory of 244	2616	Bmeandma.exe	101
PID 244 wrote to memory of 1868	244	Bdojjo32.exe	103
PID 244 wrote to memory of 1868	244	Bdojjo32.exe	103
PID 244 wrote to memory of 1868	244	Bdojjo32.exe	103
PID 1868 wrote to memory of 3104	1868	Boenhgdd.exe	104
PID 1868 wrote to memory of 3104	1868	Boenhgdd.exe	104
PID 1868 wrote to memory of 3104	1868	Boenhgdd.exe	104
PID 3104 wrote to memory of 1232	3104	Bhmbqm32.exe	106
PID 3104 wrote to memory of 1232	3104	Bhmbqm32.exe	106
PID 3104 wrote to memory of 1232	3104	Bhmbqm32.exe	106
PID 1232 wrote to memory of 5052	1232	Bmjkic32.exe	107

C:\Users\Admin\AppData\Local\Temp\3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe
"C:\Users\Admin\AppData\Local\Temp\3b1abd4c172d45ee234f18d14c78f8cfdb92c21ba3bebd51c44b9dd0baff94f7.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\Pdmdnadc.exe
  C:\Windows\system32\Pdmdnadc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\Qobhkjdi.exe
    C:\Windows\system32\Qobhkjdi.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Windows\SysWOW64\Qpcecb32.exe
      C:\Windows\system32\Qpcecb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1232
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1928
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:760
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4212
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 420
        47⤵
        Program crash
        
        PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4776 -ip 4776
1⤵
PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
327KB

MD5
94846b4905ac29e27d2cd3e764499aac

SHA1
8378e9a78bdf9bc8d4275376c0e5cd8198327e3a

SHA256
c1b9cddf69db408a665656bf313385bea458ac072eb7daf735faa7a4d2d3d812

SHA512
6ff25538c74a8fc3ae4d72a47c6efcdc025020c5487ddd381541694a6c0b74119815ec310910f43b87c9fce27b72295973fe6057346fc1477ef989ea21855c9c

Download Submit
C:\Windows\SysWOW64\Afbgkl32.exe

Filesize
327KB

MD5
87b1dfb65d6eca8da3fc420dc2bd0927

SHA1
b03d74dd29fcea60e882718ab64a2a7f896315b2

SHA256
c7e42179c72453d47d6891955c8fcbc8b08a6070ed3e53cf9427d35c1ad78b51

SHA512
58220fa5f482077c1458e07b200263bc13702cf35a09a84f4b80ee89b68343ff0846ce53841053be97e915e1ab327e935ee65812af3cc6eb5d9ae289667535a9

Download Submit
C:\Windows\SysWOW64\Aggpfkjj.exe

Filesize
327KB

MD5
99833173abc78385a4c082420dd0ec92

SHA1
f53efce73d8dfc68ab85c160bcd7aac9a74fc47d

SHA256
a32f28528f5507e7e4ce726b185b16f823206d17eb5edd6a5b0eeb363f3fcdd3

SHA512
dbea2a5ce4de38632dfb738144e3c87876e0653a8389095ddac5c55a67af869d588a7deeb1e7782f45c9a9f249429bc2a99a7ce896f828ba3e14dd9f1bfb2faf

Download Submit
C:\Windows\SysWOW64\Agimkk32.exe

Filesize
327KB

MD5
f5d4a789ea6b5530cfc6675d17b5e8ea

SHA1
4b7fa5c53fdca8722f41723258b1c980dbab3b61

SHA256
984d8d309db89279f5587d17310b30de1ceaae1fa2afa58d0348bbee8214d832

SHA512
0ca16a19ed88def076e4e12e4ef526a87bb86805f0ef4301f7759aea9fa57d351bee45a636a5c8a920920f3bf40abbe2cefeb528ad72b6c7c6d76143d283c9ab

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
327KB

MD5
9e848084e19eaac45073c5a284993770

SHA1
bfd827d46863db23e325b04c19847b71621f1899

SHA256
98714902674507b703f385bcc9190fd00087fd5faa0b2206cb1595c46ecfe216

SHA512
fa265cc7168e0bf75b670931d668f4663243cdd720b2e8d3a637b5fe93d341ce5916592b4ad235c493a44641164f4e374a8acb7153190f5e3b3c03089cf7fcb9

Download Submit
C:\Windows\SysWOW64\Amcehdod.exe

Filesize
327KB

MD5
c05a8be6183bd1b47fdac4f8e988bd7c

SHA1
f7cdfe0dfd96e946a1b4ce46fd92805e02b06698

SHA256
84b093cb401f48eab45df6de14039b108e1405ce8c949bcb7278b5401f6a17f0

SHA512
78a303a0846e0e145e640fe24be7d9967201b7c67ea300373395215799e8573bbe53be6189ca2d3996aeda28dafd4203e9190c6d918b1ef9870869f9fca62215

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
327KB

MD5
951ebab1008fb6833af263e97891856f

SHA1
9c3c53c0b15d9d4a5b223d78c9dc3cc8db2d4929

SHA256
826bf4fd2773db6529ebe8b6e4f5bbcbae1b317663eea8f3b6ecccba3a590cd5

SHA512
86d918874db81049438f2446cedf859362b9fe263fc51b3ec83b66650d00b4f6310f0e256846e24aae96676770aa66be2f6d5572ece96cf937349ebc5d0e980f

Download Submit
C:\Windows\SysWOW64\Aoioli32.exe

Filesize
327KB

MD5
d80b6ab103bd0b765daaa49ec076cc46

SHA1
015b6bf2a682fb75ff7afd59808a21a49755cf21

SHA256
85e0caeae2b0668c698e65347b5e4f097638f435b910f09a18849e9967b40f6c

SHA512
9213a6d7a6a24aca1e9639320645daf09a5e9e227fd4f6b7f40141afe318902f36fecea251f0449c992c6bb496a958bc178f3bfdb19ac812c4e66dc4cbed1b49

Download Submit
C:\Windows\SysWOW64\Apjkcadp.exe

Filesize
327KB

MD5
fb06678a79fd9e0444fef87be6bb191b

SHA1
1d0cb9450d9728f56834c344af1c233acb00f27f

SHA256
575b961c8b30196b1951f8c434e14c5416c01f158d5fee533d05a05d49b6297c

SHA512
d006948581e428e8f5383485b327e4858128242b58283c9fce3875764da61fd8f06815ea0281c86c27e6639d644a7691cd9eeb24d3c39d3cee380e07872a0e34

Download Submit
C:\Windows\SysWOW64\Bajqda32.exe

Filesize
327KB

MD5
c112ad3f4739210146d5cde35690cc86

SHA1
850f83a5fe4029b003e35d4a146d27bfdf73ecc3

SHA256
58ff7f5a1ab6eeca4a1ef16bf11a05fb6b04e7cb91881c2167449e834127fa2b

SHA512
0a2742c0265c64dc8cbd4e2367b6ee3de4172d19026e691bfc084974c37c75e6144014c44fe347e6b52c68437a503b31406c76a8d07feffc8f1203d76be4c2fa

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
327KB

MD5
99ac3c2a6f244ba5b9bac2fc26db55ce

SHA1
c478416ab59a616d28335f864a941e55203d5110

SHA256
979facc0258b74bad45b16f829001417a9bbc0f158505a89872ffba39083a767

SHA512
b7b1e42b88496dde10fb18aecc6b4121b3c2089ad985c9e2894f65702b77ccc1ae5909cc70bcc660eec8c1a33b1fa40a62f95f16caaa5f173027481ea8e756e4

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
327KB

MD5
f348c571612487b3d89b8f0c0002fdd4

SHA1
788ba0f5ce92b48c7517a594e2dc95efa2fbf762

SHA256
e2a1288eb5fce800c5744d850c40cbaa22e92dffd011db1d420b73d4415ff471

SHA512
3402de012204171f5a0960e501a7ed3dab8d45e441ba386db6411a6fc0c49d97972c89216efdad96d9d3b590b929a5ddbe5731a42cd4ec0ff54c1811103bdbb8

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
327KB

MD5
d57e1f338974b202b95ebaffc53c8ec5

SHA1
eb109274546973371a855163475fcc121ca41f56

SHA256
3dabadd484305b0699d6085bbe0f1ddea373ab860ea6ed1782d06c4b85994d3c

SHA512
70d9a6d0aa94248855f27e3031c14f3ff584c657e3804e79e6c64fb7a4e1789987942c4cc8a87a7357f5f21692d6afc5a479ee486de03cfb37452249ce9c96d6

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
327KB

MD5
c8f0d8c98d6f87725475d41b34c9094d

SHA1
163988d9ebe34cf489d729c3f8eaf775129b3813

SHA256
d171988f87b93aea7984d9234fe46dc309276e630f6f67a28f3ddfc72b746803

SHA512
a9cd34668415894def868de129aecc26648e048d9611be77e1b8501e3b1c9e5bf67a7c3c6c09c4c8af923a8086e5916a2d7e3a1fdb8f880bfe292217dcb23522

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
327KB

MD5
488a4b1a170d1c91a8257e204d929f5e

SHA1
47b5375fa4b30288392759065a577b1c39d034b3

SHA256
4d477a1d255467f4689c5f887f222a3d95fa1c4c435aead0bd985d2b3d50030c

SHA512
4d0e0e9fb297d34dc31d32ecf515d30ce9246044fa3b28b49c940470bcd52908be08823ea82daccb4a7c41b97d7718f8b315af074acacd61b186bff9e5874a02

Download Submit
C:\Windows\SysWOW64\Bmeandma.exe

Filesize
327KB

MD5
629fe8f79e407c75475acd0f58061301

SHA1
0efdcbbb4c0a4ea58c40fd6f69fb8d6fa14a443a

SHA256
8f1e443726b166b797dd4797a8e6c1057fea8b64dfef62e696b115c7e579c070

SHA512
341becba3c709c8bc5fe574652bb1f07c00b17fe5b6ea87710c9dbe1584d2fa1d7f458abfcdf64e358e7796fbf1ffdd031856a763c5072fd4ebea1bd21057197

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
327KB

MD5
7e4b38a0122aa7a8d1d172aa40cdf7e6

SHA1
e9e0e391fd4fdbbb8f498713887e466baf8a0660

SHA256
08aacf22667bf51dc027c71cef0c9165d1076c0d8919f9b35ae498f7cacd4165

SHA512
2883352567e9a23b54b41a6b32c234db491aa38ec3a4cd31481a5d99b433973168823e677f7434bf8768ee8b039ddf2dc94653048dc89b7c200087a9175a5fd2

Download Submit
C:\Windows\SysWOW64\Bnlhncgi.exe

Filesize
327KB

MD5
db48d63356e730981bb1281554a265a2

SHA1
2beaf576c1b71c178b79019f60dea8f094e56a71

SHA256
1f7191d4270f602d7eb458aa6f0c0d1996239932957b9a04d2b2791a017bf2ea

SHA512
d2c8459f134aa0c742d679dbe89045df1524c0c70584ae17986b2c2b902c5e501ef182b7b352e9345cbe2c12cad64777dc72c32bdf9324e90915bce78293a7d0

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
327KB

MD5
64c6a65cfeb19d7d1474453a948358ec

SHA1
7be53941c6ebc135eef15cbdbdf1d0b660dec274

SHA256
b8388b069fb2aaed0d58a2b248a44695537087b20c0ee9a6ec6fc2d3cbc373dc

SHA512
3634d6f226732f4900ca3d917d881672c354da6721a62e911347679d0554920fef8586841581d01b9d4187fc953d485c4c002d7c988cda8e7f523c93b876f9d8

Download Submit
C:\Windows\SysWOW64\Caojpaij.exe

Filesize
327KB

MD5
6e813e35032c196879935fdd3a9664c9

SHA1
a5edd000cb809d29755d404479a8d66d96b8b58d

SHA256
8a0080ef19731110097ddba1889d4092d4c091a43e55a08a4277773d6307783a

SHA512
d8497a3f19bbd7393ca733574fd1a4fd109bf42866f887a739ecca14ba52599f1d6fb0c6df99fdb373ddbbd239efdb770008516b64a1a8a4d490bc85e83e9812

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
327KB

MD5
6145c7781457e50db128efbf62a9cbac

SHA1
06b14420d75a3985dac389bbc9ba3b20887c52b7

SHA256
a7bb5202142680f0a7fa3c8ae4f5ff5298993e1c19150d7a3c6c9b458977ce1e

SHA512
f6e2d86abcb181adfd35de82c949db59a8c57480dd60d6209a782e0c027baae81725e23227fa235a59df4b0bf716e7808c91beace3faaaaa5e791646fe71e6fe

Download Submit
C:\Windows\SysWOW64\Cdkifmjq.exe

Filesize
327KB

MD5
f087a6dba4b3c9b3e3bbe04aa0b912d3

SHA1
6b569be59a6401281c8200a78b95bdfcaaeb5f46

SHA256
f15f7569fa0e85cf27a60498ce1d8ea9f91e11fe9de59c627b7ac0ea2f164399

SHA512
5470afb21f8e2d2d88fd8427b708218111a2a3a7aab730bceecf674d6736b1623701ff897d2287cea93398f7729866109b37797b33d45857b903cbdcc8af7239

Download Submit
C:\Windows\SysWOW64\Cdmfllhn.exe

Filesize
327KB

MD5
b4e1408f04caede018d07d9bc94e3bb8

SHA1
0c216f5b54ab60f05593346ce0b70688118b7160

SHA256
9257ae76454c7c67730a873b1c2ce81b598ef383fd66a348937df25ce6b3f15e

SHA512
28d4f69e8e6fd217ba9279d64466e28cf31b0a5fa813e6dfe72e4602b3b1b6bf5ba4e27cb6683714b8b765a638d2853007565cf885d6324018c140fd03ab39ad

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
327KB

MD5
0ce2cbf769a7adc3579dad5d35171d5b

SHA1
952a1983cf558ec4b399b1c3b01f6412363a5786

SHA256
45ca568485f64ac2fc9f3bfd2f8a9b14d03508bf0b4a9f72b354af0bb456e78b

SHA512
a653d8f37bb957da5a96c3d2a56e5a5c8e32caf16ecaea6a566a87458286bec5c51580f37a0c12110b31a6cf744d8d62d5cfd03f9449eb65ab7978dcfde69a4a

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
327KB

MD5
62b0e1e9c119e0d5d3286e5f2b7fb4af

SHA1
0bfa3ac525af8af9c65ddf45bae27cca9da9092b

SHA256
1518c496e4dc135fe5a171aa6fa9ce031cc041ed764fe4401c4390ea2801e546

SHA512
6c08069a32a741a38498ac36308108be3e4f0b3d1a822f524cd0e3612116b521246f4e340ec95e26542d2e660474222f69a1a6b3a78af5941c27efeb9b918992

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
327KB

MD5
dcf7c2db4f3e3155cf3f5062532c8040

SHA1
abd2a1242646b5a2838a762b8949651976648b38

SHA256
fcec4996d1992b17175c31adb14d5cac48f95310159c283467b1934c09cdcd1e

SHA512
7f1bfcaf18708fb48e7724dbb23d0b09d0062121806613332dfa32812643c7bf0d7b5669f487e9006f5a03452bf3768a055cae015c168e05b6819ddc162ad134

Download Submit
C:\Windows\SysWOW64\Dbmdml32.dll

Filesize
7KB

MD5
a52e0bb4169cb9127ee86c22c2db2da6

SHA1
ed96e86d85aea7efb627d309a9372967dee8688c

SHA256
4b4ee2d81e44473a367a4c2a149c3130f49b2855408295599af4b7440c7e78a6

SHA512
6119e70d7f408de01c3f18c90a86237c968711be7f0f79a91e225908e9d2db82f0ed36c366de830ebb9f0599456e57dff2ed355145567c424ff9dab0cc844ca4

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
327KB

MD5
29355928d8650abc0c64d4c802a5203a

SHA1
123d5e38695098bce151905bf6ed83bd7a948a75

SHA256
f40b5fff867bce5d48fabff0e044e6980ee40f8e2d5b3b5d38154bc10733fa55

SHA512
7a476848a5acd06095954fe60b9b9d8ff5a18b2f1a9541274232bf9d9e0dcb8f64fde27a7937acf98b5fd57682f339582e64c6bfa3c99f67ce045dd327f7b7c4

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
327KB

MD5
690a7b5015f9c2f43a9cf53a9c944cfa

SHA1
3f120feff1cb9cc7b9e39976127b2fe0be730a08

SHA256
1fc4f8892a5ade746a409eaff09fb12206699cdc448a24ca0508f7994d46d341

SHA512
362201236bd81fc19219f4ed52bfb931ce495c8508cb9d378246b9d99dfb1828927b1c8230f2831e2b0954697d862a39a9f8481fd5db9150bbacbdf4f44c33e8

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
327KB

MD5
915b06261d1ee0aa5aa04bec9d709520

SHA1
95dd47e82232a0428e30f56ba3df79d8acbd5fd6

SHA256
7f1a77fa1ac10b96dea4621196980db71b8583b25b8f11447c366cc7d2d7158c

SHA512
e90a1488d15220a3131706041a1843cc74fbe2bb099852f0dd528c402fd6ac8f601144f2a1628b9ec25396934ff59d6fc674fd8691c6ca8173f53649b043f106

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
327KB

MD5
871cc062bceded5ac50d45ed69d6a471

SHA1
c12d020d22aebc655482dd7a3d973e340bf0f198

SHA256
2694819c54cba367d80b7bda52915046098a585f0b427997e0547618129a8e2f

SHA512
d4acc79da3e310c69b49742ebb3209cb589f21ad88a67ea3e93c53d169c3182a8eb94916313b69a69b8665e4bdfcfdbd2584d37c81993ebe12c8e58b1d8af2ad

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
327KB

MD5
faf0942b49bb924e5677261914457e6e

SHA1
c794c4bc56a4fa1653ff82f16404e6595170c4fd

SHA256
3fd193b5a9942bf1cf0c915c44f09bdf21988796ca07b13046141901332f1d2b

SHA512
680efd2afb3abadf309189549a9406a3c659b41c68e69669a1774c6df4c562a3654d0dd0d21af121a24d28044bc8585d2c92fc771d5ce3770d6f2cbc24e699d2

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
327KB

MD5
ee6f9c270bb09c65a93ec944cc561b05

SHA1
83104923956644d1c3b35986eac9b93bf6ffec30

SHA256
2e957de564d007bebb9b62035474ba365d287cdb65be35e4c0bcfe0c72060b05

SHA512
e97e92306fb77653fa0a3eec07f2f2600f60c8b9166242946705ca7e4b9310d4e9711419f9088e3c5d0b01e67a5568a2d3d79d0815c679a7d043519ded41b7fb

Download Submit
memory/244-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/244-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/672-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/672-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/696-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/696-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/760-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/760-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/856-398-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/856-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1232-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1248-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1276-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1276-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1296-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1296-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1868-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1868-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1928-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2204-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2956-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3152-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3152-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3360-343-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3360-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3472-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3472-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3788-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3788-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-360-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3988-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4008-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4008-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4020-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4188-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4188-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4212-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4676-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4676-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4696-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-410-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5052-378-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5052-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads