4394e1c8384d587a8eb498eeaf5638944e572e0613d9ca3ef17fe37412ba5d7e

Analysis

max time kernel
102s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9725c2c23123f7e078756c4cf570b90N.exe
Size

96KB
MD5

d9725c2c23123f7e078756c4cf570b90
SHA1

47ecd753321ec1892515bd0dba2018dddde212d3
SHA256

4394e1c8384d587a8eb498eeaf5638944e572e0613d9ca3ef17fe37412ba5d7e
SHA512

2f0aa9089273f34f47271991a68efb9ac4ceb5f7cb90d3c3aaa72ec20e5802a626c371b3cecc734d02dbb760610c7ef7719c9a2bc2bfe044a5f4c12a827d4365
SSDEEP

1536:Y+tr+XXrLr53iHm1UUcmkoy3qN2LisBMu/HCmiDcg3MZRP3cEW3AE:Y+87n53ivlLoy3qeia6miEo

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	d9725c2c23123f7e078756c4cf570b90N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjclpcf.exe

Executes dropped EXE 64 IoCs

pid	Process
880	Qnjnnj32.exe
3248	Qqijje32.exe
1156	Qgcbgo32.exe
640	Ajanck32.exe
628	Anmjcieo.exe
3356	Aqkgpedc.exe
1940	Acjclpcf.exe
228	Ageolo32.exe
5108	Anogiicl.exe
4440	Aqncedbp.exe
2028	Aclpap32.exe
3816	Afjlnk32.exe
4596	Anadoi32.exe
3940	Aqppkd32.exe
848	Agjhgngj.exe
1408	Ajhddjfn.exe
4752	Amgapeea.exe
3860	Aeniabfd.exe
1512	Aglemn32.exe
3228	Anfmjhmd.exe
3148	Aadifclh.exe
1116	Agoabn32.exe
4540	Bjmnoi32.exe
4184	Bagflcje.exe
3676	Bebblb32.exe
1440	Bganhm32.exe
4356	Bjokdipf.exe
4852	Bmngqdpj.exe
2524	Beeoaapl.exe
2648	Bgcknmop.exe
3340	Bjagjhnc.exe
4764	Balpgb32.exe
1280	Bcjlcn32.exe
1984	Bfhhoi32.exe
5020	Bmbplc32.exe
2540	Beihma32.exe
4720	Bclhhnca.exe
4060	Bfkedibe.exe
4908	Bjfaeh32.exe
116	Bapiabak.exe
400	Belebq32.exe
2964	Chjaol32.exe
760	Cfmajipb.exe
4624	Cndikf32.exe
2676	Cabfga32.exe
2136	Cdabcm32.exe
1352	Cfpnph32.exe
2520	Cjkjpgfi.exe
2396	Cmiflbel.exe
2516	Cdcoim32.exe
3576	Cfbkeh32.exe
2636	Cnicfe32.exe
3256	Cagobalc.exe
2196	Ceckcp32.exe
728	Cfdhkhjj.exe
2032	Cjpckf32.exe
1924	Cmnpgb32.exe
5104	Cajlhqjp.exe
4496	Cdhhdlid.exe
3684	Cffdpghg.exe
8	Cmqmma32.exe
1120	Calhnpgn.exe
540	Ddjejl32.exe
716	Dfiafg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Jpcnha32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Anadoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	d9725c2c23123f7e078756c4cf570b90N.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Ehfnmfki.dll	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5248	5156	WerFault.exe	167

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9725c2c23123f7e078756c4cf570b90N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d9725c2c23123f7e078756c4cf570b90N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ageolo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 880	3460	d9725c2c23123f7e078756c4cf570b90N.exe	84
PID 3460 wrote to memory of 880	3460	d9725c2c23123f7e078756c4cf570b90N.exe	84
PID 3460 wrote to memory of 880	3460	d9725c2c23123f7e078756c4cf570b90N.exe	84
PID 880 wrote to memory of 3248	880	Qnjnnj32.exe	85
PID 880 wrote to memory of 3248	880	Qnjnnj32.exe	85
PID 880 wrote to memory of 3248	880	Qnjnnj32.exe	85
PID 3248 wrote to memory of 1156	3248	Qqijje32.exe	86
PID 3248 wrote to memory of 1156	3248	Qqijje32.exe	86
PID 3248 wrote to memory of 1156	3248	Qqijje32.exe	86
PID 1156 wrote to memory of 640	1156	Qgcbgo32.exe	87
PID 1156 wrote to memory of 640	1156	Qgcbgo32.exe	87
PID 1156 wrote to memory of 640	1156	Qgcbgo32.exe	87
PID 640 wrote to memory of 628	640	Ajanck32.exe	88
PID 640 wrote to memory of 628	640	Ajanck32.exe	88
PID 640 wrote to memory of 628	640	Ajanck32.exe	88
PID 628 wrote to memory of 3356	628	Anmjcieo.exe	89
PID 628 wrote to memory of 3356	628	Anmjcieo.exe	89
PID 628 wrote to memory of 3356	628	Anmjcieo.exe	89
PID 3356 wrote to memory of 1940	3356	Aqkgpedc.exe	90
PID 3356 wrote to memory of 1940	3356	Aqkgpedc.exe	90
PID 3356 wrote to memory of 1940	3356	Aqkgpedc.exe	90
PID 1940 wrote to memory of 228	1940	Acjclpcf.exe	91
PID 1940 wrote to memory of 228	1940	Acjclpcf.exe	91
PID 1940 wrote to memory of 228	1940	Acjclpcf.exe	91
PID 228 wrote to memory of 5108	228	Ageolo32.exe	92
PID 228 wrote to memory of 5108	228	Ageolo32.exe	92
PID 228 wrote to memory of 5108	228	Ageolo32.exe	92
PID 5108 wrote to memory of 4440	5108	Anogiicl.exe	93
PID 5108 wrote to memory of 4440	5108	Anogiicl.exe	93
PID 5108 wrote to memory of 4440	5108	Anogiicl.exe	93
PID 4440 wrote to memory of 2028	4440	Aqncedbp.exe	95
PID 4440 wrote to memory of 2028	4440	Aqncedbp.exe	95
PID 4440 wrote to memory of 2028	4440	Aqncedbp.exe	95
PID 2028 wrote to memory of 3816	2028	Aclpap32.exe	96
PID 2028 wrote to memory of 3816	2028	Aclpap32.exe	96
PID 2028 wrote to memory of 3816	2028	Aclpap32.exe	96
PID 3816 wrote to memory of 4596	3816	Afjlnk32.exe	97
PID 3816 wrote to memory of 4596	3816	Afjlnk32.exe	97
PID 3816 wrote to memory of 4596	3816	Afjlnk32.exe	97
PID 4596 wrote to memory of 3940	4596	Anadoi32.exe	98
PID 4596 wrote to memory of 3940	4596	Anadoi32.exe	98
PID 4596 wrote to memory of 3940	4596	Anadoi32.exe	98
PID 3940 wrote to memory of 848	3940	Aqppkd32.exe	99
PID 3940 wrote to memory of 848	3940	Aqppkd32.exe	99
PID 3940 wrote to memory of 848	3940	Aqppkd32.exe	99
PID 848 wrote to memory of 1408	848	Agjhgngj.exe	100
PID 848 wrote to memory of 1408	848	Agjhgngj.exe	100
PID 848 wrote to memory of 1408	848	Agjhgngj.exe	100
PID 1408 wrote to memory of 4752	1408	Ajhddjfn.exe	101
PID 1408 wrote to memory of 4752	1408	Ajhddjfn.exe	101
PID 1408 wrote to memory of 4752	1408	Ajhddjfn.exe	101
PID 4752 wrote to memory of 3860	4752	Amgapeea.exe	103
PID 4752 wrote to memory of 3860	4752	Amgapeea.exe	103
PID 4752 wrote to memory of 3860	4752	Amgapeea.exe	103
PID 3860 wrote to memory of 1512	3860	Aeniabfd.exe	104
PID 3860 wrote to memory of 1512	3860	Aeniabfd.exe	104
PID 3860 wrote to memory of 1512	3860	Aeniabfd.exe	104
PID 1512 wrote to memory of 3228	1512	Aglemn32.exe	105
PID 1512 wrote to memory of 3228	1512	Aglemn32.exe	105
PID 1512 wrote to memory of 3228	1512	Aglemn32.exe	105
PID 3228 wrote to memory of 3148	3228	Anfmjhmd.exe	107
PID 3228 wrote to memory of 3148	3228	Anfmjhmd.exe	107
PID 3228 wrote to memory of 3148	3228	Anfmjhmd.exe	107
PID 3148 wrote to memory of 1116	3148	Aadifclh.exe	108

C:\Users\Admin\AppData\Local\Temp\d9725c2c23123f7e078756c4cf570b90N.exe
"C:\Users\Admin\AppData\Local\Temp\d9725c2c23123f7e078756c4cf570b90N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\Qnjnnj32.exe
  C:\Windows\system32\Qnjnnj32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\Qqijje32.exe
    C:\Windows\system32\Qqijje32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\SysWOW64\Qgcbgo32.exe
      C:\Windows\system32\Qgcbgo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
      - C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1408
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4764
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1280
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4720
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:116
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:400
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2636
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3256
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:728
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1120
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2348
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:684
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3836
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        77⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2188
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        82⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 404
        83⤵
        Program crash
        
        PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5156 -ip 5156
1⤵
PID:5220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
96KB

MD5
496452183c538897b03779c042c0ea00

SHA1
c08b239277c1d7c2a09bcceb1f0d1622723343aa

SHA256
f909dbf50620854009635f9fced17065a2b58a7d947a2ac64f89c3e8d029852d

SHA512
a01ec1815ce3f9ebf91dec42308863c0686650e5006abc6159cb775cc1497016b3a5238c2eaa3db4aa22ff42bdb89b77e6550d0a54def620522e71eb478fc747

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
96KB

MD5
79010b224d246a77eb9a04fb847690a3

SHA1
0534873f0961915cae459ed594eed25b03680f62

SHA256
ab38ee60a2ceb3fbc521ef267310ada13cdf68dad5e30c900bc5781735f4145b

SHA512
b05991f01ec36974d74a3bb23e7cb87ba9af17064ef9744c74759ce218f878afe7b37212ea388272a2cc361fc88ed1fc98867a24baa134a37913bd83ceb6c16a

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
96KB

MD5
687d35c64c6d1dcb9fbccc66484a648c

SHA1
dc5e3e2c58b5b02221c5f5d39003094b16c0f92b

SHA256
27162e8ba5d89c3eabf95bdacc1208fe0e7b8931568dc0e339a5a7feae500e1f

SHA512
67eae94f02cc0164ce947d9ee38a8dbcf92b6c7eb80a7246345441d44e1d7abba91a46bf6cc9fac69fc697b37ea4fe4a4f179f8ca2482679c1fada99a471eb17

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
96KB

MD5
02be3aa51698e814d4e9b7e66fcbf65c

SHA1
fab93833b7fb5367bb8053e7041880b5cc89159d

SHA256
f7f4edaf3cc191eb584a37c3d4ca2bedd6febbd9f670bce34f34e0836698d4e8

SHA512
016a658ee5ab70efd28e79f3e55054ca6ab76fbd3244fdf1a0c4865a73f03e758c2deba96d3be2486943af752dd3f2e57dc5a93b9dd618cdd4c2427b428aea75

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
96KB

MD5
0337eed2f55ce75cf8015729aeb91542

SHA1
e0cf3a4e0103881fdb4267e0ae989dc432e3c308

SHA256
5bbab9e087d712efb11c31a01037c52a48379a4b4200e7808458f3115d247b68

SHA512
b5147789176d27efd48d43718853aa80bf13401ab576f79d8f4d577c68446b3c9f66255aa106b4937b547047af07ef0233c0afdecead1745a6918c7aaca8e4df

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
96KB

MD5
d46b50030da24b958fd98b7af2d8f695

SHA1
d0ce91940e140b76259d2a3616ea46a83bf2aca8

SHA256
791f9ed40c0d7f5f9e9699ef3a14a48216123fbf45836faccce1846f21166d6e

SHA512
50fd65e08e406594ebd703ddc40e608ff37c61ac44fb9889c5492a741c2f69c87f78d085d29df238a59563d57ba1a785508eb744f3e86462796d92009a89c9c9

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
96KB

MD5
13b05584733c9039a141adf12c9812f8

SHA1
a97bb9a16e476834c8c4369764d1c7d3193fb30e

SHA256
46d5fe1346fc90ab5db915b88be76873491139288c82ea9c885bfffdee3d3770

SHA512
b556c37d29f75f8b715b333de4ca922ea54773a35b10fe1306f5646c8d8a3b98f08ddcd784f9a91d1ba4a576bc2f5f399381a8d5755fd259326e807a83ca0236

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
96KB

MD5
529224ef52f6aef66a1f4a378b4a82dc

SHA1
605509d1cfa6ccaa07a2fa3d57acd0b3947dc22f

SHA256
ba0e3a3735d41a4bdd9a40e6e2038168305655eb7c80f5eaac747df4bc7228f3

SHA512
ed6df734216b4a40835811ea13d8573a676ff4ed8205540b02d43ae4094aaf87021eea5e0a1bb9391eda8213d2e4be1afb5f52be1fa7d005797e450cf38704eb

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
96KB

MD5
f8b1d6a99f37289e50435b2663adb2d9

SHA1
128df3edc9654c2c68f41e93d44e76be3f259cc8

SHA256
38f1bb3f5b7ebb3201f63f44fd2063cc30c9619400fe66eebce654c2a51de2df

SHA512
de89cb5c1f794fe1e0fde516e15b43ae49236feda32237c3d66c3fc7b96f2f0d8081e35c81554caae54cfd5e2490eeda2ac19167547b98b23a99d9eeb716a196

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
96KB

MD5
468edd5dc0a0ebdc5ae7c105e3c69289

SHA1
2934280806121c8a6d01a72dc4d6d0cb49ab9d3e

SHA256
510e67960aea9b9ed3908e5f937be6210ececb6b75db1f586e00b2a2b24bfc8d

SHA512
8e8689c82cad39b69b357471179d83aed14744abe85e625054aa3f3ec5138b2902e28c6d2c7174f5dc65d4c87bd10361e87b6aabc48155f47f61b9a96976bdd9

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
96KB

MD5
69fa58713b4854b8d4870de4024ecd62

SHA1
47eef82b211a05db28e4eba127eab3016f0be2d4

SHA256
47361bef978aff33a89871580be932db8feb24c71dccfe5a475bf6602da1d308

SHA512
76dfe2f4c99104b05e5827270a191662d7221c161bfa302981ae0577810d8ccfaada338f583688624d2f1c7b6a093a233e95594707dc9b4fb99c4948db3cc9c1

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
96KB

MD5
9a593245f1550480d6e9be667fdf4372

SHA1
e4919339c3d253e9902b149833a43c7048ab81e5

SHA256
1b329c75e77cb7fb9a4fbacf9b6f51561b251b5d93cafb6c6fd9b8cefc9326f4

SHA512
baf4641bc29d25ce91b2a920ba994b56991e26f3779582597495b4a3ab1d9c4e9c16f65d5cd698dbf275d055651abf1fea320bc86f96bfd2003d98d003d555dd

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
96KB

MD5
698db679bcdae4e85f67e52b50e485b5

SHA1
7ae096e92d2dfa2a90a1fed2bcd288f817ff0c7e

SHA256
78fa72d75852016f7710bdfc1fbcb59af34013d69e919912ca89fd56737febaa

SHA512
1224ec3c6f16e536f44961a9ce214a81ed61bbddec7cfcc30cc9afdfc434d28f7075ea0622e5853eca862cd61ed561ce0c67f8fe2d2f13022d2e71c1c229ebb9

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
96KB

MD5
b8c82cbfa6431c44727e26b65b43b95b

SHA1
0afa61c82ba424c39afb84b2925d1adfd5be3caf

SHA256
80a6c01f240739dc6223b6fb326f2f73687ccf33174b1c6c9bc9a8c5e6177b65

SHA512
892fad3caf1b70dcd2f26a78b1eb4404ad7786aedde5300c8d0979edd59693897d6f70ea9715ae1f512d574e96ffbdf4862ab346adc1d320e9bc39af7d878a91

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
96KB

MD5
78254ef1b95d5c558972ecaf7980bbb3

SHA1
3ecd212f289fe5f07fed9a7ed4f41c05ff3db468

SHA256
8a0508882bc7159b8294f56fc03b6f2d393c688ff7fbd34b233261c1c56a91cd

SHA512
d776a1aa58df31fc84e1d50fe728b577c7adaae3970400676d38e436a01aebd86da5bb11eda9a1a673294d099969631b0552e54711db347563bb430ac27fb8be

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
96KB

MD5
046add2e2d16a1521c48b602f136974b

SHA1
2daf78051ef801ecded32cc94e22baabf2f153ab

SHA256
0ebe06872f4deba13c1773ed9b7e768fe1238399fd161d26cd8260dee3ac3e60

SHA512
0b427168001d2b0b9543925822befc88988c801e71a70feba2bfd13ae5962820a916bc403db097eb56d4358da43d7e6969eee4d664dca3eab1b81416996632af

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
96KB

MD5
8a094b4a8794743719bb6413a9b97c6b

SHA1
2b41ada91f4917e973f08e1c32135f8400aea7ba

SHA256
c609aca3dae6d17111a87109be88a25bfce08b9f9d80c581c5d10a66b5c5ef3a

SHA512
e7e852ec81466a203a7d1dd94317fedddd4c199f60dd327606b5a0c1b98f64a3458374d1d03e2097ab7f5002b6902dc2f8453f253e1f115e9907a8ce8573d92f

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
96KB

MD5
84e9c4730807b157aa0937a4155ed507

SHA1
9228268e853bc1e965aad0abed88e40faae1d067

SHA256
f1a555977a3c942eaa13ee489aec8fceaa6883bfe62a545275c7c5112c751de9

SHA512
473dfdf835ff356e50d414902951d24563c271d8d4bb0428f6f64dbf907454347f964bba881388c5bd3ff2bf9b8bf37960821791bb77d6f4b398a4dc66382fc7

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
96KB

MD5
474aa8fddbb0bd57f42723e07ed0b62f

SHA1
2ccb9adc94546febf206176ea053214b452e35aa

SHA256
2db6640425c614ff7a12d7fa7a419ca050f324d9c523fc5517312ccd1e039014

SHA512
af2edae00528a47998ba5eeb66a1e51452150c7614ec4383e46ca30a0ea16b9f28153739fc762889e85b9096961e87b892aa353d62b8420fbef307da52341368

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
96KB

MD5
203aa7192de0226e1bc48ee478b1709d

SHA1
24d5b87b9b0a4ae453a6337ebb1bdf9cdb4b4012

SHA256
61bff327b9f3eb5fca1276e17d31f7315797a8e5a05ac7daa5666bdcca16352d

SHA512
5feea41c918473418e7073d78b608d4fae0e931c4e953c69321d455be5cd28d331a7a59681bcd9f9e3514f2b5913555bb4ce35bd354436eac8f9f4d07a643977

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
96KB

MD5
9dfc7282f23c7dbfdb42b8ce399c17eb

SHA1
182992e9549b9a3c90c6a26c6c4fd9d122f686ac

SHA256
e6736870afd066dde97e02ddbb7a8d526efd1f7a758907b24952f0da47aff909

SHA512
f833b6ce446809524e4d5e9a3818e5abe4a1b38de2d0cf31cb6f32bb8625f2dd8f078a9294858221d0d9cba5da7aede582d05f55d0dff7d1095c108b8206e2a5

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
96KB

MD5
b0a36327b1448217c110b99098d8ee68

SHA1
a41ec6569f239a40cd1d9326184a242d0e2702d0

SHA256
cfaafe4fb28df2136119ca2c7db07c0dfd827ef0b1223dc9044f6aab2b697852

SHA512
d4cd32c3a424c618055852f2f375440b1d48c6813dde9c3f28a66d502560f8290c7ca50a7b6884623f881cd2fcc36a040eb85ce39ddd591dab77f8bdbe5c1a34

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
96KB

MD5
a1b0162112816b70db7fbf6c3a3e4305

SHA1
ca89507cdd412e726ccd4dea50a1fa329d4674ea

SHA256
0a877e8af7e92ef0b911ba915a8442351c5cdce2acc9c11d97e579f557c2badb

SHA512
476179c6936fa6a4d63d09853edf60a6a44473b25ea32b19c2cedbbf441289a212a7a14b11395b17bd9e12d83e1c3a7546cf11556d9073f17454f7bdf1b7bfc4

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
96KB

MD5
48df7f5f3b0302c9671dfd8eef3ab081

SHA1
176cfef77f4176013dfadfc50ce4a65f17469afd

SHA256
195ec5ea12aac1ff4feb4c35b5269ded96603e273b12b8fccb2266066ec72d6f

SHA512
8d6e89420203ae321b5431e8a200ee9031baf9669422fc30b2e0dd196ea11e74804ed95d0b874a716f174b6da1543e69e2b4f3c0f95042fe8e3ac0edf7621316

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
96KB

MD5
fb1968ecb570117daea9ea48d61280f6

SHA1
3e6324a57231c9ee8b2d3e6cb154bd509ec367ae

SHA256
9ab4ea47f7069e931c1fdf375e235a330f5cf4ef082a1b4cf634b8ca198bd42e

SHA512
08d29fd850a62f6e317bb2277aafa4db623a0d7f720beb8803d56ef3cd0865ab2a068ed154e09f6dd3bd01dd566b0635285c17f9d25a4391b3ef85bdf56d817e

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
96KB

MD5
10100af3a012121801e38086f4336015

SHA1
83631caeea932390a02ec36e6df677ca7b9fad61

SHA256
10b19b6c69c182700eb7a929b905369c02b194064bab4438e020299c7da7a0b2

SHA512
266c3fa28e9d4eb0cfe61f11e2234d0ab80342247534623dc7b069459da94865ce563b66f531a8aba72d74ffac758b021644d89d6e15e3db4a571dd61baed7bd

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
96KB

MD5
16c1403a1f41346013288d3b8fd932a4

SHA1
006067d078c0d6a410c6666506e77ca86758e188

SHA256
fbc59b7c5b665c66158b5a54e6aa06dafa1389d67664271e534e4dd30c34ab05

SHA512
e904c5e162a1686a77850f2a15427a87ed1429030cd84f316ff1f637a43d244d218304e8b3514562c8465edf206b81672da00fc36f42ef7a1f5f63da61b3c7ec

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
96KB

MD5
c2b6f421567334c08ab82830f90a956b

SHA1
1c2aee9d3335be756da20a61f6f22fde2393558b

SHA256
262f4ba170119d6421ac0a23e947f17fef1dc95674e1781522df0753ec24ce78

SHA512
1bacb31a1f58fc0836050a57dd1f367bde9139e40a86a1fccf7b9585d413a0676f81f989300a33324e64e938290351d373f6b608545292fe1c69a4be3f372a74

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
96KB

MD5
48f113301f1e4e7fa22e6395679213c2

SHA1
235bd4f7be61787e3168f14e48106d29f2842ce3

SHA256
152ae27f475d707bc6f444dc352f7bef4b4d28dae90120aaf1d11fd040879c34

SHA512
f7326d36cace4c28fb906131a297421172a043858cbf92d1a034ad7f09ba3d6775c6927ca001d7bf22b244d51150d9fbf2deacd5333121de4613704b1b09d05a

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
96KB

MD5
2e27d35ae926300a781e9e72474c1ad1

SHA1
c3b12e6ecd41e3c16d0e8379d0e6df0a457c740a

SHA256
04fc4662397f8e2004590bec1df909dbbbc72b733f1893f6e751d87f27852dc8

SHA512
08da63f544d111b1bf40192e4e6c7c6b35197e4e0fc83b20719a87e5ea080748375c367362c70806be44ff517478b4d148226e7c74e2e60c6cef8191bc15c5fe

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
96KB

MD5
8fdce46916504c1b855f11b0a8db6de0

SHA1
f4352759cd236d21563d6b92e4103790559c3ee0

SHA256
fd074262371912fd09548f1b566c783fa361a1496af86a6756392abb72764dfd

SHA512
bc300bd3a1753e49504b52bf7dc760b3ba65fcc6c5bf2b4832814eedce549186181efbd766ed20fc0f410cd4c33edceef37dfdbe7f509fb8094b7cce97ae486b

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
96KB

MD5
cf0af4b2ffcbca4c401f1c0ddf6edd3a

SHA1
27770969da258cc6e7be3072699eb83bba6a5317

SHA256
514d89f224548410d7ae6fd41374de3f16ceba6a49a20f387bee753f8a04f784

SHA512
b4b95fb02f47adb7c8c2c2a247a5582913459a9df37f5697f02be78d460c09d4127e3249bb057c3c7ef410623c2c3b3c87a2f8751d85cf1ae5c9ed203b194ded

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
96KB

MD5
761b5786c1ae96898cad02409a71569b

SHA1
eb57c6c6eabafcae0386303bf639c5bf859518d4

SHA256
fcd7f83e1aed8e27c998ccf6887ad3a0878d7f2f95c535a08cb65627f7d41403

SHA512
056ccd36e168ebd117e0658eeb1b7e330ca9be468ccaeb23394b388618fa8182f03f12e72ad5f97ef0ebea7ffbe21f4cf6c73445ba1e0e53ff502c6981ef8972

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
96KB

MD5
fff22d108375283d76df42678aa14b8f

SHA1
704bfe4d2d9be413fc598993f8303e5f158d5589

SHA256
ed3b80165d506b13cc52f78379ca9845907b063c8f9e295369073401619313af

SHA512
23e983f2d72e8d78d59528704e533998d09fb884c73bb82dc6c4b8a0259ee92cfba822f1231bfe1931ed20c867464abc3936f7b6ee68d4eddb51838ac06683d6

Download Submit
memory/8-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/116-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/220-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/228-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/400-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/540-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/628-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/640-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/684-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/684-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/716-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/936-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1116-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1120-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1280-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1408-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1440-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1512-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1704-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1924-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1984-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2032-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2136-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-565-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2348-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2396-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2516-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2520-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2540-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2648-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2964-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3148-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3256-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3340-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3356-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3472-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3472-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3576-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3676-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3684-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3816-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3836-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3836-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4184-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-563-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4608-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4720-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4752-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4764-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4908-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5020-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5048-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5048-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5156-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads