812896e9225f37f8d4c54eff99403ab45145f49529f36016b4946085e66cf6d4

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4dd04d89eaa5cf06003787dedabe640N.exe
Size

160KB
MD5

d4dd04d89eaa5cf06003787dedabe640
SHA1

c57c7af069454dcefcee407fd7b65cfc8ee37aa1
SHA256

812896e9225f37f8d4c54eff99403ab45145f49529f36016b4946085e66cf6d4
SHA512

d7ad707d4358eff19f045de23713c701d2c182f6ebf053a046ada249ac0c1cbc0c0a79520bd35fc205d1bf9b801fa63b6dcc1399ef0d7b7d033e1300c89c38c8
SSDEEP

3072:HgLIOqhk2iINPiarlOGA8d2E2fAYjmjRrz3h:dOAkKBiRXE2fAEGh

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe

Executes dropped EXE 64 IoCs

pid	Process
2140	Qjoankoi.exe
1132	Qqijje32.exe
432	Qgcbgo32.exe
4468	Anmjcieo.exe
3588	Aqkgpedc.exe
1576	Ageolo32.exe
4084	Ajckij32.exe
3952	Aqncedbp.exe
4776	Aeiofcji.exe
4132	Agglboim.exe
548	Afjlnk32.exe
2612	Amddjegd.exe
2332	Acnlgp32.exe
4504	Ajhddjfn.exe
2112	Amgapeea.exe
1236	Aglemn32.exe
2228	Afoeiklb.exe
3476	Aminee32.exe
4352	Accfbokl.exe
696	Bjmnoi32.exe
1956	Bagflcje.exe
2744	Bcebhoii.exe
1928	Bjokdipf.exe
1080	Beeoaapl.exe
4192	Bffkij32.exe
3524	Bmpcfdmg.exe
4432	Beglgani.exe
1004	Bcjlcn32.exe
4828	Bfhhoi32.exe
4788	Bmbplc32.exe
2316	Beihma32.exe
2860	Bhhdil32.exe
3916	Bjfaeh32.exe
4088	Bmemac32.exe
1992	Belebq32.exe
2200	Chjaol32.exe
2524	Cjinkg32.exe
4756	Cmgjgcgo.exe
3668	Cdabcm32.exe
4884	Cfpnph32.exe
3844	Cnffqf32.exe
336	Caebma32.exe
4612	Ceqnmpfo.exe
4100	Cfbkeh32.exe
964	Cjmgfgdf.exe
4324	Cmlcbbcj.exe
4520	Cdfkolkf.exe
3516	Chagok32.exe
3956	Cjpckf32.exe
3308	Cmnpgb32.exe
1804	Ceehho32.exe
3000	Chcddk32.exe
1492	Cjbpaf32.exe
1028	Cnnlaehj.exe
1116	Calhnpgn.exe
3856	Ddjejl32.exe
2180	Dfiafg32.exe
1684	Dopigd32.exe
2352	Dmcibama.exe
4496	Dejacond.exe
4848	Ddmaok32.exe
232	Dfknkg32.exe
4020	Djgjlelk.exe
3204	Daqbip32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Beeoaapl.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Caebma32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Afoeiklb.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bmemac32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Agglboim.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Cdfkolkf.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Aqncedbp.exe	Ajckij32.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Belebq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1284	5072	WerFault.exe	161

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4dd04d89eaa5cf06003787dedabe640N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d4dd04d89eaa5cf06003787dedabe640N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	d4dd04d89eaa5cf06003787dedabe640N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chempj32.dll"	d4dd04d89eaa5cf06003787dedabe640N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	d4dd04d89eaa5cf06003787dedabe640N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d4dd04d89eaa5cf06003787dedabe640N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cdfkolkf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2140	3760	d4dd04d89eaa5cf06003787dedabe640N.exe	84
PID 3760 wrote to memory of 2140	3760	d4dd04d89eaa5cf06003787dedabe640N.exe	84
PID 3760 wrote to memory of 2140	3760	d4dd04d89eaa5cf06003787dedabe640N.exe	84
PID 2140 wrote to memory of 1132	2140	Qjoankoi.exe	85
PID 2140 wrote to memory of 1132	2140	Qjoankoi.exe	85
PID 2140 wrote to memory of 1132	2140	Qjoankoi.exe	85
PID 1132 wrote to memory of 432	1132	Qqijje32.exe	86
PID 1132 wrote to memory of 432	1132	Qqijje32.exe	86
PID 1132 wrote to memory of 432	1132	Qqijje32.exe	86
PID 432 wrote to memory of 4468	432	Qgcbgo32.exe	87
PID 432 wrote to memory of 4468	432	Qgcbgo32.exe	87
PID 432 wrote to memory of 4468	432	Qgcbgo32.exe	87
PID 4468 wrote to memory of 3588	4468	Anmjcieo.exe	88
PID 4468 wrote to memory of 3588	4468	Anmjcieo.exe	88
PID 4468 wrote to memory of 3588	4468	Anmjcieo.exe	88
PID 3588 wrote to memory of 1576	3588	Aqkgpedc.exe	89
PID 3588 wrote to memory of 1576	3588	Aqkgpedc.exe	89
PID 3588 wrote to memory of 1576	3588	Aqkgpedc.exe	89
PID 1576 wrote to memory of 4084	1576	Ageolo32.exe	90
PID 1576 wrote to memory of 4084	1576	Ageolo32.exe	90
PID 1576 wrote to memory of 4084	1576	Ageolo32.exe	90
PID 4084 wrote to memory of 3952	4084	Ajckij32.exe	91
PID 4084 wrote to memory of 3952	4084	Ajckij32.exe	91
PID 4084 wrote to memory of 3952	4084	Ajckij32.exe	91
PID 3952 wrote to memory of 4776	3952	Aqncedbp.exe	92
PID 3952 wrote to memory of 4776	3952	Aqncedbp.exe	92
PID 3952 wrote to memory of 4776	3952	Aqncedbp.exe	92
PID 4776 wrote to memory of 4132	4776	Aeiofcji.exe	93
PID 4776 wrote to memory of 4132	4776	Aeiofcji.exe	93
PID 4776 wrote to memory of 4132	4776	Aeiofcji.exe	93
PID 4132 wrote to memory of 548	4132	Agglboim.exe	94
PID 4132 wrote to memory of 548	4132	Agglboim.exe	94
PID 4132 wrote to memory of 548	4132	Agglboim.exe	94
PID 548 wrote to memory of 2612	548	Afjlnk32.exe	95
PID 548 wrote to memory of 2612	548	Afjlnk32.exe	95
PID 548 wrote to memory of 2612	548	Afjlnk32.exe	95
PID 2612 wrote to memory of 2332	2612	Amddjegd.exe	97
PID 2612 wrote to memory of 2332	2612	Amddjegd.exe	97
PID 2612 wrote to memory of 2332	2612	Amddjegd.exe	97
PID 2332 wrote to memory of 4504	2332	Acnlgp32.exe	98
PID 2332 wrote to memory of 4504	2332	Acnlgp32.exe	98
PID 2332 wrote to memory of 4504	2332	Acnlgp32.exe	98
PID 4504 wrote to memory of 2112	4504	Ajhddjfn.exe	99
PID 4504 wrote to memory of 2112	4504	Ajhddjfn.exe	99
PID 4504 wrote to memory of 2112	4504	Ajhddjfn.exe	99
PID 2112 wrote to memory of 1236	2112	Amgapeea.exe	101
PID 2112 wrote to memory of 1236	2112	Amgapeea.exe	101
PID 2112 wrote to memory of 1236	2112	Amgapeea.exe	101
PID 1236 wrote to memory of 2228	1236	Aglemn32.exe	102
PID 1236 wrote to memory of 2228	1236	Aglemn32.exe	102
PID 1236 wrote to memory of 2228	1236	Aglemn32.exe	102
PID 2228 wrote to memory of 3476	2228	Afoeiklb.exe	103
PID 2228 wrote to memory of 3476	2228	Afoeiklb.exe	103
PID 2228 wrote to memory of 3476	2228	Afoeiklb.exe	103
PID 3476 wrote to memory of 4352	3476	Aminee32.exe	105
PID 3476 wrote to memory of 4352	3476	Aminee32.exe	105
PID 3476 wrote to memory of 4352	3476	Aminee32.exe	105
PID 4352 wrote to memory of 696	4352	Accfbokl.exe	106
PID 4352 wrote to memory of 696	4352	Accfbokl.exe	106
PID 4352 wrote to memory of 696	4352	Accfbokl.exe	106
PID 696 wrote to memory of 1956	696	Bjmnoi32.exe	107
PID 696 wrote to memory of 1956	696	Bjmnoi32.exe	107
PID 696 wrote to memory of 1956	696	Bjmnoi32.exe	107
PID 1956 wrote to memory of 2744	1956	Bagflcje.exe	108

C:\Users\Admin\AppData\Local\Temp\d4dd04d89eaa5cf06003787dedabe640N.exe
"C:\Users\Admin\AppData\Local\Temp\d4dd04d89eaa5cf06003787dedabe640N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\Qjoankoi.exe
  C:\Windows\system32\Qjoankoi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\Qqijje32.exe
    C:\Windows\system32\Qqijje32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\Qgcbgo32.exe
      C:\Windows\system32\Qgcbgo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
      - C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2744
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1928
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3524
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1004
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3916
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4088
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4756
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3844
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:336
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4612
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4520
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1028
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1116
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2180
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2352
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4704
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2220
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4988
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4860
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        75⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 220
        77⤵
        Program crash
        
        PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5072 -ip 5072
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
160KB

MD5
8b5b65be8a94f56946e34a64e82f5aac

SHA1
9d1dbbccd0cdcf85bd42c86e827b037396d8001e

SHA256
914b82744c35216596654d41dec92fd2aa3ea01f20d5b6f3b8faf07497424894

SHA512
e6ca65b41d323d8f340fce5a90598b26d0d2dd13c988058e0cd30241a304b4a63d464133b4e4d91864a3bce3b368e673389456fc6e7740f2ade38170f2fb247f

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
160KB

MD5
63884e4ee943b961f8411dca9a9a1ea6

SHA1
f6d8f1fd8190be94b61a8d97c2d5999312c7ff25

SHA256
1dd5ccb1f04c7a49234fcf0d0ed2ede19f02c095d5c89c6942c955a27a192e20

SHA512
6d251f84aa9994543c38827f0a9dc529052bebbca843f19fafc9f2c3c74ef3bf08425b66f15c7be2678b62afe9333da9e07eb5cba4366fd323f570de62047499

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
160KB

MD5
7524c58f81261041f8a6089f66e768c8

SHA1
1d846a3c19d4411bca9be95b2e54f881761ca0c9

SHA256
b67f0b100bf214dc78cc522319a55d9b69feaf326ba3031b7cd798ce75b562d0

SHA512
c8c73adbd5180f72ca4b999d328baccb34fc5fd896a915d4a23d83247e1773800bf7d45266796b66362a60bf10ed127ab0c052d98461b66a7dba3167c0fb1d4c

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
160KB

MD5
75421fed681281c0fa19eb9be0a06985

SHA1
738caccbb2cde45ecb17fabf40bf75d2cdab6432

SHA256
6e70a833f7674e654a6cf80d9ef14bf7cdf0597e3478b7128089d3ee52d232e0

SHA512
436284cbfc1246984275d4e67eb57e4bac4f7d7fe8ae635f8e0e3cdb474f39eaf461d7d5860010857c4984a21ea14306277f89a4f35836a963531d7c308d99e5

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
160KB

MD5
5a98c2fd3173872bb9c21dc0d736c8c3

SHA1
c61822242d3bc22664187ae07ef9242c981b05e2

SHA256
84b13317f286b2eb3361e60d0c94d60d66bfab4140f92573fd33551513835ace

SHA512
5e07d5eb19747a942485bff6d77c2711e3ec0dc5884398e5cea7a7da35cee081d1a7fc6a68a97488d93a052718e96744348ae33c0b772fa6d4cbc3d9e579b83b

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
160KB

MD5
0674c5c1e1ce44d03be2f179ed69530b

SHA1
fb9ec72886994b1d2cb7959b4165b45c5ee2ffda

SHA256
c4d919f2484dc95e868c6f3dfd23b379f6fa521f1f2225652db9056ab82dc877

SHA512
c2b34b84649169c55de5828d92a66ce0db586aa8e856bb46656b70d912ebb8486c8f039c7e95bb1e3abd8c7af14a5b2552e4cc2d5afea566cb7534d60b00c45f

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
160KB

MD5
24cbe64f6eb520351a1ae22c56131023

SHA1
d8c76d7132feb81291f8050c0f7e447a87a8bf20

SHA256
e002457716a5ab786def12f557d80f0b0c08736717eab15225c2df16316b4764

SHA512
068d78e3e81630ba77acbc86d4b315e7ee4da5c6ab6bb2da753acd42418d4e84335eeda05635aaf7a184808b0e452c40e7b4385eac4aa11e0282629c348584b6

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
160KB

MD5
75964866ac33c9be6b93f8c53c1e245a

SHA1
9c29d8c5197491a6b0ebc3b124dd4efbaceb5f39

SHA256
f615ec248e81819b1fd83f106d10a839141c3b083c71f6bd863e2e3e7bf63636

SHA512
bd64f74d0404d4282d3f7ef0912163a20c129360178e6b2a3b535cc56690d653edc00bd2e3d0c841a7d6cc34ccb31a5186ee5ae3c9a07f8bc5bf52bb81fea6ac

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
160KB

MD5
9fa092708192a6a10ef2541c604a726f

SHA1
1e90c7673059befbbf9fd3c4ca695e10730e640a

SHA256
c2c318bee3595b052720f19070990b927e7fa1ec3de11e7fe304561c21462e74

SHA512
40d92dff28f7f4299b4aee911891b6849d2f51a78df96ae619e00da52e2ec595e2eabcd3cfd77ad9513a49f61b1e2e33f4ab6bc460187e601ba26c362e8dd0e2

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
160KB

MD5
562767ec34cf19ac821d1895ce504b29

SHA1
e268bb6ec349f1ae42654f319a18153c7adb78f4

SHA256
50958fe8158c9f4e2ab8b33cb43d975ecfdbae4f87bdae78f27553fef95d1108

SHA512
e26a6ebe4aa9f8b467ff0adf0a398ff396f93dbc89d6c646ead15487f572879c68ab4c89b2c21a3dbcffda492d42afe9ca5aea4104a2653c5f477ecdb5b18d26

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
160KB

MD5
450003c09a2ba1d63e8f4ce1f4115b86

SHA1
a935a4914434e257a87a270626606479de9458ff

SHA256
e52b3e4187f713907868107df5e16ca240b7ff7add662ca3fc6778053ead485b

SHA512
42debf07d598a7e18c332c50646c1a3e7424a2d0348706a6be6089b5e6dd7f4eefa391ea1ce12904c0214d972e7e90c4f46e8535154de5d9cb1c63c67116e4e8

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
160KB

MD5
6654fc126c933d2845e03d02b5eba43b

SHA1
d790f53cd0a597050c0d9b838ad986acfcb2a9fa

SHA256
b6d09fa7558715cc7a01f3c356a7c704cd8f1c59c1a2f67d0ab95e93e36972ae

SHA512
6df1a4fd8ddda0c5df03dc6fee979b51d735ead9f8f21e5c985a7463afcda0aeae8195f23b5c85e42f97eb7b82be7b60233530be7d81de7f5eb581770c585122

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
160KB

MD5
be9d5c42d561d37662f64a5381b9c0c3

SHA1
31be399cd4643470429421a69418920e5ebe7007

SHA256
7e9aa67ed0f38481ba4b699df9539ef96018a4c286a5ee26b74065555fe406fc

SHA512
44c50ed999afc95a40156e6f3656fb69451a68bb58ebd26bad28e13e9f5fb4c7bf1799d6d0222acc7aa28ba32627690e9ec3f4b40b91d7f00777b3ab0af6316a

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
160KB

MD5
2ed80809c43d3548420b9d90a395d5d7

SHA1
de933255bbc34657c1b15b6d1f4e3d4d22221adc

SHA256
c048981f2cb09054f655394037b20d0c1541f34b143967e9f091d5c13d183914

SHA512
28235fc65f6b0d57eaae8c648ce03f4bf31bb1335b49ec91e3e2038cbb3327e79234d15d1ed17a4002e5041cf1661cd142555e70bd4ee5940f2733bf55abe74c

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
160KB

MD5
2d2214c30889125011a8cd8df5f0dae5

SHA1
2fbe91aadadeb686b0a5106ec5b089bd4e6cb947

SHA256
d290febe33dc469e82d2dc24c3617ac953d73d8582fe5bd3c4a74c4f9ba9a2d5

SHA512
1e294ed9693165faefea2d35d5aaf156cb01052d36a89e4f5d8f00ec48aca91bf0dc7f6ed27d1cdca9b1a2794e96e2d99b9225f93fb8cb918e7cb281e4db2587

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
160KB

MD5
17981d4bfd99471563137869afae941e

SHA1
21efc99dfcc041cfe29cbe476b1203244ddd8c7a

SHA256
bf2e9be4164643d68ac21e5a071ade9791d83580c7de2ad5a3e075312f5ceebc

SHA512
05dd52fd10c795fb0bff9c48426df7bbdca014a6a3b95596144dcfed3c26b4b10dc594a5c4c43c485564061bd2f6ef1cb79a0047c0b764a863a389493158c4e2

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
160KB

MD5
8e1cf130a9c8634061c9f310e2cf9f42

SHA1
698ce8b8eaee4ee43caf1c4bbd28ddf6568ec791

SHA256
ad9bd0074d54e4f40b831a357d1ef82bd79e5e1a45c6bce9873583cd3ab64938

SHA512
d8e752dffe3f3dc2124f35dde8279fe60242e60def472e6cd09724a7d927b63271916fd46691532b15c1fbca5b087bc64ac7da3dcf123d5a1e34bce60b930b77

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
160KB

MD5
911abccf39b559a3479459760b4822e3

SHA1
e678dd5cdf45d329e199fe118cb2deb7403dada6

SHA256
231a07e805731c62d76350929b76571fbabab3b85152b6a7c7f069229d77d46a

SHA512
a4317cd159f5672c3bc09717e1b6de6388752cd5406f9538a5d94654d3cbab8ce0e37183098a368e02750a14d4bd830aad46b6536b3d22f5198a23caacb73655

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
160KB

MD5
003e33c75d90e558811809691756f009

SHA1
72eb98a1f9530173881bded69cb0c8fe41809bfd

SHA256
cdabcb2c0257c8eede5b20e728e4e2c6ba5244c5daa569afc5c9ac989482fc61

SHA512
dec1a0fa9400cb080d6b6a409df7ef3bb3e1944dbef795aca952c07f24bd9c9e7cde4d20f85154058a6e22023268320a8d5fe0e5cb4225f7ecd9cbb5e99ee385

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
160KB

MD5
9056e3040f9445631437ea98a2dedcb6

SHA1
6d79308a7394559039c6f8e2994af247dfa6a9c9

SHA256
158f0d4e067dd64ceb2807df70850a27c46f52b00fddc65a0ad89c52dd8b82f0

SHA512
aa035e78fcb95d7b077fc490e9e369f204eb860f3c0941ec8e5e6bd791a0dc0e73a85db77545dca401bbee3186b756984760a28c602f52763b6842e059da0211

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
160KB

MD5
09ee10f15b72cc5819c0fafcfded264c

SHA1
99d0a78a16b9214023cda3191f709c3faff6ff8f

SHA256
0abd5f720dd0fbef97bb7de5372450e2de4f5b0ce53f1fd459d39dd4fef5c454

SHA512
6db786d3eb304d01322a222fa36e83cab30c0a8dbcd5cbcb11efa194e6d08b047836b79433e196c8b66a06cff240c91ac87ed5f42d38529936edccf662e818f8

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
160KB

MD5
bc7eb6a7f1a5ff113fe1b3383179bc3d

SHA1
cfa89cb4055e692f5d0d97594718b513206b5377

SHA256
0066a2fb923f94195ef09981823ef69aec90b3ad374fb61b746e710e430f230c

SHA512
477fcaf7568ce538938e6b6d18130d2287e864d1bab766e090271205fa47ae205d6bab9fda387950c44bb306bab03b42e054107d6c9fe826dda0a143e84b865a

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
160KB

MD5
72f0ea247a6d0be88dceec9290da5f21

SHA1
2c1e93b7bc411f90e983600b04966650d4d7adec

SHA256
5bf7c269041801f76b6d6206636250c47cefebeb1ea65161922cf6814e4e5cf3

SHA512
fa41960c59afc0e8433e2543da702763218621f2403bdbd8c8ea314512b1fff6adaf5b642240e3df870630a671677b6566bfcec5adacf4650e88a85a2be8a0bf

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
160KB

MD5
10baac32a26494dda80d636e61b3e860

SHA1
077d13fa311e16be7e673a90f816d4e1d2e9766e

SHA256
23b419c48ede0e6d6adf55c1616d1b5d261b2d6150673a45858e570b7bfd0045

SHA512
7c1de7538737b1267251bf7a3aa50935833e5c89d54c0182bc64d4d9f509d85997622e26885abcf78f6452fcdeff62533f5a4fdb29d5872f380789a88db9a56f

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
160KB

MD5
70f1cded7959374b978a75f60df6778f

SHA1
f7cbe1e00ed59bdcf23569a5e79b49991a4be351

SHA256
035408f6de6a6e73a865907b4a77a8df7bb5325cd0a2d0c37d45b9cd30d6f946

SHA512
ccbe0dbd33fc6eac5050cb4165a7fd5775594d5768e14370e81339ba1eb712df27f13ef655e6e454656ebdd7c05d89a8ece397371da34c9e85f3ced3da35c670

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
160KB

MD5
3fb0e9d641621a9f1d91206640ba4077

SHA1
4ec0fd19f46e9071e20eab536342400119db9b12

SHA256
9d1432c174445a16625e1e68e7f2afe113cdce1b56cb4b96827c5a0853cbe212

SHA512
9d05ad5a8857e8588498acedfe1592f0db40846afdbffe1b39007956ef555eb3b58f0745fae009b5ff51697b4543567dad8e1b5f086cf320168c7f305cd4ef72

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
160KB

MD5
3f3e19975a02cef4818fd19cd673fa68

SHA1
8aa7c1c15e0b2548a248f1fabbc368150149b72a

SHA256
3cb00e976a27db110753faccfb4cfa3cd6a1b5513481be6c4132309d94142cf5

SHA512
864caf114252e4823e5b4d0fa9a98fc900dba15070e40b3a4dd58ddccd9affe4098b29f57863d5d7e1d98d28caf01ecad387fda9efe6d6fb526a26a4a2d4409c

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
160KB

MD5
4768a4c7f113e36a4ec75543253bf07b

SHA1
c1f6198438437c703b92208073dd31b492f96615

SHA256
d4ed0185ee6e9f7f0bf4baf3ea49ebec9e1bef94001e4cf4200a337ceb2309b4

SHA512
b8b0430ac70a1f9732511627537acaacc9a2c5e36659ae073b4b417038fe9548c22ea3ece64dc053a8424a33dd0c639c2837bc1a734cb2aba6e3168441ffe444

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
160KB

MD5
7b78ba2e001db3c8fec2b2993458d208

SHA1
cf505e035c2fddd6d50386348d21778a61b8eb5a

SHA256
9b2a01d8f5e7e6f6212bdcf8bdd0c246632228d3428a0848c305eecfea42f311

SHA512
15c244b891c34eae2a251e5ac1446f915edd74afb7b8c49768781bd340093d4e15f3d76564abe7062b07c604243c88890ffbf9ba61732107e67331687bcef338

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
160KB

MD5
8d6248fcf708c96ab99c456703664dd7

SHA1
31b4ddad20d5e849b781eea5689d292b40364bc4

SHA256
523bfaeee46aae3b262145084d9620d24c251589c7e6a972e56aeb242dadc181

SHA512
4a2b7201226bf52b3a5edd6b0f1fb04847826df73aef3353cdf2ffe966273ec309b0ab8d1ca0a4a1d89c60ecd7ad2672d2de0c5d8cec4856cc3804576b04a78a

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
160KB

MD5
64b8f9b15d29e1398b8ec84418afdb9a

SHA1
e8722ee62fb69eea22b01826e49b79a754365d9b

SHA256
11b502bac8b31910b7599de0e2a03728741ad1ab5c4df39acee66aba3b2946be

SHA512
c6317ec399ce7efd97a68123905e65beaa21e34b2d188249e1a3233fe7d3b6823985939549bb86dc2952ee98df21285fb8d008cba1a07a30d212da84704d2df2

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
160KB

MD5
168843e20580269d37e398cb695c584f

SHA1
77f630307dce94232baec28580fc2c29bcdc4804

SHA256
06be2bf7fa28f87222a1d0c736ae087ea966c17304dde60b891fba0cc3906c00

SHA512
5691a180be10cc996474152546cb2737753d42d13d87b7884c5a4ea738c951d6b3952bb6079095e4d412addc58f776f99c8e77e210899163724ad67a907f401d

Download Submit
memory/232-543-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/232-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/336-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/432-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/964-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1116-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1132-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1492-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1576-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-550-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1804-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1928-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-529-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2228-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2332-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2352-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2612-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3476-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3588-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-523-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3760-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3760-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3824-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3824-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3844-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3856-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3856-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3916-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3956-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4192-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-519-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4308-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4468-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4612-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-537-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4828-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4860-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4860-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads