d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe
Size

82KB
MD5

276292a562c97dbb648f3c786e5f2550
SHA1

c901b409cb5dae67eb062265e5c265a50e9ac50b
SHA256

d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d
SHA512

7dd24007893d3a8d509ed30a840d19c6380eb9d3823ab806a0b6ad40b942713962c39f28470fa8f3858e7a7f7228c95e8e6241da50bb944c49966d8e7d1f9360
SSDEEP

1536:TV7s/mwKLf/2/nd5Dw7jP3KBZFRgOkmoqc2L76Fpm6+wDSmQFN6TiN1sJtvQu:TVg/mwKb0ZFJkaVkpm6tm7N6TO1SpD

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe

Executes dropped EXE 64 IoCs

pid	Process
4812	Qgqeappe.exe
636	Qmmnjfnl.exe
2624	Qqijje32.exe
1080	Qcgffqei.exe
4768	Qffbbldm.exe
4376	Anmjcieo.exe
2192	Adgbpc32.exe
4260	Afhohlbj.exe
2000	Ajckij32.exe
948	Ambgef32.exe
3948	Aqncedbp.exe
4368	Ajfhnjhq.exe
3540	Amddjegd.exe
1800	Aeklkchg.exe
1344	Acnlgp32.exe
3064	Aabmqd32.exe
1076	Acqimo32.exe
3144	Aminee32.exe
1644	Aepefb32.exe
4804	Bjmnoi32.exe
3748	Bebblb32.exe
3528	Bjokdipf.exe
4108	Bmngqdpj.exe
4236	Beeoaapl.exe
2280	Bffkij32.exe
4480	Bjagjhnc.exe
4668	Balpgb32.exe
2608	Bfhhoi32.exe
2040	Bnpppgdj.exe
2732	Bclhhnca.exe
3432	Bfkedibe.exe
4416	Bjfaeh32.exe
2904	Bnbmefbg.exe
4644	Bapiabak.exe
4440	Chjaol32.exe
2344	Cfmajipb.exe
4280	Cmgjgcgo.exe
4356	Cdabcm32.exe
512	Cfpnph32.exe
3672	Cmiflbel.exe
4536	Ceqnmpfo.exe
768	Chokikeb.exe
4848	Cjmgfgdf.exe
5052	Cagobalc.exe
4900	Cdfkolkf.exe
4396	Cfdhkhjj.exe
2316	Cnkplejl.exe
376	Cmnpgb32.exe
1996	Chcddk32.exe
2308	Cnnlaehj.exe
4788	Calhnpgn.exe
64	Ddjejl32.exe
3620	Dhfajjoj.exe
3428	Dmcibama.exe
3140	Ddmaok32.exe
2940	Dfknkg32.exe
3184	Djgjlelk.exe
1716	Dmefhako.exe
3680	Delnin32.exe
2492	Ddonekbl.exe
4944	Dfnjafap.exe
3420	Dkifae32.exe
1260	Dmgbnq32.exe
3008	Daconoae.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Aoqimi32.dll	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Aepefb32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Ajckij32.exe
File created	C:\Windows\SysWOW64\Amddjegd.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qqijje32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Cdfkolkf.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Balpgb32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2916	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdlgno32.dll"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4812	3260	d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe	84
PID 3260 wrote to memory of 4812	3260	d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe	84
PID 3260 wrote to memory of 4812	3260	d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe	84
PID 4812 wrote to memory of 636	4812	Qgqeappe.exe	85
PID 4812 wrote to memory of 636	4812	Qgqeappe.exe	85
PID 4812 wrote to memory of 636	4812	Qgqeappe.exe	85
PID 636 wrote to memory of 2624	636	Qmmnjfnl.exe	86
PID 636 wrote to memory of 2624	636	Qmmnjfnl.exe	86
PID 636 wrote to memory of 2624	636	Qmmnjfnl.exe	86
PID 2624 wrote to memory of 1080	2624	Qqijje32.exe	87
PID 2624 wrote to memory of 1080	2624	Qqijje32.exe	87
PID 2624 wrote to memory of 1080	2624	Qqijje32.exe	87
PID 1080 wrote to memory of 4768	1080	Qcgffqei.exe	88
PID 1080 wrote to memory of 4768	1080	Qcgffqei.exe	88
PID 1080 wrote to memory of 4768	1080	Qcgffqei.exe	88
PID 4768 wrote to memory of 4376	4768	Qffbbldm.exe	89
PID 4768 wrote to memory of 4376	4768	Qffbbldm.exe	89
PID 4768 wrote to memory of 4376	4768	Qffbbldm.exe	89
PID 4376 wrote to memory of 2192	4376	Anmjcieo.exe	90
PID 4376 wrote to memory of 2192	4376	Anmjcieo.exe	90
PID 4376 wrote to memory of 2192	4376	Anmjcieo.exe	90
PID 2192 wrote to memory of 4260	2192	Adgbpc32.exe	91
PID 2192 wrote to memory of 4260	2192	Adgbpc32.exe	91
PID 2192 wrote to memory of 4260	2192	Adgbpc32.exe	91
PID 4260 wrote to memory of 2000	4260	Afhohlbj.exe	92
PID 4260 wrote to memory of 2000	4260	Afhohlbj.exe	92
PID 4260 wrote to memory of 2000	4260	Afhohlbj.exe	92
PID 2000 wrote to memory of 948	2000	Ajckij32.exe	93
PID 2000 wrote to memory of 948	2000	Ajckij32.exe	93
PID 2000 wrote to memory of 948	2000	Ajckij32.exe	93
PID 948 wrote to memory of 3948	948	Ambgef32.exe	95
PID 948 wrote to memory of 3948	948	Ambgef32.exe	95
PID 948 wrote to memory of 3948	948	Ambgef32.exe	95
PID 3948 wrote to memory of 4368	3948	Aqncedbp.exe	96
PID 3948 wrote to memory of 4368	3948	Aqncedbp.exe	96
PID 3948 wrote to memory of 4368	3948	Aqncedbp.exe	96
PID 4368 wrote to memory of 3540	4368	Ajfhnjhq.exe	97
PID 4368 wrote to memory of 3540	4368	Ajfhnjhq.exe	97
PID 4368 wrote to memory of 3540	4368	Ajfhnjhq.exe	97
PID 3540 wrote to memory of 1800	3540	Amddjegd.exe	98
PID 3540 wrote to memory of 1800	3540	Amddjegd.exe	98
PID 3540 wrote to memory of 1800	3540	Amddjegd.exe	98
PID 1800 wrote to memory of 1344	1800	Aeklkchg.exe	99
PID 1800 wrote to memory of 1344	1800	Aeklkchg.exe	99
PID 1800 wrote to memory of 1344	1800	Aeklkchg.exe	99
PID 1344 wrote to memory of 3064	1344	Acnlgp32.exe	100
PID 1344 wrote to memory of 3064	1344	Acnlgp32.exe	100
PID 1344 wrote to memory of 3064	1344	Acnlgp32.exe	100
PID 3064 wrote to memory of 1076	3064	Aabmqd32.exe	102
PID 3064 wrote to memory of 1076	3064	Aabmqd32.exe	102
PID 3064 wrote to memory of 1076	3064	Aabmqd32.exe	102
PID 1076 wrote to memory of 3144	1076	Acqimo32.exe	103
PID 1076 wrote to memory of 3144	1076	Acqimo32.exe	103
PID 1076 wrote to memory of 3144	1076	Acqimo32.exe	103
PID 3144 wrote to memory of 1644	3144	Aminee32.exe	104
PID 3144 wrote to memory of 1644	3144	Aminee32.exe	104
PID 3144 wrote to memory of 1644	3144	Aminee32.exe	104
PID 1644 wrote to memory of 4804	1644	Aepefb32.exe	106
PID 1644 wrote to memory of 4804	1644	Aepefb32.exe	106
PID 1644 wrote to memory of 4804	1644	Aepefb32.exe	106
PID 4804 wrote to memory of 3748	4804	Bjmnoi32.exe	107
PID 4804 wrote to memory of 3748	4804	Bjmnoi32.exe	107
PID 4804 wrote to memory of 3748	4804	Bjmnoi32.exe	107
PID 3748 wrote to memory of 3528	3748	Bebblb32.exe	108

C:\Users\Admin\AppData\Local\Temp\d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe
"C:\Users\Admin\AppData\Local\Temp\d6261291ee7b3c45b75da290d95c1dc1d57a20191bf07cd624718352ce753f4d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\Qgqeappe.exe
  C:\Windows\system32\Qgqeappe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\Qmmnjfnl.exe
    C:\Windows\system32\Qmmnjfnl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Windows\SysWOW64\Qqijje32.exe
      C:\Windows\system32\Qqijje32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
      - C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3528
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2608
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4416
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2904
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4280
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3672
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4900
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3184
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3680
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2492
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3980
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:640
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4672
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        73⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 404
        74⤵
        Program crash
        
        PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2916 -ip 2916
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
82KB

MD5
6dc8a4e3acd08a025c9686639614f64f

SHA1
026ff9c79ec45f1ba95923522be666b0ca2b1a02

SHA256
21d2392b975b65b831feba2d4cfb355b8a19c1da02277d61a8c13ff55a62e10c

SHA512
7167815c3e052421375ee75d98d54ea1baf721ba7490552b69c878cb4c9d6be915ade9325289d143cca82a04d2889f8ae7fca2815eabf666a4b6b2f9187c9170

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
82KB

MD5
9c2373a494460c5bd4a71ecb6fcd6b78

SHA1
98600fad91d5bb9f60f4eb9e577441e199cc4404

SHA256
966f27b7031e47a8d23b9a7efd3b4f8fef5ff30b38de5ebed284515b5e5d4340

SHA512
03d5a43b39dd7a6769cebce36342caa6a9939abe281c409e2b321a4f84691ecaf2cf23a15de1fc00fc7c1ae488cccb7236976b18ea6a19863f3097de6befbad2

Download Submit
C:\Windows\SysWOW64\Acqimo32.exe

Filesize
82KB

MD5
3a92bee1a2f8f833cf1f360fa3aae614

SHA1
a366b6f2066c685b57d26a3d588506b3fcc85411

SHA256
aac7efabf00fd533ac3c03726d1c10b355137f39b438698d00b08c7af5030fa1

SHA512
646d025abb1556a47aecdccaf696e7e18db5762a0d26b942506bfd5b3436d9239d83213cb0888c85423ef034f3792a8e8d4a32e8415e2b4c2a6c6cedf488e2d8

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
82KB

MD5
3e0ec7f9769215735f49a5dbdad9fa3e

SHA1
fdd5c7e3a1eaa372c4316f78934f6e796aeeb468

SHA256
94b161c66da819346298f536bad45a5e0bae66b3ef4fb5d50aad7b1b3397cecd

SHA512
aae4003b9e53c2f9a825619bdf76e31bebf87859490672fa24d3eb947e802d6dd5440cf1515c179e4e638f38ddc44906901334b5c24d161c29ad005ba3f6803e

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
82KB

MD5
3c6e0694ec85ff46dd733272226d377f

SHA1
ff40b584c1c3aa8544d233a97c2ca65047f64d68

SHA256
cbb7b1187cb66d25a529669d489225a4604ae00cc43bbd37e3582b8fb590f537

SHA512
b003f887b7d8fe705a758fb4cc5042f6db582059e8043c8b2052e48866005ea9b9d99e7e5e1e107bb6901a00eb42776a47cb15a919a9b096f1728c475fae0e05

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
82KB

MD5
4a7fcd9388fbf52723e5a888f4eb0ce4

SHA1
62d829274e7f8b1ea21699c09b33edb09237ff5f

SHA256
5d014456bad259f16dc2356041c6eb17a19bc82a337b26743ba28924526eb832

SHA512
903fbf44b6aea11308a9d74d928e0ca5a294d5a5a817bb7ee8bf1165004708978589b4235929462f743af11a85327b695550f0dab27feff98a843978ab39325e

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
82KB

MD5
cc32082ef2411edcf46436bbbad331cb

SHA1
5a7a9f38dbfe6ef6be7f8b5b1cd739beb973e44d

SHA256
bd24a27220fb2fd5f1a654471140a3f639b2f0eb0e34660fbffdeedf910f2636

SHA512
64dbd1c091d1de7f204238b22a0d42694c58396e7454def3fe11df49dc82ed4ba94598b435f7e02bcbba74388056b71217f8094f00206ecce41e00b281ed1bed

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
82KB

MD5
192bb54d216e7ae2bf45b56057cf8d3d

SHA1
62b6f6593961f1dd6caea2820bac2ef9ee735d30

SHA256
0ba0468ccf08e2f9e7a6d4c06ddfa79d04ccc1c94f532e4193165dd119dff45b

SHA512
f4901b395f0259c09765862f528203a32d8e0796a125b07f2863c546ac3bafb97915ee2f806c840a71c80cebfaccd8029656b4d82a1139dff4efff2f5375f9d5

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
82KB

MD5
e60761379c279ba4c900ed7c3d4b4a44

SHA1
c92f41d627260e45a4a65c8684f1ca35fb112ceb

SHA256
fb0b567baf8f1874d779d395f77a50fa3770d1b7d8d756c42332763b208fa66f

SHA512
c9ec9c89108888a521078f3cfd7fd03a60af2a1b2607931d2594f415a31b8e4ab404730e544642550222411004484e3820c9fbafa5f91bf397e1184f0e0c1225

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
82KB

MD5
c4b43fd9afbf8d03301174f47f6ffc79

SHA1
c48f52d7b6718c40fe4453e43e26ac9971e2e045

SHA256
be7f86e3e5b96cfe0eb98c36edf0a4553ebc3adac95cae98568282bd75a1d934

SHA512
9d56c15e5cf5a3f634222bba52a3057edb930abc2c3003f6b918f96127167fa84d6a1939b7c6f88436872166c229dfb45347ca3ede29d5b9aaf9a0600d4f6af9

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
82KB

MD5
2e1db1e73a2559b6cbd508809353e530

SHA1
9ebb1c5c561d61368e21415e0588990e194b4feb

SHA256
c28e9c5a806a8378156bef68e9e0ae5e21f1340abde1766518c4803f24ffe26e

SHA512
47ada7ff1481a40c624ec1000c4ed251f0b8dd54ce7d8ffede0dd050db25045b44765105be4085a05752e8ca807226bcc2fa07b073f6d17f4e9db8c5c3d900c2

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
82KB

MD5
9672fbb398986ad55445a54a19f87014

SHA1
6ba62e0f3e9122bfb2ba1b0784be865c51daaebb

SHA256
d488005a41676a92cf13e473deee5007277abba8467d4a808215e785cc9992ff

SHA512
40248e90ac4fd277f9d18cb5ba70f3370ecbe9f274d34fba235ba9ba9a3c4e4e9c0c73f584644a129d56a417b0674c3ce0a5de07ff829192efc5058add807b9b

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
82KB

MD5
bf53aeddff9b145de9e62fbe4a2c3185

SHA1
dbddaac12092bfcfeb71ab570066b08eda3fac23

SHA256
8ba69cd9e558f3e32981111eadb3615fcfbf81a2434619287b6928f46ae1d54b

SHA512
842ee594f8c4f3beaedf6b21640f50e10e6d57c5548f9924446dd3a20a1ae38d958d09b606af022b5c11e6f912c53bfbb3abaa48615e63babec788e1464691c3

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
82KB

MD5
28136d3d729b8a1618300d99cce97724

SHA1
fe840aeabfb51bb1e50895124b5638277096cebd

SHA256
820ec0404ec8885bc4de1988b41057de5d441c51a9794cad2a2c130942510ede

SHA512
8ffd417149b25999df2ea232d8b732cf3fdd937ac1b8eb4ced3e680e13a7a76ced0e126dbb4f83e9610fe1c41ace1f94bcf87b94f95f0118355e6fde336ec2f5

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
82KB

MD5
e8942957603fb9a85fb96dc6420618fb

SHA1
6c9a831c865768b4c44327fd9adbd033264351e3

SHA256
496227585897ac77af1eebe5edbacaebd7ff1991aaf7d477d36a356bf665fedd

SHA512
bf408bf1866f638181c3818a17f2e70ddbd760e7eb827e7a1cc5985dbdb907d8ed350a5a5b9ac8900e937cf339952264179b0098e20053fa7e420a402dfdcd94

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
82KB

MD5
dc3cf5841ceee762f4ed3932adeeba00

SHA1
011b2ed3396961d3703e6156dbd871afcd032f19

SHA256
c66bb52ecde0b71515e5d6e6fd8b5a97826fcefb16c1a7d4fcda8bc019c51a73

SHA512
4ec87ad6547f4616cb8c8b835b7fd56349bc8d1be536c436eb441c11c38f50459eb208c6176229026d3a4627ca60fc794a6a84c1ed0fc9179d5c6777ec1406d3

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
82KB

MD5
7f4d6fa7093787057bb9e914f28b54c4

SHA1
8cbc7a9beee9402e84b7fb8093fc193fe0ae80d2

SHA256
a7bb605e212d0a1a75575fd8538090b0e0b64b0f634001122112c6e7108962e7

SHA512
dac21f51db9943447998231db9b2e41e7da2572bcddc0a882f674fa4986b2ad18e3420d72b1faf059eee9ea754d5d188322d29af98a1f886962f2e9c24db38e2

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
82KB

MD5
edec7e56bea19b6f56e9793fff142450

SHA1
494e7dd45530079da7c3bc89f60b9dd589ef293b

SHA256
91fad1b30978eef6957a46a6dea83a25928eb453cab3dbd39136940da3398302

SHA512
8f440aefab45763e77bcdf7ce25dec384fa663b420225ae7950548a809b08f23cfc6385f0cf9cacd7d1c48e1a52c09489758a72af91b417aa6785a2212e43d73

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
82KB

MD5
77bec4243ebd294c4a41c8a2373d2ee1

SHA1
bfb0129e7e10000d4a295b4270c3e2f220553e17

SHA256
584e27799ab55e964360a8f22fba1caf6357e1079d00358b716396d830c2f947

SHA512
0c0d58b364a47c44d29d0ac632e3917c1d0f8c9d555418d9d033cc0b7ce0861acb0ff8c4eeaf0ce9a2f1552717ef0f06a5dd1f403788b89c1e81790a74e1da50

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
82KB

MD5
5125e74e0ce913a577978836c5276a60

SHA1
d35b8e82da26dc23580a868db65b75eab954a50b

SHA256
7e371377141eb8746a809cb3b7f24aa9becd8d6d4e92e6095ce8fadb00c598bd

SHA512
304fac48c530546a8752d8e895081a6370cb881db164853cdc75ec37e6cd03bce9e87e55fd8abcb3b4459b6389fe55b2b857d4514d52940827953bdfb369703d

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
82KB

MD5
c1df9cc339ad5cfe39920bb73a1f7359

SHA1
2fb52ff9be174f0daaeda28d5c9e5b48e2be02fc

SHA256
25268ea80c8975778636e66a9f6fab2d9162214c1290e4c50c7d2e239c2ea85e

SHA512
56a762ab5bd7fe995f3bec6f4e43a797163f6006900eb4956c2ed475156cccf16e0372411e8bd101ff813f8dc7d7f8a2bb51e14291a6e0820a7a188b19c452e2

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
82KB

MD5
3eb1e11ea583e12d6798d816b140f8a1

SHA1
8940c34de86cf8e169de2cc3ef2a351fcc7db63d

SHA256
847518c1098d22a9418c78bcdfebf37c31b9ef52dd76d63eb261f90c19dd9bda

SHA512
f8d5336a36b1390feb203eb0e7fa5dd6eafbf71e965d8b06667c870defc5fea6ffcdb14382897d6ab16b7f0b0a1123e28f5fcc4d1fd8f592d00000c25a5f4bf6

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
82KB

MD5
360d1413f34ab8a83a9fdfe604687dc8

SHA1
53d3551bcd61fc3493413a18355e7633d9dc121b

SHA256
e2d5e7612df49b22ad6cbe8bceaacb70efd8f48b6eef0ce38e8ef889a94da458

SHA512
dc259a3ebc56e86a0c0f565199575b596d89d6ca16486b27de88c3aa2e5250ebe9f2acc01d1a709720994f6ccfbf36746bfc6a055ea3f36f3a3b4d2f46c175d1

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
82KB

MD5
aad73551ba476789df0b876be3356727

SHA1
1e2bccdb66c5a3d3fa0461a58cda1c0fc9450e94

SHA256
2e25a6dea59d33b4236e2ff2e6b7e912e02b21b6d1c6032c7fefa91401539f85

SHA512
85c8cbc12be67271d1e119170f96b5ddf74ef6090330ac4b689e1966e0f499e04026576497911befa81f355dfd8915c61bf46b1018574a47c2bef045055faaea

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
82KB

MD5
9dcf43fe3a64ac05a5e62412b374b2db

SHA1
bcd1c4d090503397fbf4dd414b33843d830cdb69

SHA256
ba91dba92d93781a6fee25ee83f751ef2ba08fc39b63155b5e65d1b79f0a8d56

SHA512
7f1f67204bbd152e91ffe8e665013ed1c838a1af68ae1e39f3c51de9344a2a1b2d58242d6c388d6852547b8df539d63c6ba8e70f07f799c2e4b2c91a19b49006

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
82KB

MD5
98ea2c684dd7a85c0f7dcd43ca2c0afb

SHA1
5c7ed2518f571e11bbce3b550b97aff2cb21c049

SHA256
d3d48a150ccf6b2343056ecc0e42361243ea0fab67a827f7d8e0f3b6d72d2038

SHA512
42fca01a41afffd9b3c314f4d905d943861650c7330b77025086f687ddf08d5786dc8d8d6085db9eceee4ea7cd4eea65c3a4ec9c62c9c35c23ef5d024eeef41a

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
82KB

MD5
20761ed810c388811da138ae7e4bd368

SHA1
2d2f545fdd67aeff9c827d4cfa95693ef8251ccf

SHA256
54f88383f1c0790b305b9fddfcfd4e5114972f25477a901383f0e73ecf9034e5

SHA512
d32569b998723e291a98a733eeebc58565f524aebfc26d353191c5abd2d99eac44639e7f9997a00d3dfc92151b40e3942762a8dfec684c1f0c8b61c65556587d

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
82KB

MD5
cee0c0c604ecb493dd99875311f4d168

SHA1
93aa97e885aa8c3c7696904780f2be6490f97ece

SHA256
5c2c4d662ddb67831f06eeaad97c9b113757f3d38bb10f9d536061067ea6d592

SHA512
becba43b327d2a04da805c3a5ad8284b06949ac6dea087a84ac5475efdb20f3ebc182299ee218f39816db975083be93a72e8d8ddd76ea9ea64bd30d5bd2d5662

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
82KB

MD5
672964cbb876f46de87a0a6bdd488bc5

SHA1
e4e72546fb4ea64b4f249d6cea83eeedbce523ba

SHA256
74fa9db1c330860035a5d8fbc723bb0d88db2b91ffe204227bc5fbefe917b8bc

SHA512
eabb8383388f11b18b7ec1a40db25b538c15ff011ae45759c079d390c32ab8e897b3e4e787ce32e2890cd33e5cf6841a90e72f3f484d7130e41a9e16be422cda

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
82KB

MD5
7d7e3217ca6f2ad47c2c5e0092ceabf2

SHA1
1e28f70bdbf2b349d29b899ef85cb83f34d67dae

SHA256
97813b2c6c9516ddebebcfd7d491899476f60d1dbc1443299ac886b0900002c3

SHA512
12e9b2a71b6f8ffa3ef9262821848d93eb5bc529fe6d1f7db61486fedd05fd154eea47b1e44ea9a0023f9dc9f368b7362da67f02cacec3d785d80266a6e787e6

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
82KB

MD5
42ba129cbd8bcff98bb971d3c8c5d570

SHA1
c6d521fc9432a098aad29604d6096a4758400ba3

SHA256
2131f6fa50a67f57e4574d636dc840469e219ef1c56d7ba47c19b344b3343259

SHA512
682cbce907c1bdb11763401983cc8470253eb6ad360bb0bedc3bce651c7397a3663dfcf6f083c694a45e646454ba5cd791063579c979c0878ea756b01dbd86ec

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
82KB

MD5
2f97c459d56a673e6bfbf05cda041a3b

SHA1
51e10477132df5150ee9516bd3af5d90fd277b7f

SHA256
a1a267cdd29b2100c8969537034a05afbf518144fa6f576b75094ed86555df9b

SHA512
5675aa99e6ee09be4bf7c3cb9461aeb6b8a1bd908b7c74b5287fc614aab230d3c14a5df0e768b9cec47d472358e66240799b4e620d198d9a062f2fa445e518c8

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
82KB

MD5
a27c4ed845930dda923304969dd2ea8e

SHA1
b361b1ae19e3f962e8eb0f79cda2e1c184fba6b1

SHA256
fe4368ac4b7bfaabb105640e111f37a3155a28698b5fc2dbca83051d31ed9807

SHA512
f9da271059a3e9960ae7d871714ce33add709bbcdb7ace31f497119eb66a0a1fc30fe628046f260a3f7d1fdf489ffaff76f568eca50d8e489e73d5daef1c2569

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
82KB

MD5
4c4babe4fbdf618b5346d406dc4562db

SHA1
7e308db2666f63a145011037af26e45815772249

SHA256
92b08cff4cad3b6b3e0d06ea2aabbbdc85983d24030abfdd7b3c0e5ec7274ae9

SHA512
8bcc86eadae06e718a3469006210ab428a544260847f9f30652023ce879a3422fa842df592fcc0ce7157d1ff3b68f0f6a28d6ba02e48d7981924ade38fb3a05b

Download Submit
memory/64-414-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/376-386-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/512-392-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/512-325-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/636-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/636-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/768-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/768-413-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1076-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1076-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1344-220-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1344-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1644-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1644-162-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1800-205-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1800-117-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1996-393-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2000-78-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2000-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2040-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2040-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2280-221-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2308-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2316-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2608-243-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2608-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2624-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2624-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-331-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2904-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2904-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3064-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3064-229-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3260-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3260-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3260-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3428-428-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-273-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3528-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3540-114-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3620-421-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-399-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3748-181-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3748-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3948-91-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3948-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4108-202-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4260-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4260-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4280-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4280-378-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-385-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4368-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4368-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4396-372-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4416-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4440-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4440-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4480-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4536-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4536-339-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4644-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4668-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4668-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4768-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4768-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4788-411-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4812-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4812-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4848-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4848-420-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4900-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4900-434-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5052-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5052-427-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads