bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
Size

93KB
MD5

84f73d7badae787b86cf374e1fec0f30
SHA1

a68f1d818307850669cbef606adb4d586524cf74
SHA256

bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385
SHA512

109caa199636beb27821c40075ceb6caa6f81001fe3454fd2c5024ab0ef134edd7a804281ec50f32b6aa93d9d08598fa5eb33f6a4f873699513db775e167a19d
SSDEEP

1536:JY8q6mGcXmD338MYexpoyRfQiK6r+05PsaMiwihtIbbpkp:JU63EmDn8Mj3oyRwQ+05PdMiwaIbbpkp

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe

Executes dropped EXE 60 IoCs

pid	Process
4324	Qgqeappe.exe
4952	Qnjnnj32.exe
5068	Qqijje32.exe
2140	Qgcbgo32.exe
1132	Ajanck32.exe
4200	Aqkgpedc.exe
3372	Acjclpcf.exe
4348	Afhohlbj.exe
4628	Ambgef32.exe
2848	Aeiofcji.exe
1988	Agglboim.exe
2168	Afjlnk32.exe
4448	Amddjegd.exe
2424	Aeklkchg.exe
2872	Agjhgngj.exe
2144	Afmhck32.exe
2200	Aabmqd32.exe
4884	Aglemn32.exe
1488	Aminee32.exe
3824	Agoabn32.exe
1532	Bmkjkd32.exe
2360	Bfdodjhm.exe
2976	Beeoaapl.exe
2864	Bgcknmop.exe
2444	Bnmcjg32.exe
3364	Bmpcfdmg.exe
4168	Bgehcmmm.exe
4100	Bnpppgdj.exe
112	Beihma32.exe
3112	Bfkedibe.exe
2064	Bnbmefbg.exe
3396	Bapiabak.exe
1360	Chjaol32.exe
956	Cabfga32.exe
2232	Cnffqf32.exe
4016	Chokikeb.exe
396	Cfbkeh32.exe
3956	Cmlcbbcj.exe
2324	Cagobalc.exe
4788	Cfdhkhjj.exe
1576	Cjpckf32.exe
2688	Cajlhqjp.exe
2956	Cdhhdlid.exe
3640	Cjbpaf32.exe
4240	Cmqmma32.exe
2980	Cegdnopg.exe
384	Ddjejl32.exe
2332	Djdmffnn.exe
2128	Danecp32.exe
3856	Ddmaok32.exe
1820	Djgjlelk.exe
3668	Dmefhako.exe
4552	Daqbip32.exe
4512	Ddonekbl.exe
696	Dodbbdbb.exe
1956	Dmgbnq32.exe
3160	Ddakjkqi.exe
2124	Daekdooc.exe
3884	Dgbdlf32.exe
5112	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Aeiofcji.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cabfga32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cdhhdlid.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Afhohlbj.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
File created	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Qciaajej.dll	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Ddonekbl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1828	5112	WerFault.exe	142

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aabmqd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 4324	3184	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe	82
PID 3184 wrote to memory of 4324	3184	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe	82
PID 3184 wrote to memory of 4324	3184	bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe	82
PID 4324 wrote to memory of 4952	4324	Qgqeappe.exe	83
PID 4324 wrote to memory of 4952	4324	Qgqeappe.exe	83
PID 4324 wrote to memory of 4952	4324	Qgqeappe.exe	83
PID 4952 wrote to memory of 5068	4952	Qnjnnj32.exe	84
PID 4952 wrote to memory of 5068	4952	Qnjnnj32.exe	84
PID 4952 wrote to memory of 5068	4952	Qnjnnj32.exe	84
PID 5068 wrote to memory of 2140	5068	Qqijje32.exe	85
PID 5068 wrote to memory of 2140	5068	Qqijje32.exe	85
PID 5068 wrote to memory of 2140	5068	Qqijje32.exe	85
PID 2140 wrote to memory of 1132	2140	Qgcbgo32.exe	86
PID 2140 wrote to memory of 1132	2140	Qgcbgo32.exe	86
PID 2140 wrote to memory of 1132	2140	Qgcbgo32.exe	86
PID 1132 wrote to memory of 4200	1132	Ajanck32.exe	87
PID 1132 wrote to memory of 4200	1132	Ajanck32.exe	87
PID 1132 wrote to memory of 4200	1132	Ajanck32.exe	87
PID 4200 wrote to memory of 3372	4200	Aqkgpedc.exe	88
PID 4200 wrote to memory of 3372	4200	Aqkgpedc.exe	88
PID 4200 wrote to memory of 3372	4200	Aqkgpedc.exe	88
PID 3372 wrote to memory of 4348	3372	Acjclpcf.exe	89
PID 3372 wrote to memory of 4348	3372	Acjclpcf.exe	89
PID 3372 wrote to memory of 4348	3372	Acjclpcf.exe	89
PID 4348 wrote to memory of 4628	4348	Afhohlbj.exe	90
PID 4348 wrote to memory of 4628	4348	Afhohlbj.exe	90
PID 4348 wrote to memory of 4628	4348	Afhohlbj.exe	90
PID 4628 wrote to memory of 2848	4628	Ambgef32.exe	91
PID 4628 wrote to memory of 2848	4628	Ambgef32.exe	91
PID 4628 wrote to memory of 2848	4628	Ambgef32.exe	91
PID 2848 wrote to memory of 1988	2848	Aeiofcji.exe	92
PID 2848 wrote to memory of 1988	2848	Aeiofcji.exe	92
PID 2848 wrote to memory of 1988	2848	Aeiofcji.exe	92
PID 1988 wrote to memory of 2168	1988	Agglboim.exe	93
PID 1988 wrote to memory of 2168	1988	Agglboim.exe	93
PID 1988 wrote to memory of 2168	1988	Agglboim.exe	93
PID 2168 wrote to memory of 4448	2168	Afjlnk32.exe	94
PID 2168 wrote to memory of 4448	2168	Afjlnk32.exe	94
PID 2168 wrote to memory of 4448	2168	Afjlnk32.exe	94
PID 4448 wrote to memory of 2424	4448	Amddjegd.exe	95
PID 4448 wrote to memory of 2424	4448	Amddjegd.exe	95
PID 4448 wrote to memory of 2424	4448	Amddjegd.exe	95
PID 2424 wrote to memory of 2872	2424	Aeklkchg.exe	96
PID 2424 wrote to memory of 2872	2424	Aeklkchg.exe	96
PID 2424 wrote to memory of 2872	2424	Aeklkchg.exe	96
PID 2872 wrote to memory of 2144	2872	Agjhgngj.exe	97
PID 2872 wrote to memory of 2144	2872	Agjhgngj.exe	97
PID 2872 wrote to memory of 2144	2872	Agjhgngj.exe	97
PID 2144 wrote to memory of 2200	2144	Afmhck32.exe	98
PID 2144 wrote to memory of 2200	2144	Afmhck32.exe	98
PID 2144 wrote to memory of 2200	2144	Afmhck32.exe	98
PID 2200 wrote to memory of 4884	2200	Aabmqd32.exe	99
PID 2200 wrote to memory of 4884	2200	Aabmqd32.exe	99
PID 2200 wrote to memory of 4884	2200	Aabmqd32.exe	99
PID 4884 wrote to memory of 1488	4884	Aglemn32.exe	100
PID 4884 wrote to memory of 1488	4884	Aglemn32.exe	100
PID 4884 wrote to memory of 1488	4884	Aglemn32.exe	100
PID 1488 wrote to memory of 3824	1488	Aminee32.exe	101
PID 1488 wrote to memory of 3824	1488	Aminee32.exe	101
PID 1488 wrote to memory of 3824	1488	Aminee32.exe	101
PID 3824 wrote to memory of 1532	3824	Agoabn32.exe	102
PID 3824 wrote to memory of 1532	3824	Agoabn32.exe	102
PID 3824 wrote to memory of 1532	3824	Agoabn32.exe	102
PID 1532 wrote to memory of 2360	1532	Bmkjkd32.exe	103

C:\Users\Admin\AppData\Local\Temp\bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe
"C:\Users\Admin\AppData\Local\Temp\bdd8f5813f0e031c7e9f304ef4f3566fb333edbf795231b60304c1529e3c4385N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\Qgqeappe.exe
  C:\Windows\system32\Qgqeappe.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\Qnjnnj32.exe
    C:\Windows\system32\Qnjnnj32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\Qqijje32.exe
      C:\Windows\system32\Qqijje32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4100
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:112
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:956
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4016
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4788
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3640
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:384
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3856
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 408
        63⤵
        Program crash
        
        PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5112 -ip 5112
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
93KB

MD5
0bd2fca2e0ecbf7bc101df465c9add19

SHA1
8561a6b79cd6138a59602327d9c94cc64567e5d0

SHA256
53471a2487f94edbe0cc71ca34e00df5749a6f161c48db441a3571337327b97f

SHA512
264fafc6ecae38c063e674e0975a77d1392172945c842c9903d1e6d9fafb3016a3f0e75144b2e9b508013551c65f58a002418a598d93c42bcacdbf7137fb5c2c

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
93KB

MD5
eac296486fd6b8b937f4df5e8e42bf61

SHA1
8a99102d88adb1048dbf17b200b4826eab1e1bbf

SHA256
fb67df9a140383a50ce32540ad4436014d1edc7b7953392af0c54855fc7c0504

SHA512
8a8d4ac134432647652a767fc9a719fb2b2f7efdf0398bed031db6c607a9f8b884544c742f8d2855ea5050dc668da6df1a05c1f6e84b710ad5df36d3bd85de87

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
93KB

MD5
ad0817b2996fb0bca5447853d798bb8a

SHA1
b06fdd6ed6896e16104a45cb171c70a85cc2de62

SHA256
a5f2426957660335544f1d9397e3897cef5351c05d2f872b0d4c020515fc6a21

SHA512
f49d3f25f92973192c9ea664246d22aca7d186d0d3476a0ac26f0fbed7b083ce7546b740dc4186bcccc4b213f61a51a26f83b6c7cebcc31b1825e8c82c8d8664

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
93KB

MD5
9c9e826981282e5c5efc8616141d4c99

SHA1
4762f38cd6b907fe302e21cefc6130ee0953f5e1

SHA256
b53f2478a333f18f77e846dc36a19ceea46ae3d6b9b5d9bce21e2f7400907ba0

SHA512
221007517a4521f7cc6cba617659230b910c23ae3346d168d808b33a6ed7d3d6a3654541bba1bfd8ffb93451ba7cb21dc91b0e6dd3d1c31bc0eb7171131a85ca

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
93KB

MD5
1f2536d68dfdb6ed1e56ef62b17722ac

SHA1
a4a5a62513f9d2e841222b30084149896fc1e0c9

SHA256
580f97700275815c8177dfcb6cf3aa2ce5219db3c13634ab3f40eee412e61b2f

SHA512
c60ad048904d58b770f474f9db1a104d392dcb5627d3133909bc076f56b9540c8c18c543ccd10a8767cfc77ebf10af8a59d3064f420c67cb5e78c9d0553266df

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
93KB

MD5
c3acf6bbaf1d5e06ba0fc5564eb0ad02

SHA1
9575e5dafd50f0c75f537c1f6068ef50272a00fa

SHA256
6ceef667769e4ae76266d2d70f1d7294283ce0230ef787fda99d518f99f66c67

SHA512
46f84fd44cc61ac767e3a56fb80f37fb895cba8b77db4493a9d3e7903c52189936e8cb3c441b23edcfd1caaf73d786a34cd865d32873dea780b4967a7ab4078a

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
93KB

MD5
24e11a29eda22bca89b509402c662c66

SHA1
60de176a1e95fe219311d85f2bbc366ae3a56462

SHA256
82c5e3c68f913db3f13b6183546bb1486cd3608d12dd8cc34bd19be6577820cf

SHA512
d4e3ec7d3479fa7a8103fc6f8f085a3f9924ad2bc47895db130e477adc4d18a3af2d69107e7f93ee7dbaadfa08f0327108aeb2071a7b77c07a4eab4fff946993

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
93KB

MD5
63965740b66dc71c3b3abcb5273e6cd7

SHA1
a3e37369fc6123fab33535e4b639630dbe562154

SHA256
ed38984c633823d08ffb2c5b2c4c63bf7e094d7943e73d56efeac30c23826e6a

SHA512
4386410e4e5babebf2481d4858074f0f0ed54dc23dcd26a5e292b6c0d730558028074fd18dbcbcada61a48b7a583a7c88be8b26baf6df538bc6fe6a18b9af400

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
93KB

MD5
26cd502a6e2e2fddf6043229dc1efb75

SHA1
02433f0812be602d5acca4948c9f55bdb949da01

SHA256
e467c718d1039ddc15f1ea71c6d89f876549b516e5cb471e66cb356af8d95942

SHA512
7b75b0f83452505de357dd920921847fa522a8f17e113bcbaa1b2d9cf3272057cac699146fa3233e9a33cfa2a946792cf64ea3759b0f9ce634f0c39fd2db40f4

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
93KB

MD5
1dfa8df2505cac2dcf10dd34dc364149

SHA1
5299ac4e70c6f6e073fa4670ee0ceec2c6467880

SHA256
3d522d3aa14b11b1693e02b380cafa46a6bdee4831fa2d3ebcb1267b28540124

SHA512
f50b9ad77fba61d90b9581120677f82059b5195d1f955c8fccf4cae4abef5af4e8766aa1712552340414931eb3728fe06d2ca1eff606e9c46104820f8a6b5c73

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
93KB

MD5
5e32f3d6efa84b63744c5eb0d19c5430

SHA1
4468837783c6c2246c5985a795a2c058f8eb4369

SHA256
2850e49971f8f559672fdadbf37a0260f5148ec7075a07ae9ea1c8afc843842e

SHA512
2c42dcaed1db482d785d4b178c8ab660936c4380f44d002f29b83f0c78ce8f1e002417920b433c76d3532b1b5a86410db3a1a65fea15bbec03e998e925fc84ec

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
93KB

MD5
d057e564299eb55221721b63c1b81164

SHA1
956a6b416c224947721662642049363a4eaeaf42

SHA256
91f12ebce7e4a9a07dab1db43445ede72133a2f43a178c39d6d91781392c557a

SHA512
d63283bdffdf4290aea74cf03c80fe373bab4c8dab596ba598ef6d0cbfb65270d077364bcb6687533e352bf6265824eb50d5eea183f79112dbba646ec5ea4aa4

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
93KB

MD5
896f1cb6c04524195bd6f970dface2ca

SHA1
748089e433605f07fb253dc951651626fc94562f

SHA256
059f793e4de3b6ad54b784493b9e47a434f8bafa1cb6b0c9a54c5107a66bd19b

SHA512
92eb8651b9266403705b7afba599dd702996b5c8c9abbe10a11f23d05be798d59a4a056ca40c822da9ae24b2236c4f6cd0c0bc34b403495e0cf0409d67e9039c

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
93KB

MD5
877c477d9abc4a3a83467bd7133e68a2

SHA1
e4c08976533e0581b152440bd8fff415c1552193

SHA256
ae5d7910af095629aa51f1a5c7552ff9935e4c4a09dfc3081a8e107df5ea678c

SHA512
6a579470621619e1a2261bc4a8f2b158f8e3f79c0c9741fd21edd659fa749d08dd033de040c7f375db80e3c181ca447691986bef253089f08b2bf9cca1cbb6ac

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
93KB

MD5
44260251b14a625cb36ca27ba383d0d9

SHA1
4108bd22674920b575d453de1a2da0680eaf37dd

SHA256
ecd3c2804f039df21dd2efd5ff4f8de9698e4e66407353e4758d51662ff30711

SHA512
7a3ec24f4b8a3baa03073f3050e14780e4a2b54106a4b555ec49a9b452861173dbd5a349bbfb97b8ae286ba9153f83fc246398aa39c7c2f91c7c787e067bce03

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
93KB

MD5
73e8d0cf31467565d51dafdab08dc090

SHA1
d15b567d7fa18c267b97ae9049f24cbd561a004c

SHA256
2be2469511e00692d5b6b8ca8854fb38ac248132552703f1987e5173f3b9e0e1

SHA512
30923865222c438559f58eaa4ea169658b0a01165b9a5145b60dd79a9e2826217af7a35afacaa91a7577436ab01033a67c0cd22730b9eacd93bdd10800fe7aba

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
93KB

MD5
bd5ae77d8e523edd3ccf4757f15a6747

SHA1
457cd064ae605b80ae353e2d9d3f6358b96415f0

SHA256
207e73c94b946de726cd7d48c3997104c7db61beec7d2bd6ab9e593bb04af586

SHA512
1ff41b59292d615108c38ad3b833140f8694a43f60119dccf765635df0de46c22322650d930621b3d0663837b4dd8e151c00af0885d930fa2db674dbef167575

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
93KB

MD5
1da8e1a736e8739049bc943b79d2da08

SHA1
b6b8b462a6fe1fbcef7024c8964ead1bfcec3eb7

SHA256
7d1b48379f3bf34ee09a1ef1526801d0f5d96ee8d7b664ceac93cf8425b8024f

SHA512
1964cca9326e5e2137f02664e96df0c6f4910a1f996c46db8067bbdbe7399321324ea5a7ec8ecc75a6d7777e4da11b953238feba359b39d54746794c0a3e0da2

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
93KB

MD5
fd945ee11339f6188d7741f9a17e949d

SHA1
ef2f1b1ebf2468f628f40110e56953fc2ecfee4b

SHA256
4ff4df2d665b2aa6d29704b170326a3b01988065039058342dd655e7a424b6a1

SHA512
b8afcae3028c03c382a25fa20300c3c795cab7db3838213b430ad783695237889c9ab8acf1d7f432f39d63fdf278d047e6f22fed37123e42224dd08104b7dc58

Download Submit
C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
93KB

MD5
83ce1ebb9ac0a19d8453b344d8f88788

SHA1
0cbc3cd1a8f9285d750a821e2d06084a5ab066b2

SHA256
1c8f72f71a727ee47330056ac0685e1584b81b0bd479d0723c7dbfbd67f29ce3

SHA512
3cb1e471f0a0ece5a2ebaa9d066d7febaff54be7eb55febacdc49acc3c8129587e39a387b80b74b10eae0d31808d45e9dcab0bbcb05fd73c1ed6ea2550e675e9

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
93KB

MD5
350e85961e493c6782307388938a54cb

SHA1
44918174e9928e62244d6dc542ea15a015f80e0e

SHA256
94c34184f7aaa2950ea5b4ae434abfe48cf845514c0165c5624ab91dab284c09

SHA512
a71ed827108b054f4d9513af4da7454295038baa20ea9bf6282c56c77e7d5996f43542c5a71fd21334d825bac53aac707005abd09729d11da3f5ea1e32deb0ae

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
93KB

MD5
7ed9f6e0c765cb32f13612203303ade9

SHA1
5245203d9e600e778011578fde7035fedbc8308c

SHA256
5114fd734d2109f69858e1ea970f337d48d2634d9bb76d20cca62d31c069e946

SHA512
83b7491e4b8b251991fbc785376737d8ed8d99a555624c25e0568f8bdcec136445d8773bc09991cbb4e3c902f638cb318f2966f06f4460e77cae877885663be9

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
93KB

MD5
5dcc4d1e657c87eb5dfca926ba8a97ba

SHA1
a3a8a1a35a56cce58b18ebe558068f06b6f429f5

SHA256
ec830905b45b7fbdc478adade13d8353b630ba7d16ee3776b481f59e46776b61

SHA512
d90f6a2c0acdd7b46d77a6708f281dd3562bae85f70aca7aea5918c76d0899edea30cad541d5606b8acba59150f41b801ee444a6030de082f299efa02a206a77

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
93KB

MD5
e46e553dd4a050fdf9b54b980ba08122

SHA1
129a7d6193c55147cebc5b351f6c16897e3d3221

SHA256
25041af10ac94ec65a18c1e648020a360abf1859b8215b3ec7ec6fa148281213

SHA512
a94cb551e86fb20151c5c22aeb5d3640a1026a83db1d284b7a430cf49edaf2683b8c93fde2ebd0ca1a6eb2031a884fc3445f7a6f3260d3fdb89f6eef2825b933

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
93KB

MD5
838732c188f2eddbc2d729e9889dad5b

SHA1
79f4ddb36de7a0c27469e0188ee56a342400d394

SHA256
d6ff160aa59672bf934c2ea1ff78c486046a5b951f8269e1cf2fc9b37c55aa32

SHA512
e03139a13fed5f54ebd34f5e3939058f1138341e4ef814593667e297a82bfb15fb16dcce71361e54f3c0072becaf0cfa572eba5dd2985a6cfae22df93bb0ae7b

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
93KB

MD5
dc2e9ca9b63ed3cd83e98b3d54fa04aa

SHA1
90881d833b7fe1f281c31b0fe3bb5bca98ff87c7

SHA256
5965c1c623ea58b6fcc9e8a2f64a425c90f0f2ee35fae58c2be2c703e2f9384b

SHA512
a7200efbe7136631e5e7c71cf75b541d7dba4fd3093591d79da1091a4df85d2e60cfb3791afe06628a25690f97c4e58c8d1d24a2c0279a2cc68ebece495dffc4

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
93KB

MD5
7f6dccf1f2388c8d84510b9a1193a87f

SHA1
71e76e0ec9d4d80115d483331b8650212de5cc89

SHA256
da118438a09ccb68a381e9c817a260cddd9cfb1f506d9d9291a6b63054f8becc

SHA512
297ce778f27796ad71c22d5dc96001c4d65a0e23447228fa582958b2d0e014ec1eddfca421e29c0906bb595f492b9d6ffa68d48c774fc07bd88b6695e5e3c987

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
93KB

MD5
85cd888a6e66f74ef19f93e0a98d9dee

SHA1
26039fb0dd7af405eacbd3ce63bcfeb06fbc6f35

SHA256
b059bcf83f88f3eebf817a91d3e047445923ea6d7e7b20b90cbfb7e061a8712d

SHA512
7b35bfa1e51ebd802cd406390086b5bb7fcfb116c81ca3a3113b3f12b34241886e4cec96f97302e38f9bd97bafc864ff3fe2cd9d339cdc0fe16d7428d3e9c7bd

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
93KB

MD5
fde78bcb2cf6df7eec9b66a263a8cd72

SHA1
9ffdf73582639f1d20b4953e9007e28110593b1c

SHA256
ed0b9f21ec5b9b3408de59257a3643cb69813bda63f38f4b1ecb9b5aec029c20

SHA512
d0af4683cd19b20178c3766af3afca2f5580c4850076c8955c0e9904b8c6d496bc805538c788f183725a0cda5cc823a67af6cb3b0e8fb6a6b0c6bd155afa9bc4

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
93KB

MD5
d81587935e148e5879276fb3c9bd0c51

SHA1
62182d183464fc06aefae571d07dc8100aa09789

SHA256
1041a4ad1401621ac5331d6d252c80347816435243afeb1b8fdc10c4ebc15e59

SHA512
9039f88a1f88b84ec3f35726029432b40e107aaa400dcb1bed440c54a6c621f5af02047a6e23ea1838c635800b746b9ebc074a0f2ef960b95ef9710105f836ad

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
93KB

MD5
e33a58033927cdd60d4542c6ee7b2d9a

SHA1
ba93b818516fb35611356a1d989ce7f62371e650

SHA256
35503b3eedd6bd5e4a0e1392c5ec9c092c9e05e4b38087fd38010bdac74be130

SHA512
c51110688d26aad6adbb47a3f32dbaa59f3f2b1e582e33ebb64c972f348eb880cca9af992d44def15b258fc8d8a9ce3394ce2c933dec03a0fb60317bce69e448

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
93KB

MD5
cc20ce3623439329e690d001177bbc98

SHA1
a7132ecf364544c50008bd3c3a3491323fd77c8a

SHA256
98c95c6b108b53bb294e49cfbcc2ec71ce96b4dd03a3e358c39f339b62eac380

SHA512
d41ea99b2da7dd28671130167c080588ffe66059de7639f6c30f03770ac750145c06455576131ad77c68a2c40ce889d4cecf63ce2c3ec5dd1f9e391da17f5162

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
93KB

MD5
a2b5856f96110539436a549bfd64423b

SHA1
12db9514b8ff1848ccb842e25be73c4821be87a5

SHA256
78a28a8f11e49e710b8f7a2500dea443ca3ae3a4d4effc4432f293de3bbdecf3

SHA512
aaa4c20e82ce7f19659ab7496236af042e6625da0dc462373de0584a9647dbe3f4e745201f1c20a2d9073540d02808439b9510f9e631beb58230e97c8b9777ea

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
93KB

MD5
807991cf0c5d0917a65e752efe25d742

SHA1
765419c3f8943288fb1785397902ece8de8dcc2d

SHA256
393a202a20433e7c985001e94e062ea0b415bbfbba9b2a4a68f886a8e378756a

SHA512
c601714343706818829e60019fd63d5f22b7af101bec39d81928f7e6749c0d1302f4abc22ef9beb4f5b79d062c50bdff95b00e74d2138f188d39af327af12e31

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
93KB

MD5
d59e7dbf73eae0f4be72e001fe34b3fd

SHA1
c3f6f0d2af406cf0eb6d97e506c003a10cb1c5a3

SHA256
2c9eae3a8a1468e88e79dd4534a1fd96a4d39253a0d5436623f69d5a144cafcc

SHA512
aff1f78db3a0f52406ee2edb1e254081d9b7c3a97f6fdbc81ee0c345df7eac72fde32cd034c4ade6bfbd6977379616435bf4ae69d66a6045ddb4019b602499d9

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
93KB

MD5
fc18fac86fb81485eae3244f4a8ba9ff

SHA1
b1596b253c00f4849fe43b8f86aa427dac86259a

SHA256
979db8c6b5fe8e6c5acc7c8c2fec0e5ab1aac3fd19eee5dab0960d0f57a73295

SHA512
93a026b2251fb6f05c6b6c89c3566f0c30463bbd5697a818100435656f393e4acda1e4c0c2aef36a6116cb89f4ec78ffa6f07eb0fe9a671d90aa3f8a6e7aedfa

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
93KB

MD5
582a9d64adee5c52518c3466ffc669c4

SHA1
f217962ac1bc1bcde74b6c76afe42f3260f810a9

SHA256
e36b5b73419fe18bfe3fdada2640094e6e50d4acfe46f1add4fe25c0864503d5

SHA512
528f02c23598285aa069ebb82ce7c864da2c9576b96499f9a9026088a3a18ed6e813dba6bf0d22b819a9731c8171f7e327f3cd5de6f8d9447bb110d9668aee8e

Download Submit
C:\Windows\SysWOW64\Qeobam32.dll

Filesize
7KB

MD5
a3c95aebf1516f32bf4065150584f960

SHA1
55c7a66c7c389edff0ece9dc6b1190efcbc9694d

SHA256
fea4ee4675a806fefb8be1317f8f85f293e8e246c73d38ee0aa73213b6229b7a

SHA512
cf4fc676e671e491a9f56b4540aae923b188d8128903b67a338a497a9e5d774dffab66c22d29b754565fe0cd296cb1115aa746660c59b3b5c030ed8c18587d1d

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
93KB

MD5
c8366ca9456e70ae7eed6a7f4ca9b72f

SHA1
64ceb8bdcf904a8109b1df51d40296327c15411e

SHA256
500eaab17b1840c29158c6f47d191a35e94d32546fe8f8ac4f87777c300f9231

SHA512
4915e88db691660557440b18511a542bf39e006ad6f454c47d7301e4907f62338c29b1f9764b91920343a867324405c646957154857ecdcd08ded83f72308e07

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
93KB

MD5
adb1235277e64db4d4c8206d50841be4

SHA1
8dfbbc37c7c8c4246191ecff8fc0015fc1920d53

SHA256
7dd6a1e137b52a19a65f3231a6b1a3da82f6ddb3c5319a4cb4be4e4b66b2ce6e

SHA512
4d8d4cf55705a6836cbdb2c0ab65e3cb0d85e167746f4c4363a27b06b22f9ebad8024ce20afbd7613875b64724628a99c9e2562208422bbe607df360df55a959

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
93KB

MD5
20fca016920954cb35850f86423f9cde

SHA1
e16d2cd4101c28753fd32f860c55c44a702aff2b

SHA256
0ef19cb9d291733b63222c8ce0ebf4443ec4b9a4ab181d1a5256b676609f8476

SHA512
78d3fe424a0d70fce669a205b18489129f90b755a62a56e3c9b7b2193eec81ba09cab777489bd991b7df6ff31e32dd9052bf0436bde5c9eac9477f3f50cbe22b

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
93KB

MD5
e0f8449a44aed9b6c1aafe2370877dbb

SHA1
7f9d0f0928747f57a5d5579cb24a9d8c71ccd50b

SHA256
4c4c6e26b6b29c330cf505a6c7c796067f985637c9cb07011808e9e9b1fb961c

SHA512
0e70a12e8d7483689a1ea90caceb5539d5e7cb84c0349ffdaf0d3569bbad35f33e904da911532c246ed9b9de1c87306a615627d1a76f1ee73bc6c81eb24af921

Download Submit
memory/112-231-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/112-456-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/384-437-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/384-347-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-287-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-447-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/696-395-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/696-430-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/956-451-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/956-268-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1132-39-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1360-452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1360-262-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1488-151-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1532-167-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1576-443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1576-311-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1820-371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-401-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-87-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-454-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-247-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2124-427-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-435-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2128-359-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2140-31-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2144-127-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2168-95-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2200-135-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-450-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-445-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-299-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2332-436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2332-353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2360-175-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2424-111-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-200-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2444-459-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-317-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2688-442-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2848-80-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2864-191-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2872-120-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-441-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2956-323-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2976-183-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2980-341-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2980-438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3112-240-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3160-428-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3160-407-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3184-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-458-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3364-207-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3372-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3396-256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3396-453-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3640-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3640-440-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-433-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3824-159-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-434-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-365-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3884-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3884-426-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-293-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3956-446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4016-448-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4016-281-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4100-229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4168-457-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4168-215-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4200-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4240-439-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4240-335-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4324-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4348-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4448-103-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4512-389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4628-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4788-305-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4788-444-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-449-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4800-275-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4884-143-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4952-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5068-23-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5112-425-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads