berbew | ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09

Analysis

max time kernel
96s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
Size

163KB
MD5

fcc3950134be6cb12cb0122fe008ecf0
SHA1

ecb3bf1de0b438ccc31b2af520dbb1b4232b6a05
SHA256

ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09
SHA512

67709afe4222b0956e2362fbc6365023db991b8b36f9e6c01c647404ae588e06a3f8eedd31a0a85b2478d7218e3d5f779708df1f09383bb59f6999930ae25696
SSDEEP

1536:PX0kuF2G9lqvj8/c5+C1G1JsdhAi1bzxlProNVU4qNVUrk/9QbfBr+7GwKrPAsqE:9uIGGb8E5+7wA8nxltOrWKDBr+yJb

Score

10^/10

berbew gozi backdoor banker discovery isfb persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

gozi

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi

Executes dropped EXE 64 IoCs

pid	Process
2184	Qnjnnj32.exe
4896	Qgcbgo32.exe
1448	Aqkgpedc.exe
4800	Acjclpcf.exe
4780	Afhohlbj.exe
1776	Anogiicl.exe
2580	Aqncedbp.exe
4116	Aclpap32.exe
3036	Ajfhnjhq.exe
1568	Aqppkd32.exe
4984	Afmhck32.exe
3704	Andqdh32.exe
4040	Aabmqd32.exe
2240	Aglemn32.exe
4840	Aminee32.exe
1052	Accfbokl.exe
3928	Bjmnoi32.exe
1960	Bmkjkd32.exe
2176	Bebblb32.exe
368	Bganhm32.exe
4440	Bjokdipf.exe
4880	Bnkgeg32.exe
4816	Baicac32.exe
4420	Bchomn32.exe
5060	Bgcknmop.exe
5056	Bjagjhnc.exe
4608	Balpgb32.exe
3452	Bcjlcn32.exe
4396	Bgehcmmm.exe
2604	Bjddphlq.exe
3988	Bnpppgdj.exe
1640	Banllbdn.exe
2888	Bclhhnca.exe
4448	Bhhdil32.exe
3784	Bjfaeh32.exe
384	Bmemac32.exe
2020	Belebq32.exe
3176	Chjaol32.exe
2620	Cfmajipb.exe
2036	Cmgjgcgo.exe
2752	Cenahpha.exe
4252	Chmndlge.exe
828	Cjkjpgfi.exe
4692	Cmiflbel.exe
996	Ceqnmpfo.exe
2876	Chokikeb.exe
2096	Cnicfe32.exe
4112	Cagobalc.exe
1512	Chagok32.exe
652	Cjpckf32.exe
4960	Cmnpgb32.exe
3696	Ceehho32.exe
3788	Chcddk32.exe
1440	Cjbpaf32.exe
3872	Calhnpgn.exe
2136	Ddjejl32.exe
1400	Dfiafg32.exe
3248	Dopigd32.exe
3972	Dejacond.exe
1540	Dhhnpjmh.exe
2252	Dobfld32.exe
4500	Daqbip32.exe
4172	Ddonekbl.exe
5044	Dhkjej32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Andqdh32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Andqdh32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Echegpbb.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1352	WerFault.exe	155

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phiifkjp.dll"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndhkdnkh.dll"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Calhnpgn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2184	2156	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe	83
PID 2156 wrote to memory of 2184	2156	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe	83
PID 2156 wrote to memory of 2184	2156	ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe	83
PID 2184 wrote to memory of 4896	2184	Qnjnnj32.exe	84
PID 2184 wrote to memory of 4896	2184	Qnjnnj32.exe	84
PID 2184 wrote to memory of 4896	2184	Qnjnnj32.exe	84
PID 4896 wrote to memory of 1448	4896	Qgcbgo32.exe	85
PID 4896 wrote to memory of 1448	4896	Qgcbgo32.exe	85
PID 4896 wrote to memory of 1448	4896	Qgcbgo32.exe	85
PID 1448 wrote to memory of 4800	1448	Aqkgpedc.exe	86
PID 1448 wrote to memory of 4800	1448	Aqkgpedc.exe	86
PID 1448 wrote to memory of 4800	1448	Aqkgpedc.exe	86
PID 4800 wrote to memory of 4780	4800	Acjclpcf.exe	87
PID 4800 wrote to memory of 4780	4800	Acjclpcf.exe	87
PID 4800 wrote to memory of 4780	4800	Acjclpcf.exe	87
PID 4780 wrote to memory of 1776	4780	Afhohlbj.exe	88
PID 4780 wrote to memory of 1776	4780	Afhohlbj.exe	88
PID 4780 wrote to memory of 1776	4780	Afhohlbj.exe	88
PID 1776 wrote to memory of 2580	1776	Anogiicl.exe	89
PID 1776 wrote to memory of 2580	1776	Anogiicl.exe	89
PID 1776 wrote to memory of 2580	1776	Anogiicl.exe	89
PID 2580 wrote to memory of 4116	2580	Aqncedbp.exe	90
PID 2580 wrote to memory of 4116	2580	Aqncedbp.exe	90
PID 2580 wrote to memory of 4116	2580	Aqncedbp.exe	90
PID 4116 wrote to memory of 3036	4116	Aclpap32.exe	91
PID 4116 wrote to memory of 3036	4116	Aclpap32.exe	91
PID 4116 wrote to memory of 3036	4116	Aclpap32.exe	91
PID 3036 wrote to memory of 1568	3036	Ajfhnjhq.exe	92
PID 3036 wrote to memory of 1568	3036	Ajfhnjhq.exe	92
PID 3036 wrote to memory of 1568	3036	Ajfhnjhq.exe	92
PID 1568 wrote to memory of 4984	1568	Aqppkd32.exe	93
PID 1568 wrote to memory of 4984	1568	Aqppkd32.exe	93
PID 1568 wrote to memory of 4984	1568	Aqppkd32.exe	93
PID 4984 wrote to memory of 3704	4984	Afmhck32.exe	94
PID 4984 wrote to memory of 3704	4984	Afmhck32.exe	94
PID 4984 wrote to memory of 3704	4984	Afmhck32.exe	94
PID 3704 wrote to memory of 4040	3704	Andqdh32.exe	95
PID 3704 wrote to memory of 4040	3704	Andqdh32.exe	95
PID 3704 wrote to memory of 4040	3704	Andqdh32.exe	95
PID 4040 wrote to memory of 2240	4040	Aabmqd32.exe	96
PID 4040 wrote to memory of 2240	4040	Aabmqd32.exe	96
PID 4040 wrote to memory of 2240	4040	Aabmqd32.exe	96
PID 2240 wrote to memory of 4840	2240	Aglemn32.exe	97
PID 2240 wrote to memory of 4840	2240	Aglemn32.exe	97
PID 2240 wrote to memory of 4840	2240	Aglemn32.exe	97
PID 4840 wrote to memory of 1052	4840	Aminee32.exe	98
PID 4840 wrote to memory of 1052	4840	Aminee32.exe	98
PID 4840 wrote to memory of 1052	4840	Aminee32.exe	98
PID 1052 wrote to memory of 3928	1052	Accfbokl.exe	99
PID 1052 wrote to memory of 3928	1052	Accfbokl.exe	99
PID 1052 wrote to memory of 3928	1052	Accfbokl.exe	99
PID 3928 wrote to memory of 1960	3928	Bjmnoi32.exe	100
PID 3928 wrote to memory of 1960	3928	Bjmnoi32.exe	100
PID 3928 wrote to memory of 1960	3928	Bjmnoi32.exe	100
PID 1960 wrote to memory of 2176	1960	Bmkjkd32.exe	101
PID 1960 wrote to memory of 2176	1960	Bmkjkd32.exe	101
PID 1960 wrote to memory of 2176	1960	Bmkjkd32.exe	101
PID 2176 wrote to memory of 368	2176	Bebblb32.exe	102
PID 2176 wrote to memory of 368	2176	Bebblb32.exe	102
PID 2176 wrote to memory of 368	2176	Bebblb32.exe	102
PID 368 wrote to memory of 4440	368	Bganhm32.exe	103
PID 368 wrote to memory of 4440	368	Bganhm32.exe	103
PID 368 wrote to memory of 4440	368	Bganhm32.exe	103
PID 4440 wrote to memory of 4880	4440	Bjokdipf.exe	104

C:\Users\Admin\AppData\Local\Temp\ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe
"C:\Users\Admin\AppData\Local\Temp\ac5a6971249756d52e0e8024a969e6d7f11a3f8e904f0b2b2b6ebba8bfe31f09N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\Qnjnnj32.exe
  C:\Windows\system32\Qnjnnj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\Qgcbgo32.exe
    C:\Windows\system32\Qgcbgo32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\Aqkgpedc.exe
      C:\Windows\system32\Aqkgpedc.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4420
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2604
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3988
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2888
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4448
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:384
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3788
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1400
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3972
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1540
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4500
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        72⤵
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1408
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:1352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 396
        75⤵
        Program crash
        
        PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1352 -ip 1352
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
163KB

MD5
05b3beb7240d29857be7738b9c6b517f

SHA1
d953f76adabcd9a91169631006a148b7f80ad4d2

SHA256
5f8e885fc78290642607306214177e963f17f580f3236cad14534d459d1c5ac4

SHA512
1ecf8d8981e891eae860a0c8645814506b8bef15f98b1e0ab368bc5b26c8a6f56797bb6e89610cd0f0b5cdcdc1be1f8001639b9fec5319a38adc564dd81f574e

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
163KB

MD5
226bc45ea4416b3b66862f217861e41d

SHA1
6ada87d55ad60001cb92b33ed6ed90780a98d370

SHA256
8217f17373ccc38853ac15cf51044239fc1843c67faf2cbd7905d53da20c7e9d

SHA512
e8b23766b8b897a028e6a95a326c2fb5991cc5364afa800c992b047444de844c4ac3e11ae77785f65d79160119ac7c919397572a29679cdad0d05f7421b990a3

Download Submit
C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
163KB

MD5
e898902ef1e61c88f3d4388713b7f286

SHA1
9ec22900d85bf4d04336cee17db9a87ba599922c

SHA256
33561d0f441da22c30daf431b8240dbae4a70b6f9a16829bb25c9d084a393915

SHA512
a5ac500d2d57ff4b2b96fccb283f6cb34d6b59c621e1e8173ed69b26d597dad713aeb11bef0019051f3aac89d42c73bdaebbbe86bfff6517a5c34225a2c799e8

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
163KB

MD5
9852e5dd4ddf5be3b25500b9b1a8a838

SHA1
d3f338e0ca08855bad9d3f979b435b7f64ed1c8b

SHA256
bfdeb98cb0579c716a88e74a49a09c239b919c6ad2caa25099d36ef2f46bf063

SHA512
5feae70ce26d60d3eaf98f1e45e6f8ae1be9b4957685b808ed3256b104e7778826ee251a55f9304e182f9d0bb0482918d6445fa1484b326f928760e73285ddc7

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
163KB

MD5
6e1a7bad978b9d99b550fb3a3031220f

SHA1
36fbc554f132130bb83996184397d898fa79a9e0

SHA256
ff46109f8942a8191912c7204f7ea8a5f3e12d9cd5754d65bd4d8c1d16894c89

SHA512
528ae32ce667757ac11b08114e8c7d1bf9e7660f40be8c8d6ce3b3352d3c18e89fb7d7f6777a149a4cd13783f95dab4e225be93b0d7f72c520bb743982927f67

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
163KB

MD5
f49dafca10dc202e163359f5ba47f254

SHA1
e14eac782f881d4a455b7aa9bf225e76a6290ee4

SHA256
2cc6c2ca88f3d12a5177e434f0152e518b1eada19353f04eaeef5a8672dd8cd3

SHA512
7f71da2597fee3c779949cb036062a603da646a0321502e4017d8f9f7aad49b25c3f4d89c4f79a27f5b1e649de6a2ae86bd19fb4a642e19a5cee7f20ef928458

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
163KB

MD5
d877eafa21aed34eb9002e6ba7316cf7

SHA1
5d66cf2bb49b815e4698bd7b74d9c1aceaa145db

SHA256
584575c757eb89adeda58b6f6695ba105015e4694095037e7141f8430cb9da69

SHA512
75eff925c7860e0e58f9814e0a061c77f1546b31abd296c4286d4cebbf9e5523d9b6f5cf6c95aef70274ff2f843e9f0ea270669b646f75214a4d6aa4ba94f42c

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
163KB

MD5
d80387ca9f3b69edb6badd07ec1ac90e

SHA1
fdc2e2722c2786c7e3b610f3d1de0c8a25676973

SHA256
d6f9ceb56c0c50f424feb82a75c8ae2ba67d223638e7f21df66d2f179e12b777

SHA512
83327d90261c48789556d272783754d011608aa68b8943afbbbbfd21924725eb4a24011d02946fac1b84c47c90044590263d201eefeac1a3f1c689c542ef2dc4

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
163KB

MD5
3731dac87d28273e96bf4fc8547c5172

SHA1
41f4538eed967ab0d8669ab76026d3dfd7978ee2

SHA256
cf7f5d6183adac46e3f1581ccdd6b28bc5fadb69f69e26e778fd34d98e0760ef

SHA512
5e14c3489ce7d98d5e4a54fdcda729fb04550ae001a9c8b4545700f9d5c3793a4520339c33ad0cb97025785982cec4191f6cc5d7a4ce4db30b9757e01f1d0914

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
163KB

MD5
c1d87a90ba51090c3666872019a8ecd6

SHA1
41fa45e8d0667aef2f937a26c7cef990c56c5917

SHA256
61a58b025d213c4f2bfd0e7ec898052677bd96d9d1b92955140546d0550a19fd

SHA512
39d76d2e6bb6deb36afc20d92cc2236e40e38e033a9c69ed8356aea1ed5a10ef12d9de55a83ae2ce921739554acf5ff6ba612125a18fb6ac8425f96aeb8cddfe

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
163KB

MD5
656ff3c774594b6fd4d12f9f23dce0e7

SHA1
94ff3e71321d56c4dcb557712fe7ca55a3444552

SHA256
085e3f48da7af8ad342d3a1051018c24098c3b6b18089950fe0f0fbf7fc00fe1

SHA512
c0490da456a2a90c8702bd9ff7d496de9f06307bd1d3416f50b73300bd5f5fd8f30f10e3e9ff86c43d86e782986e8120699587947202295a09ba7a17a5c331b9

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
163KB

MD5
dc65fa96215a05c8e52d352dd75151a5

SHA1
1c5a5b7c1e55fe01e07a9f10aa745a99faecd060

SHA256
181db252aaa0ad7b5a7536e9ecfe7ba0628927eb27842914f1c8226783da75e0

SHA512
fc9c414bd07c1ecc8639750eb90726b0b47b9d26659ac0e911f474efa7c71edcf8e73dfc06f5db76ba5b32688e1a85bf8070a4bb22cbff3df1f53cbebdad1729

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
163KB

MD5
56e715f18fd42346366abde97bcae90e

SHA1
0438be11d941cc6a4ef965a5a390c43ae180fdb2

SHA256
5a63344d73c7b1acd6caf4e6ea957e46c39ebecd94d59d0ea25864610209b6c9

SHA512
f79c86fd4dd1b645a2e6bc88e21932560ef87df9da51fa19227d5d92bd5fb611ffa90bc84316ce941e74ec9159bf54a5704bff38a814fb341171d1915b074fa5

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
163KB

MD5
9564ea7a667d058982f7e6c742eb9e36

SHA1
9ad38365d600905aee6efb4cbb03a41b1d6b3d58

SHA256
d8a21c0e7b284deabc378e8dacb172f07cc5ee98a76186ea5765536f668b1d76

SHA512
18a603c76da112f1af16fa3e72651e4d821fb9a0e04bc05327c4d7e97da1351ea67c8b2eebc5f83b013d327a2578f1c6d5ceafc4fc2ce53c83388c010562c9a5

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
163KB

MD5
d22fc9677a0e134de8fd7362975a5848

SHA1
29d6764d1e0b65e73b6685f1af92a6ef409d473a

SHA256
e0c13cd2819b48139dfffcf2c76553e2385b47af0eab79211f8eb7a5c1f419b5

SHA512
2112a6a8a9757560043b5f222a94b7ec8482ed94523101bbe7497e669c60f92f404bca94291a503ea0bc53b25ce6eabb2b6a7302c4196709aca03cde6a5cad66

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
163KB

MD5
d990721d4280098574e468c5455b8bdd

SHA1
456c730e3d290c5c4b2141393568579326eb4bbb

SHA256
7b9eda370b34532ca23c752ad916cbf10cede8f66cac73fb056c1ea0f98e0f21

SHA512
39c307bfd47768f74b5c403ea5eb596db2d418edeb00238770d1cdfc872ca78b6778c95ee7ac6a8a921de290354196fe6e875976fea617938905f3ae238e8fc6

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
163KB

MD5
5d10cc8718ace3d1727729bd2d286c29

SHA1
152a4629c9d5a538b78cebbd81aed8b849661036

SHA256
a91b223888217d498271ab917a34dce26037853c1c0c06ac8e4d3e6b0f7c7cac

SHA512
135ddc5f964dff009b96b26122db70d6582dd30686d48a36fa2a09716b0938837b8aa3e929c20c8d2c9197b34265f1d23025ee497969b92661cab0eccaf6f26e

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
163KB

MD5
477cc991faaf064f5698f25fe81145dd

SHA1
ac08008da8854764f22a741de56e5188cfca0491

SHA256
a51da9887bfdc99a7fb77de38a88344f01ec06d81b915b74bf8459ec527d5515

SHA512
b9e36b1635558170f586f5ca2f536c99965ff28127165ed50a0d7ab4d86d167626c638349a865fb54e167e5babcd5c33597cc9d301c879daddee7b1e5d38f865

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
163KB

MD5
1394f4fa08bb9a5932aa012f625d01e6

SHA1
c3b1ad9e5e0b732905e11cb409c4d9c7e8907bab

SHA256
1cee8793fa1d0bbd0b4f9a3be07e088be72359aeda255226ca6fcc98632c98ba

SHA512
1ef1c9b28498539652c3b68ed0dfd6b8a2e4dd22068b04941f2867ba5be9d3dcf522bd0005dee2d044aa08b6edc20291aaea72886c2a8ef8b37e4ecb68e6a521

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
163KB

MD5
c27d646550cd7a821124d4539f94c5c8

SHA1
4e05a40caa1e39d5b9891fdd1c2a4c60ed2bf3be

SHA256
53d42e1a4b286edf925202a4b3d8ddc0602affde1666bf422df1033d6bd72315

SHA512
4c3c871a45bf4d667ff9c997230e29b862ccd56ab2e784cde30c0171904e5bfa513de1a235e3897f5f25e758b0a830fcc49eca2882bd6f66f752e316ef39bb72

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
163KB

MD5
1201c841de2afc7ffb03d5d4f6815b2d

SHA1
75c6a1163f2579a1e35a7637494c12095bbb05c1

SHA256
8c39a492490c8b03b8a9c00f600eeceaa149b86ad331a4207b7bde7a094eab41

SHA512
8830afeea4ad603d10c2c7f8ffce91c548ea5850d82ce3676d6b8c5378a7184f92fd948aff6012ce55665369402d444f1c03146268886550a9329da7efcc6775

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
163KB

MD5
fa2532a07c63806cd0e72a5dc6b07250

SHA1
28aeeae983e3e20f727a068c10c3001788e6b27b

SHA256
a9f8bf7fa9edcb0d93dba09c19b80ca1b7d02055c8711ef27466dd32521b18f6

SHA512
c6cc61fcf4e42dedb6614454a62fd80b6847f73531fc9532def9db38ef290994be1aad418d8054073fe27b813219394cd60bca07e4939f437af8ac80871c827c

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
163KB

MD5
40ece8f14713c5ca8bf490e8bf878e85

SHA1
6769f717865fadd6c184736f4d40a9e7f0b3d156

SHA256
dd9499de9f17725b98c12814839be56998a2d4f561c717eccf9bd98ec5f9e9ea

SHA512
01c0fdb9b07410734aee209167fd07ffb634e351288de7e712caa3162d472733c8609d0de28811f34454b62fbad4e7fcbde0fab6a8c4358c867901fba0530b5b

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
163KB

MD5
09c643dda39402a26f100ace31841e9d

SHA1
88e3b2a5ccb7da7a2cd0bca530bf307acfbf3a80

SHA256
f9cbfba67ade2d18107c5cb6524d59cd86791dcdbb82f5c2e4b9433e1aef97bc

SHA512
41bab8a173a8cc75f537aafd67fc5e577e451a47dfee320f8f9835cfad2a4a70a208b8527d118ec73625ca5b9efcf79f815087edb4a82a368f12f7684e94cdbf

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
163KB

MD5
2f7be0479ed83d3a6febae0068c0d8f0

SHA1
fb6ab3f5dabe61859ebe6e71beb44920bd122bd9

SHA256
711598c131dcb49f5b5a16606fa1fd49e632bc709b50b3b611f014c0d9ae6276

SHA512
1549740b2eab4d89ed6808a3337852ed3b1d0d71552416719d142fc08984c4c287aed4eaf81ab87ea4bad83730d163a0d2bd68ed72aa793dc4698291044dfb1a

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
163KB

MD5
9e40571682d57ef1a3aa649aea1d3f0f

SHA1
df7e66b03178acdd015ce3163899701b85e6323b

SHA256
65379c4122d622999c58d1c6752ff8f1e312b70b7d7b80cd0273418dafd548ea

SHA512
64b7ca3025ad8acc0c4b90938a3922c35a8bd905e2e0b23d0e71dec9fe7877a467f2b9f7c77407fa80c4681352b467c1fe4e4e9e2af48ef3daf2518065c91a3f

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
163KB

MD5
1af4a8a87af5ab2019e27d3dd5a2f260

SHA1
9b15ecb88f0d1a3a17b80a6279cf1a657e708d49

SHA256
ebc9868fd0ebc31eed094c7e92d691c228b7badec8ffbd3834a3a7d187ce6e07

SHA512
a71d68929b2e3ac9159ef061028ef2decb15a1a1391b1c56a233d22c8749686ffaa3ca1c38e3ae9fec2b4fa1c313151cc8f3f0c880febda4c5a3fcd26c91d664

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
163KB

MD5
d2e662ee07976f5b412335b23e940770

SHA1
47c50e7f540d1cfd6644c3c3af2df760a0915c34

SHA256
b82c15d7394ec97c93e2c9ef806bb7ef1276e9ef7f04919d6ae0e5de39d97e13

SHA512
89ff15e0ee8a247ac7a22cfb37760e59819c112f2143bb21fb99e842cd204856789eb32824b37dbaf3b906d4e6145b5cadcb2bddf9f10eb9dcb28acd9b8cf927

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
163KB

MD5
cc488a6478e4d858ec83906b0136c199

SHA1
c94ea3880a337bc0fc8cbbf82644726bada7711b

SHA256
a32892fb6f011d0e913143bb9d13cba119ecdf59923e6d73299ee135d68ffbdb

SHA512
e5734c8fa13c89640365463eedcb214db59c3bd9ba2d93ffe76807d5d9d21572be82107fa03552b389e664448eca0b1c221ab03d8e7e7b53d751687f8cf05ab7

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
163KB

MD5
0e30c005666aa572bc32c9fe4fc1d1bb

SHA1
daf82eb5dc758b4c59e6074c3b2dbc4ad505a1c4

SHA256
bae68834ce7ccd3400f0ca5f53b305893e83c6340560d329957854e14d07ac58

SHA512
443615935c5dc2c2c865382d8a70d15ae069de310527a4e55ee180734aec9646baa72284b03c3b06188c93e5678fec2e0a6cbb0ec33cdea1483ab8dbc326d97f

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
163KB

MD5
20717cc9ebba7c4e0ddc1f9bf435cab0

SHA1
84d836f43de69bd5e3657a455ca7ef8ec7c624ed

SHA256
1f46f06c4409fdd01fcfd06cff37b85d039094d2828642bb14fe63a28473c52c

SHA512
7436b151abb8e219332baac93a3b9a1468185282f2067ec1f49bb724fd6821d55e313e60e008b447c21a4378da2c34a1337faab29c54ee42b266c2669b0ac9aa

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
163KB

MD5
9d11132ee6ee856fe29ab549cf761fb8

SHA1
d3ad5756df230cad91ef1a530c45c6043deac6e8

SHA256
5e398ed9264751f18dac7a37777561a7029890bc306262c6257bab188b3c121a

SHA512
24170ac95a9bfaa41152bbfc900d684128f01a986ecc52f48665fc12560289f69b24be4d0d1fb5482bb216acd36a548280ff064191648996bb28228e5ed91cba

Download Submit
memory/368-164-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/384-282-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/652-535-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/652-366-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/828-549-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/828-325-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/996-545-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1352-487-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1352-489-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1400-521-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1400-408-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1408-491-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1440-390-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1440-527-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1448-29-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1512-537-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1512-360-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1540-515-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1540-424-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1568-81-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1640-258-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1776-49-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2020-289-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2020-561-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2036-555-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2036-312-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2096-541-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2096-348-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2136-523-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2136-402-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2156-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/2176-156-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2184-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2240-118-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2252-513-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2580-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2604-244-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2608-505-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2620-557-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2620-301-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2752-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2752-313-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2876-342-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2876-543-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2888-265-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3036-73-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3144-495-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-295-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3176-559-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3248-519-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3452-228-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3696-378-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3696-531-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3704-102-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3732-497-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3784-277-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3788-529-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3788-384-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3872-525-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3872-396-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3928-141-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3972-517-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4040-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-539-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4112-354-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4116-70-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4172-509-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4252-319-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4252-551-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4320-493-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4396-236-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4420-196-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4440-172-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4448-271-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-456-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4460-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4500-511-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4596-502-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4608-220-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4676-500-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4692-331-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4692-547-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4780-45-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4800-33-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4816-188-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4840-126-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4880-180-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4896-17-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4960-372-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4960-533-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4984-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-445-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5044-507-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5056-212-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5060-204-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads