berbew | 62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85

Analysis

max time kernel
124s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe
Size

77KB
MD5

3d82a607cf1e91e7a3f418016b2d25e0
SHA1

993c72faacaaa9bd302c8188f131b12cc0712b5b
SHA256

62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85
SHA512

03f1b0d1214db6655cbebd7b769559d95c7f87b411341a39b645e8ee58f73e1427ab35f90debf014f6699ad4064c113a7638d0476a1e9a704f1c42cdd2577541
SSDEEP

1536:Q36bwHc+ooO+v39YcttnOw5OaGSQn3lDfgt:Q3DH9htYyHstYt

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gndbie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Keceoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkbkmqed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhmafcnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lklnconj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gndbie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iabglnco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ihaidhgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeolckne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkegbpca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khkdad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gjcmngnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjihfbno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggjjlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldfoad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjcmngnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihaidhgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbppgona.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjdokb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ijiopd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igmoih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibgmaqfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jddiegbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khkdad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gqpapacd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhbbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kblpcndd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lacijjgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdgdeppb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjficg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iagqgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idhiii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnhkdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcqjal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkafdco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Janghmia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jddiegbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hepgkohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hebcao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibgmaqfl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4372	Gdgdeppb.exe
3132	Gjcmngnj.exe
2296	Gqnejaff.exe
3384	Gdiakp32.exe
1608	Gjficg32.exe
3268	Gqpapacd.exe
2792	Ggjjlk32.exe
1164	Gndbie32.exe
216	Gcqjal32.exe
4804	Gkhbbi32.exe
4160	Hepgkohh.exe
1792	Hgocgjgk.exe
668	Hnhkdd32.exe
3948	Hebcao32.exe
3312	Hkmlnimb.exe
4744	Ijiopd32.exe
3472	Iabglnco.exe
2632	Igmoih32.exe
3124	Infhebbh.exe
1360	Iaedanal.exe
4960	Ijmhkchl.exe
4784	Iagqgn32.exe
3140	Ihaidhgf.exe
3048	Ibgmaqfl.exe
4688	Idhiii32.exe
4928	Iloajfml.exe
2424	Jbijgp32.exe
1556	Jaljbmkd.exe
64	Jjdokb32.exe
4188	Janghmia.exe
2756	Jjgkab32.exe
2692	Jaqcnl32.exe
1580	Jjihfbno.exe
2520	Jbppgona.exe
3028	Jeolckne.exe
1684	Jhmhpfmi.exe
4316	Jjkdlall.exe
2808	Jaemilci.exe
3956	Jddiegbm.exe
1852	Jlkafdco.exe
2664	Kbeibo32.exe
456	Keceoj32.exe
4552	Khabke32.exe
2532	Klmnkdal.exe
2652	Koljgppp.exe
2256	Kajfdk32.exe
3144	Khdoqefq.exe
3228	Kkbkmqed.exe
4628	Kalcik32.exe
2864	Kdkoef32.exe
3276	Kkegbpca.exe
5092	Kblpcndd.exe
2964	Kdmlkfjb.exe
3532	Khihld32.exe
1148	Kocphojh.exe
2724	Kemhei32.exe
3648	Khkdad32.exe
2956	Loemnnhe.exe
3348	Lacijjgi.exe
4968	Lhmafcnf.exe
3892	Lklnconj.exe
4748	Lbcedmnl.exe
1236	Lddble32.exe
1800	Llkjmb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ggjjlk32.exe	Gqpapacd.exe
File created	C:\Windows\SysWOW64\Kjekja32.dll	Hepgkohh.exe
File created	C:\Windows\SysWOW64\Lqcnhf32.dll	Hkmlnimb.exe
File created	C:\Windows\SysWOW64\Khabke32.exe	Keceoj32.exe
File created	C:\Windows\SysWOW64\Bkclkjqn.dll	Lbcedmnl.exe
File created	C:\Windows\SysWOW64\Gdiakp32.exe	Gqnejaff.exe
File opened for modification	C:\Windows\SysWOW64\Gkhbbi32.exe	Gcqjal32.exe
File created	C:\Windows\SysWOW64\Iloajfml.exe	Idhiii32.exe
File created	C:\Windows\SysWOW64\Kdkoef32.exe	Kalcik32.exe
File created	C:\Windows\SysWOW64\Lacijjgi.exe	Loemnnhe.exe
File created	C:\Windows\SysWOW64\Ldikgdpe.exe	Lbhool32.exe
File created	C:\Windows\SysWOW64\Ilcaoaif.dll	Hgocgjgk.exe
File opened for modification	C:\Windows\SysWOW64\Jjkdlall.exe	Jhmhpfmi.exe
File created	C:\Windows\SysWOW64\Khecje32.dll	Keceoj32.exe
File created	C:\Windows\SysWOW64\Kajfdk32.exe	Koljgppp.exe
File opened for modification	C:\Windows\SysWOW64\Kalcik32.exe	Kkbkmqed.exe
File created	C:\Windows\SysWOW64\Bkjbah32.dll	Khihld32.exe
File created	C:\Windows\SysWOW64\Lklnconj.exe	Lhmafcnf.exe
File created	C:\Windows\SysWOW64\Fhjaco32.dll	Lolcnman.exe
File opened for modification	C:\Windows\SysWOW64\Jbijgp32.exe	Iloajfml.exe
File opened for modification	C:\Windows\SysWOW64\Jeolckne.exe	Jbppgona.exe
File created	C:\Windows\SysWOW64\Hmijcp32.dll	Jlkafdco.exe
File opened for modification	C:\Windows\SysWOW64\Keceoj32.exe	Kbeibo32.exe
File created	C:\Windows\SysWOW64\Fncnpk32.dll	Khabke32.exe
File created	C:\Windows\SysWOW64\Ehilac32.dll	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Gcqjal32.exe	Gndbie32.exe
File created	C:\Windows\SysWOW64\Ijmhkchl.exe	Iaedanal.exe
File created	C:\Windows\SysWOW64\Kknikplo.dll	Iagqgn32.exe
File created	C:\Windows\SysWOW64\Gpmmbfem.dll	Idhiii32.exe
File created	C:\Windows\SysWOW64\Hbhgkfkg.dll	Kbeibo32.exe
File created	C:\Windows\SysWOW64\Kkbkmqed.exe	Khdoqefq.exe
File opened for modification	C:\Windows\SysWOW64\Khihld32.exe	Kdmlkfjb.exe
File created	C:\Windows\SysWOW64\Mnfooh32.dll	Llkjmb32.exe
File created	C:\Windows\SysWOW64\Jbhkbjdi.dll	Gndbie32.exe
File opened for modification	C:\Windows\SysWOW64\Jjdokb32.exe	Jaljbmkd.exe
File opened for modification	C:\Windows\SysWOW64\Kdmlkfjb.exe	Kblpcndd.exe
File opened for modification	C:\Windows\SysWOW64\Kemhei32.exe	Kocphojh.exe
File created	C:\Windows\SysWOW64\Oofial32.dll	Llngbabj.exe
File created	C:\Windows\SysWOW64\Lbhool32.exe	Lolcnman.exe
File created	C:\Windows\SysWOW64\Ckfaapfi.dll	Gjcmngnj.exe
File created	C:\Windows\SysWOW64\Eopbppjf.dll	Iaedanal.exe
File created	C:\Windows\SysWOW64\Oacmli32.dll	Klmnkdal.exe
File opened for modification	C:\Windows\SysWOW64\Kblpcndd.exe	Kkegbpca.exe
File created	C:\Windows\SysWOW64\Kocphojh.exe	Khihld32.exe
File opened for modification	C:\Windows\SysWOW64\Ldikgdpe.exe	Lbhool32.exe
File opened for modification	C:\Windows\SysWOW64\Hgocgjgk.exe	Hepgkohh.exe
File created	C:\Windows\SysWOW64\Infhebbh.exe	Igmoih32.exe
File created	C:\Windows\SysWOW64\Icajjnkn.dll	Ibgmaqfl.exe
File created	C:\Windows\SysWOW64\Dodipp32.dll	Jbppgona.exe
File created	C:\Windows\SysWOW64\Bfdkqcmb.dll	Kocphojh.exe
File created	C:\Windows\SysWOW64\Lhmafcnf.exe	Lacijjgi.exe
File created	C:\Windows\SysWOW64\Lddble32.exe	Lbcedmnl.exe
File created	C:\Windows\SysWOW64\Iaedanal.exe	Infhebbh.exe
File created	C:\Windows\SysWOW64\Jeolckne.exe	Jbppgona.exe
File created	C:\Windows\SysWOW64\Jlkafdco.exe	Jddiegbm.exe
File created	C:\Windows\SysWOW64\Kblpcndd.exe	Kkegbpca.exe
File opened for modification	C:\Windows\SysWOW64\Khkdad32.exe	Kemhei32.exe
File opened for modification	C:\Windows\SysWOW64\Iloajfml.exe	Idhiii32.exe
File created	C:\Windows\SysWOW64\Jbppgona.exe	Jjihfbno.exe
File created	C:\Windows\SysWOW64\Khdoqefq.exe	Kajfdk32.exe
File opened for modification	C:\Windows\SysWOW64\Loemnnhe.exe	Khkdad32.exe
File opened for modification	C:\Windows\SysWOW64\Lolcnman.exe	Llngbabj.exe
File created	C:\Windows\SysWOW64\Hnhkdd32.exe	Hgocgjgk.exe
File opened for modification	C:\Windows\SysWOW64\Hebcao32.exe	Hnhkdd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2252	WerFault.exe	158

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldikgdpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqpapacd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeolckne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klmnkdal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdkoef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lddble32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldfoad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdiakp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hgocgjgk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjkdlall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kalcik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jddiegbm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khihld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llkjmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbhool32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdgdeppb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkhbbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hebcao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iagqgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbppgona.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbeibo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjficg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igmoih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Infhebbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Janghmia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacijjgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lklnconj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khdoqefq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbebilli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gndbie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijmhkchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjgkab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbcedmnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaqcnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khabke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblpcndd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khkdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iaedanal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaemilci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcqjal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbijgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkmlnimb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjihfbno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kocphojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lolcnman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kajfdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkegbpca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gqnejaff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iloajfml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlkafdco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Koljgppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Idhiii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggjjlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnhkdd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iabglnco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loemnnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hepgkohh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaljbmkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkbkmqed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdmlkfjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjihfbno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcmnee32.dll"	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqhomdeb.dll"	Lacijjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkhbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjcnl32.dll"	Hnhkdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iaedanal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jeolckne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kajfdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lklnconj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmgglf32.dll"	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaqcco32.dll"	Jaqcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Loemnnhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gqpapacd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clhgbgki.dll"	Gqpapacd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkhbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jjihfbno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehilac32.dll"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okahhpqj.dll"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfdcpb32.dll"	Ggjjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gndbie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hepgkohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jddiegbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khkdad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lbcedmnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lolcnman.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Backedki.dll"	Gqnejaff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gjficg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jaljbmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijaaij32.dll"	Jjkdlall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdkoef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkcnp32.dll"	Kblpcndd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hgocgjgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkmlnimb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jhmhpfmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Khdoqefq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oofial32.dll"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llngbabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kknikplo.dll"	Iagqgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboleq32.dll"	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbojb32.dll"	Kdkoef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gqpapacd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gndbie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghikqj32.dll"	Iabglnco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbijgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjdokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdkqcmb.dll"	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lacijjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdinng32.dll"	Gjficg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kalcik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khihld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lhmafcnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkclkjqn.dll"	Lbcedmnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Janghmia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjmannfj.dll"	Jhmhpfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdkoef32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 4372	1100	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe	87
PID 1100 wrote to memory of 4372	1100	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe	87
PID 1100 wrote to memory of 4372	1100	62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe	87
PID 4372 wrote to memory of 3132	4372	Gdgdeppb.exe	88
PID 4372 wrote to memory of 3132	4372	Gdgdeppb.exe	88
PID 4372 wrote to memory of 3132	4372	Gdgdeppb.exe	88
PID 3132 wrote to memory of 2296	3132	Gjcmngnj.exe	89
PID 3132 wrote to memory of 2296	3132	Gjcmngnj.exe	89
PID 3132 wrote to memory of 2296	3132	Gjcmngnj.exe	89
PID 2296 wrote to memory of 3384	2296	Gqnejaff.exe	90
PID 2296 wrote to memory of 3384	2296	Gqnejaff.exe	90
PID 2296 wrote to memory of 3384	2296	Gqnejaff.exe	90
PID 3384 wrote to memory of 1608	3384	Gdiakp32.exe	91
PID 3384 wrote to memory of 1608	3384	Gdiakp32.exe	91
PID 3384 wrote to memory of 1608	3384	Gdiakp32.exe	91
PID 1608 wrote to memory of 3268	1608	Gjficg32.exe	92
PID 1608 wrote to memory of 3268	1608	Gjficg32.exe	92
PID 1608 wrote to memory of 3268	1608	Gjficg32.exe	92
PID 3268 wrote to memory of 2792	3268	Gqpapacd.exe	93
PID 3268 wrote to memory of 2792	3268	Gqpapacd.exe	93
PID 3268 wrote to memory of 2792	3268	Gqpapacd.exe	93
PID 2792 wrote to memory of 1164	2792	Ggjjlk32.exe	94
PID 2792 wrote to memory of 1164	2792	Ggjjlk32.exe	94
PID 2792 wrote to memory of 1164	2792	Ggjjlk32.exe	94
PID 1164 wrote to memory of 216	1164	Gndbie32.exe	95
PID 1164 wrote to memory of 216	1164	Gndbie32.exe	95
PID 1164 wrote to memory of 216	1164	Gndbie32.exe	95
PID 216 wrote to memory of 4804	216	Gcqjal32.exe	96
PID 216 wrote to memory of 4804	216	Gcqjal32.exe	96
PID 216 wrote to memory of 4804	216	Gcqjal32.exe	96
PID 4804 wrote to memory of 4160	4804	Gkhbbi32.exe	97
PID 4804 wrote to memory of 4160	4804	Gkhbbi32.exe	97
PID 4804 wrote to memory of 4160	4804	Gkhbbi32.exe	97
PID 4160 wrote to memory of 1792	4160	Hepgkohh.exe	98
PID 4160 wrote to memory of 1792	4160	Hepgkohh.exe	98
PID 4160 wrote to memory of 1792	4160	Hepgkohh.exe	98
PID 1792 wrote to memory of 668	1792	Hgocgjgk.exe	99
PID 1792 wrote to memory of 668	1792	Hgocgjgk.exe	99
PID 1792 wrote to memory of 668	1792	Hgocgjgk.exe	99
PID 668 wrote to memory of 3948	668	Hnhkdd32.exe	100
PID 668 wrote to memory of 3948	668	Hnhkdd32.exe	100
PID 668 wrote to memory of 3948	668	Hnhkdd32.exe	100
PID 3948 wrote to memory of 3312	3948	Hebcao32.exe	101
PID 3948 wrote to memory of 3312	3948	Hebcao32.exe	101
PID 3948 wrote to memory of 3312	3948	Hebcao32.exe	101
PID 3312 wrote to memory of 4744	3312	Hkmlnimb.exe	102
PID 3312 wrote to memory of 4744	3312	Hkmlnimb.exe	102
PID 3312 wrote to memory of 4744	3312	Hkmlnimb.exe	102
PID 4744 wrote to memory of 3472	4744	Ijiopd32.exe	103
PID 4744 wrote to memory of 3472	4744	Ijiopd32.exe	103
PID 4744 wrote to memory of 3472	4744	Ijiopd32.exe	103
PID 3472 wrote to memory of 2632	3472	Iabglnco.exe	104
PID 3472 wrote to memory of 2632	3472	Iabglnco.exe	104
PID 3472 wrote to memory of 2632	3472	Iabglnco.exe	104
PID 2632 wrote to memory of 3124	2632	Igmoih32.exe	105
PID 2632 wrote to memory of 3124	2632	Igmoih32.exe	105
PID 2632 wrote to memory of 3124	2632	Igmoih32.exe	105
PID 3124 wrote to memory of 1360	3124	Infhebbh.exe	106
PID 3124 wrote to memory of 1360	3124	Infhebbh.exe	106
PID 3124 wrote to memory of 1360	3124	Infhebbh.exe	106
PID 1360 wrote to memory of 4960	1360	Iaedanal.exe	108
PID 1360 wrote to memory of 4960	1360	Iaedanal.exe	108
PID 1360 wrote to memory of 4960	1360	Iaedanal.exe	108
PID 4960 wrote to memory of 4784	4960	Ijmhkchl.exe	109

C:\Users\Admin\AppData\Local\Temp\62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe
"C:\Users\Admin\AppData\Local\Temp\62453a92827de63e0d601ca1bc555fcfaa0d366f8c77d4d7ab9f29665b796b85.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\Gdgdeppb.exe
  C:\Windows\system32\Gdgdeppb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\Gjcmngnj.exe
    C:\Windows\system32\Gjcmngnj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\SysWOW64\Gqnejaff.exe
      C:\Windows\system32\Gqnejaff.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3124
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4784
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4928
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Janghmia.exe
        
        C:\Windows\system32\Janghmia.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2756
        
        C:\Windows\SysWOW64\Jaqcnl32.exe
        
        C:\Windows\system32\Jaqcnl32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\Jddiegbm.exe
        
        C:\Windows\system32\Jddiegbm.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2256
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3228
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2956
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3348
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2096
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 412
        72⤵
        Program crash
        
        PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2252 -ip 2252
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Emjnfn32.dll

Filesize
7KB

MD5
36f362a26ced9caaeff0a97e97a311ee

SHA1
f787f6dc42e4693697b635eff85907f3df30d5e9

SHA256
f3584d7aaaabad26711bd8603072d76fc462fb81d1bf18ab34af61e0763447db

SHA512
b361a39fc4043bfe911eab68cf15fb6ccad30d3b07524d5886b498fe5619e4516aec55af8172dc81e15591f86b8f69ad5455c587a595998f5a1bad265c41a2df

Download Submit
C:\Windows\SysWOW64\Gcqjal32.exe

Filesize
77KB

MD5
a119cccdfdc33350b2be9da0fc266fad

SHA1
d21523259ccda6e180db665eb061e7fa87e3da18

SHA256
2bd826d4ebe761bbb872bc04f723f8d92b3b0d5f3e030f003a0f5aa91393a809

SHA512
4433266e47d01758edc39c1d18bbfa652be3792a5658ab1c2743629799f48d75aaa706dbe92f4058712bd3d46255c85b395157966b60725d393ffb52e7d22fad

Download Submit
C:\Windows\SysWOW64\Gdgdeppb.exe

Filesize
77KB

MD5
c812efeb5d2f7d7fe6a859afa2c29f9f

SHA1
fa3c35d5e66f68c1df0304f1e95368258855791b

SHA256
fcbaca6dc5ece4d4246f9140a5f8210bf5a56a3a7254b0d6015a8e46308db05a

SHA512
966b359164e4ed6cbfe7f6470fbd1b3d810b18694623ad6e2ec6972d1d9bf002e2d373d2b7f3b4d845903ac256291a8c0a31cbf62f4558d6051b142c898b0bd1

Download Submit
C:\Windows\SysWOW64\Gdiakp32.exe

Filesize
77KB

MD5
05213bfce73b8af05e4e7a1393cd84b2

SHA1
17825e2543ac32ffef4a0c95a864580d88a2f252

SHA256
721271ad6ecae138998ad4f8c7f99dabc292bf81460942a39f4057f9ff6ef67b

SHA512
7f028bf7bb3af3982cfc9e764bef92ef85fb7ba10ffbe00823b2a8a8047428f04d3dd379fc4a1756f2d0b162df85f38e0acadb8929985ffc8f52ad91ef1fe57c

Download Submit
C:\Windows\SysWOW64\Ggjjlk32.exe

Filesize
77KB

MD5
9c48849d646be9afeca824c578001b74

SHA1
eb7de4709e412b90ba9852d5d8fc3833ff87f6cd

SHA256
d8bce6973e08fa3e46db009c50f05f417222fa155690e054267ab241ea8b5146

SHA512
c6e966a88264cc94ec100bbbefbf5cb2b1ffd2b4c3e25af34b9f5be7f5dfa4cb7b9d3116b56e648d28f32d29b5a0a389bf610031e05acddee6679510159f4bff

Download Submit
C:\Windows\SysWOW64\Gjcmngnj.exe

Filesize
77KB

MD5
4b32b565f9f431022546c6d6ecc6307b

SHA1
d9c6b5a0872977ba9eac6aa612a382620841568a

SHA256
fe9eb498e3d3adf721e4d65ddc77360b3c5ab92a407711dbdc08247f12416b29

SHA512
fa716632500e91ff051e321fbab247e8db74b252f7b6108e7320a30308b124a108b26c0b5b52db02ec9e6c552adb89f7c348fdabd1a1e6eedfb2a8608051e3e7

Download Submit
C:\Windows\SysWOW64\Gjficg32.exe

Filesize
77KB

MD5
df86962dea623c14d3befdf48da555c2

SHA1
00636c8b6ca07e8d27ca1110b35c28e7a5466bcc

SHA256
31b6f7e3165345bf28f32c2486013cb911c55522019a703c0a8ed451dd6c182f

SHA512
cdb6fe51f6b2218396c58e8397a82e038653d6d829aca7be6b2acb50a50d2a60aba99388c0b6f8c4bb70f202c0bdb75435a69f9f744dfe77607e77345994fb8d

Download Submit
C:\Windows\SysWOW64\Gkhbbi32.exe

Filesize
77KB

MD5
318806f56bed27958ad6c78f91729430

SHA1
7129ca29035e24082e78f60264b5bdc48e2960d6

SHA256
d99807aafb5bea90dcb5481dc99d0e5586e34a31afd803e92fbf5e84ae2033f8

SHA512
961e79ca147c3f30dab8e616a7267622d1c3ec427236fad8889d25d8f0823e77c394dab93bee30724b28898dff7311c28d9a25d7ee3a3e6fe95b639dcec844ed

Download Submit
C:\Windows\SysWOW64\Gndbie32.exe

Filesize
77KB

MD5
aac222b6150d85a60f215644ff992712

SHA1
b97eece0a8f3e7702be3a7432d6ab2bae7649581

SHA256
4cd842b05e39b0b1cb928d305ad4e75dd859495975fdd2eaff5d741139c5cd76

SHA512
5726173c4e24122f7bb884b965b6f8a55cd19a2e13a7247834b4f9e503908bab1415beb17908b713e1b7c7a189547a1a28a539121f24c9fc28d120af2cf3c0c1

Download Submit
C:\Windows\SysWOW64\Gqnejaff.exe

Filesize
77KB

MD5
3480bcf0369d9638588a3b52eb02724b

SHA1
3e631595827071e462d194506d0ad9e882fb41d1

SHA256
20f7ec7d5a4e46de3b3b58e415cea8f50fb5f835099495a54e0672c63f806b7d

SHA512
e6c71447fc6e48382ed5d62480bf2db5943ed78a8a856da8bbe329dc6cb378d0b9e2095ad3719e71c3499726ef919ac64619d8a7c71ca571e1ecf9154e981093

Download Submit
C:\Windows\SysWOW64\Gqpapacd.exe

Filesize
77KB

MD5
bf552071cade7e9e48b0030873f977a3

SHA1
a1c5d1fd674fc35691f12acae2d878e29130b403

SHA256
ddb0b9b85201581b77c82095588ac3b6b4a60a93b48900cff0cc84cf88e13948

SHA512
cf4bd74f00f904c4122669044132395cc6e5786483a8cd53b5b71db158a2b5fc1722d12dfef149dd37b10bd6585130ac314817d43cffb9acfbdd15c52526964d

Download Submit
C:\Windows\SysWOW64\Hebcao32.exe

Filesize
77KB

MD5
3fc27ecbbdf28b6fdf435bf41ee57748

SHA1
df8a385dce795d7126a7f0a830916545f02f74ae

SHA256
8c1a473890f49783e84aa2fb01f1affe527041e740ec2cc17eef250d7c3ba9b8

SHA512
bb9a5f99241b431510a9f17942e7331cb33bbac36765608b112f49801e9d348d5ccdfe1b02b1d331af0a0f15873838ffef9518f0b1589e4c08b556bf794adc9e

Download Submit
C:\Windows\SysWOW64\Hepgkohh.exe

Filesize
77KB

MD5
7c7d1838c8b85cb0f5ab1689f5aa9954

SHA1
466b4b821fb4c1249f75a2fdbb0b5400ed07c25f

SHA256
1d3841ee799cade74b4ebbeecf60987b5c3e9560249dfdab614622ff25402b80

SHA512
8f167173cf2b9c507a8e1fb4aea2116268e5cf6ee082c6020aa7e837e4a2b2ca78a617cf210a5b7843dc170abc0128c433aa4ae23528d716d66c99cf440ce769

Download Submit
C:\Windows\SysWOW64\Hgocgjgk.exe

Filesize
77KB

MD5
436aca45945e964df715695356aae626

SHA1
293005917b9e331f01a48cdc5579fe523d2bc32f

SHA256
60ce9c7525d2d51252af84fa26c97808bdd445b657468d8cf9464ef42956e1cf

SHA512
90d97c63e7453862f73992a4a09b735ade118ae95de5407e31d700ce121c16cb899396fcd06008bce8c2428e5d8e85cb8ffea7127dac53bde742b286d338937e

Download Submit
C:\Windows\SysWOW64\Hkmlnimb.exe

Filesize
77KB

MD5
c7755942523427ab7ff958cf8921cbf1

SHA1
60a9e29744cbe85b6b912aff9c437056587248fa

SHA256
04d6af4ba7460fa84a01def8813e958f15c49968eb209d0bf72254c967853d88

SHA512
8658c88e0cd6bc8aeaa977e145cdb7786d0f6fa5c84547f6cdfcd5acf6c6d4cd797c48960a097b648b5f1034728e0bd1a6141d810e918a1e33cbb35ce1e6edb2

Download Submit
C:\Windows\SysWOW64\Hnhkdd32.exe

Filesize
77KB

MD5
8ad5979f065540b7bdbcef6b46e914a6

SHA1
9fcaff0c34e24760c3e201dd39f23b7042c7a4bd

SHA256
55e97d374f1e586e1da21eaf50f0a08a1f280b28b5f373c9166e0aab1cfdae89

SHA512
4487131bfd8a2293bd79cf1308b3cca95c857c340f82724b05febdf4f49a453c9cc4c6089c6870369c4f86864ae4efe8d5fcfb1e47642912077c3bc26e1468d5

Download Submit
C:\Windows\SysWOW64\Iabglnco.exe

Filesize
77KB

MD5
074966efd188cf2eaf414ce63c2d860a

SHA1
5051ff2fdbf0ce2b4cd70cf1b70024b70629401b

SHA256
5f586c1bdfac23edaa22b931db202a04d8c7e4057da143ab924988ebc42f4d44

SHA512
45f64990b6bbeef4ccc1637dfc0c56c1072a67f334116aeea36de36a05720db688d5109a730eeec5fcec43fc9a6e842b4b7975f951d5dbc2a37ea8e844ff90e1

Download Submit
C:\Windows\SysWOW64\Iaedanal.exe

Filesize
77KB

MD5
a1a781382d8d3f30668e000ad6522a5c

SHA1
8b5fe086e886591a2af7a13b954f4ef13ec508aa

SHA256
8aeb1ca5addf56cebd6d0fb38aa9824d02dbbca8a4803ea1bc7e9eb14b724507

SHA512
00fe4c475ff41bc339ca733fdcb8efce1408ec59422d10b66492ff3fee92b82ea9bfd94798f39bede8c8d2efc01b694f65412ec5e5f47281c812917ace85aeaf

Download Submit
C:\Windows\SysWOW64\Iagqgn32.exe

Filesize
77KB

MD5
b696a1cccdce4e6c8c51e723df0dbaa7

SHA1
4a82cdc1951548e6568630e4a2164f414ce6d6a1

SHA256
90f40f0973f3dbd6482229b0ebbe88597f19f87d2a5c3fa1990e79d58678992c

SHA512
af00a6159dcff9185df28a7f447abcf198dd3fb275d7859597a0959706d49c7315877fa0760fc4b8bcd4fdcefd365271e9af083f5bbd04adb79f5ef2970ac2bc

Download Submit
C:\Windows\SysWOW64\Ibgmaqfl.exe

Filesize
77KB

MD5
016350ddb1d259cec6a8406768ef3d80

SHA1
6e2e59bf179c9a1ef5a410cc0d43c76571e74880

SHA256
217d17dd7b3dbad482800e1fd2f843310f11cdbd4bc059e9908c10bed9bff4df

SHA512
6db0b6a156d9a66b4988623311d74e91f55beb44a2c45751b6426410ba206c97e04254f1a7af44aad2d49e0a718624b8cb67bfc6b9375c5fb733616375df3777

Download Submit
C:\Windows\SysWOW64\Idhiii32.exe

Filesize
77KB

MD5
1703fca00d5fdd8093d13583ba543432

SHA1
071876787a27b6f3c00ee425d82ad4651509d0cf

SHA256
ca70fb50a6fc085aebb39fa844433a4e11cc78d1bb2b9cd7aabe2d0e1810c96d

SHA512
c97d1216d4bf51e69bc3c9c8755cea9e6e591675d76cb04582df5afe699e1d9b5e939225ca6ef669eb01ce8cedb549ad1e77cce6ac36601fafef5960015c769a

Download Submit
C:\Windows\SysWOW64\Igmoih32.exe

Filesize
77KB

MD5
974a9005394d3c7ebba169b9ae157124

SHA1
9ec5f57aedd24edb6197ad9a50b68f18da6f6b4a

SHA256
4056ebb445b90fce762308a9b81b49123533835f064bbc849e37ba4142a51c4a

SHA512
296f306bfd87d86b763f46e667e068c151913d5edbe96d6f4145e0bec0ff196213a689b66cea88223d9645184b8f7e40e6546a258d677311ace5b6786593b710

Download Submit
C:\Windows\SysWOW64\Ihaidhgf.exe

Filesize
77KB

MD5
9e7eec7d6b18f2dc1fbef56b5e8a38e4

SHA1
60bd26becf6ef46379bfd5a56e94007bc75c3b22

SHA256
f586c923d7e8fc1eb2340d46cf8dbf473882776ebef22f03ae770280c5baa2b8

SHA512
10a83ae58754410706f5172180db49255c5d383a159424813c6c81acb3bc400f1e133d2e294e3d1e3bea325ce0269be829fcddd4e7e5a9e627eea48cb4eaad91

Download Submit
C:\Windows\SysWOW64\Ijiopd32.exe

Filesize
77KB

MD5
2f7cf86202be952a4cf8a87e82a96348

SHA1
f9e9724c140f7cc6abffa92e53016a7543e00c77

SHA256
8ea3824d0304ae5042858e040b49beb320882e7a2bf97a08d9e43ea9a60a386a

SHA512
f72811ff63d452afeb540de105c3556c9e5e215caa5b8a26bc404971e4ff3eea3c49a980a440bc0174ab8f162cdcfff1cb4602720e28d97d6a60f6763726462a

Download Submit
C:\Windows\SysWOW64\Ijmhkchl.exe

Filesize
77KB

MD5
8feff6df4f0b7372c33ff48a726c7720

SHA1
0e0d6b42ea34daac21d03c0d2ca40255a0ab8f39

SHA256
a3599155b6f3362622cfdee6b2c5610ad1130f17e358cfd0ff453d5a025c451d

SHA512
7f2a9c7c59512d081549734e0d230b694bd11c566daa65719f1bbecb61e701a7d855a67e9b9a1ec1adbf22c97e2a079a7a678bf80b7b063e9f32a733d9de9997

Download Submit
C:\Windows\SysWOW64\Iloajfml.exe

Filesize
77KB

MD5
b68253c199925155a6367a1018fe4bfc

SHA1
d487a84d720ff9bdf4ebc03af70067ddd0933818

SHA256
3d1217028c18ea578d8549a7622fd7e7a18812f386ec851a08627c611bd1ecff

SHA512
e1f4ae868c19de4f5a1a16c099072c07bc63d723eec4722ac132c60fecb22701173381470f73d2b26a545de93be6b02b3cdaba2b93dc06f9f21a7323559ba6aa

Download Submit
C:\Windows\SysWOW64\Infhebbh.exe

Filesize
77KB

MD5
16c780f409a6f2b20934f33074cdd062

SHA1
b244a41f94053daa638974a848554cbbb5ccdc76

SHA256
b4164aa6dc68a162a364017aade8338acbd53066eb2062b334df77b907983097

SHA512
f61b291473ae2ad8432b73a913bba68d93e35303f9ae3d1e3808aa483bbb1894e353c47c469a7b16ac0ac93a3fa2172ca2714c6f9c582a3eb4752b1094772b58

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
77KB

MD5
791474febf127d5298787e257cbd5f4a

SHA1
257b9a212574a0d633a31895228972fa4bb96a25

SHA256
d3add4b562eb2d2bb27f589b2a0c3549536c6728ddb2af43c8073f34d1737da1

SHA512
23c4d65a24222278e505939f3687b281da28245bf70eaec8fa1ceb2a70a899c6f45a1e098c3a6187a39576bf6131a5a229bf2b657cb209fc8403e017c22581cd

Download Submit
C:\Windows\SysWOW64\Janghmia.exe

Filesize
77KB

MD5
736c5ab34556db582ce83d2d168e7db9

SHA1
bbcb9f043aecd8f2ada70ed662c54f2dad6291ff

SHA256
5b606005dbf65cf08bdd6709e4f6c838108127e7e5f21b8cba2da983cc47eac3

SHA512
e7a3755a3dabae912c5f1c525da86e6bd2e46df7d42afbf8e981e87db8ffe2cda958467d3b698ab3d6ebba24c9427591503dd81a60b0ad6c81ebe0647830f46f

Download Submit
C:\Windows\SysWOW64\Jaqcnl32.exe

Filesize
77KB

MD5
3138e165d8c51167b47156e46c1643c8

SHA1
6160edf7752c7cde634ae2d1112e2a4c34a10371

SHA256
50ad8c4956eca89439c3e859adb75e084f4e6df2cd9b63be73bfb4b1f8c88859

SHA512
9b416b901c70dcf7d740882751994086f9970dcdf2d43473c6e6f3adb725bc59c5139e0d98a6ce6eadb34acbb11135e55225df665da0f832ab9d45d9f9b4ba91

Download Submit
C:\Windows\SysWOW64\Jbijgp32.exe

Filesize
77KB

MD5
3b15b0bb667d3cc7306b9123f32147b9

SHA1
948c54ebdc8c9f191715b7d977ab80b99ef7b2e4

SHA256
086935e0555d01cd6b0bd6a3da1163187e06b87173451b2b39b6d2872bfabe7d

SHA512
ef3674976495a0b9bc0995ba2f232b3955837da56760c6d392a5bf52932977a8c55265798f7ea3194fe9106b1d21a22d6ca7e5fcea20d3234706cd1fbe84e9c9

Download Submit
C:\Windows\SysWOW64\Jjdokb32.exe

Filesize
77KB

MD5
f95c8d6fa464b0c598503dc0d766a6ad

SHA1
d126e1897d745cb6a6af8d351100706f968b1ce9

SHA256
6286fc5a45d3588e36b5630e3215583717e4fb259b6e64ca8bbfef41b625e52e

SHA512
72b2cd52e05804ab744bb35ddca489738f45bea53c6a31e7385d8e56a6dd1c07c139815ff439f905a7215e6af164bbe7eba84b9057f4fb38b9d72450f05bbefa

Download Submit
C:\Windows\SysWOW64\Jjgkab32.exe

Filesize
77KB

MD5
14fe429d312680597ef09d6fb2330b1d

SHA1
beb8a6497abe5e203bb5619ac19f7a6d7960ca65

SHA256
f429da2572b933bb939b59a34013b156e1b6400dd4e64828f39ca82222ed0b64

SHA512
e323068a38977b7220d846c04ab908fae12f215f92bc694289293283022a9b14e6853958f67dc1148e015d0dd78218118afefb377b3cdd6430126013ead5a54f

Download Submit
memory/64-231-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/216-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/456-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/668-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1100-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1148-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1148-500-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1164-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1236-492-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1236-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1328-472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1328-487-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1360-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1556-223-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1580-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1684-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1792-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1800-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1800-491-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1852-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2096-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2096-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2252-486-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2252-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2256-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2256-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2296-28-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2424-216-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2532-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2632-144-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2652-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2664-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2692-255-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-499-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2756-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2792-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2808-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2856-466-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2856-489-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2864-505-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2864-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2956-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2956-497-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2964-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2964-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3028-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3048-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3124-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3132-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3140-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3144-508-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3144-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3228-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3228-507-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3268-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3276-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3276-504-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3312-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3348-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3384-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3472-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3532-501-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3532-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3648-498-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3648-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3892-494-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3892-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3948-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3956-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-485-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4160-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4188-239-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4316-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4372-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4468-488-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4468-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4552-327-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4628-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4628-506-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4688-199-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4744-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4748-493-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4748-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4784-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4804-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4928-207-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4960-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4968-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4968-495-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5092-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5092-503-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads