7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Size

467KB
MD5

f3a3695531196d74229de250db9a7093
SHA1

0dada84cae063b4c55c9970b55381572ebce8b70
SHA256

7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9
SHA512

8d802a9e52e09a7a56501cab095c80b9a334f6fd39043d4a4628a4926572b66e77ba3f951fe4891d762c4dfa859d3a259f07eaa1ad69d7033c493a169e6a2ced
SSDEEP

12288:C8A2o8wE39uW8wESByvNv54B9f01ZmHByvNv5:O2o8wDW8wQvr4B9f01ZmQvr

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe

Executes dropped EXE 27 IoCs

pid	Process
2516	Ajanck32.exe
4868	Ampkof32.exe
1948	Afjlnk32.exe
712	Aeklkchg.exe
932	Ajhddjfn.exe
2152	Aabmqd32.exe
4588	Anfmjhmd.exe
1096	Bagflcje.exe
1224	Bmngqdpj.exe
3744	Bmpcfdmg.exe
436	Bjddphlq.exe
1840	Bclhhnca.exe
1932	Belebq32.exe
2052	Cndikf32.exe
1572	Chmndlge.exe
2916	Caebma32.exe
3048	Cfbkeh32.exe
2964	Cjpckf32.exe
4880	Chcddk32.exe
756	Cffdpghg.exe
2456	Dopigd32.exe
4816	Dfknkg32.exe
3872	Delnin32.exe
5004	Dodbbdbb.exe
516	Dogogcpo.exe
3792	Doilmc32.exe
4720	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Bjddphlq.exe
File opened for modification	C:\Windows\SysWOW64\Chmndlge.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bagflcje.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Ampkof32.exe	Ajanck32.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Hhqeiena.dll	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cjpckf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	4720	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cacamdcd.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeobam32.dll"	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idnljnaa.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2516	316	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe	83
PID 316 wrote to memory of 2516	316	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe	83
PID 316 wrote to memory of 2516	316	7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe	83
PID 2516 wrote to memory of 4868	2516	Ajanck32.exe	84
PID 2516 wrote to memory of 4868	2516	Ajanck32.exe	84
PID 2516 wrote to memory of 4868	2516	Ajanck32.exe	84
PID 4868 wrote to memory of 1948	4868	Ampkof32.exe	85
PID 4868 wrote to memory of 1948	4868	Ampkof32.exe	85
PID 4868 wrote to memory of 1948	4868	Ampkof32.exe	85
PID 1948 wrote to memory of 712	1948	Afjlnk32.exe	86
PID 1948 wrote to memory of 712	1948	Afjlnk32.exe	86
PID 1948 wrote to memory of 712	1948	Afjlnk32.exe	86
PID 712 wrote to memory of 932	712	Aeklkchg.exe	87
PID 712 wrote to memory of 932	712	Aeklkchg.exe	87
PID 712 wrote to memory of 932	712	Aeklkchg.exe	87
PID 932 wrote to memory of 2152	932	Ajhddjfn.exe	88
PID 932 wrote to memory of 2152	932	Ajhddjfn.exe	88
PID 932 wrote to memory of 2152	932	Ajhddjfn.exe	88
PID 2152 wrote to memory of 4588	2152	Aabmqd32.exe	89
PID 2152 wrote to memory of 4588	2152	Aabmqd32.exe	89
PID 2152 wrote to memory of 4588	2152	Aabmqd32.exe	89
PID 4588 wrote to memory of 1096	4588	Anfmjhmd.exe	90
PID 4588 wrote to memory of 1096	4588	Anfmjhmd.exe	90
PID 4588 wrote to memory of 1096	4588	Anfmjhmd.exe	90
PID 1096 wrote to memory of 1224	1096	Bagflcje.exe	91
PID 1096 wrote to memory of 1224	1096	Bagflcje.exe	91
PID 1096 wrote to memory of 1224	1096	Bagflcje.exe	91
PID 1224 wrote to memory of 3744	1224	Bmngqdpj.exe	92
PID 1224 wrote to memory of 3744	1224	Bmngqdpj.exe	92
PID 1224 wrote to memory of 3744	1224	Bmngqdpj.exe	92
PID 3744 wrote to memory of 436	3744	Bmpcfdmg.exe	93
PID 3744 wrote to memory of 436	3744	Bmpcfdmg.exe	93
PID 3744 wrote to memory of 436	3744	Bmpcfdmg.exe	93
PID 436 wrote to memory of 1840	436	Bjddphlq.exe	94
PID 436 wrote to memory of 1840	436	Bjddphlq.exe	94
PID 436 wrote to memory of 1840	436	Bjddphlq.exe	94
PID 1840 wrote to memory of 1932	1840	Bclhhnca.exe	95
PID 1840 wrote to memory of 1932	1840	Bclhhnca.exe	95
PID 1840 wrote to memory of 1932	1840	Bclhhnca.exe	95
PID 1932 wrote to memory of 2052	1932	Belebq32.exe	97
PID 1932 wrote to memory of 2052	1932	Belebq32.exe	97
PID 1932 wrote to memory of 2052	1932	Belebq32.exe	97
PID 2052 wrote to memory of 1572	2052	Cndikf32.exe	99
PID 2052 wrote to memory of 1572	2052	Cndikf32.exe	99
PID 2052 wrote to memory of 1572	2052	Cndikf32.exe	99
PID 1572 wrote to memory of 2916	1572	Chmndlge.exe	100
PID 1572 wrote to memory of 2916	1572	Chmndlge.exe	100
PID 1572 wrote to memory of 2916	1572	Chmndlge.exe	100
PID 2916 wrote to memory of 3048	2916	Caebma32.exe	102
PID 2916 wrote to memory of 3048	2916	Caebma32.exe	102
PID 2916 wrote to memory of 3048	2916	Caebma32.exe	102
PID 3048 wrote to memory of 2964	3048	Cfbkeh32.exe	103
PID 3048 wrote to memory of 2964	3048	Cfbkeh32.exe	103
PID 3048 wrote to memory of 2964	3048	Cfbkeh32.exe	103
PID 2964 wrote to memory of 4880	2964	Cjpckf32.exe	104
PID 2964 wrote to memory of 4880	2964	Cjpckf32.exe	104
PID 2964 wrote to memory of 4880	2964	Cjpckf32.exe	104
PID 4880 wrote to memory of 756	4880	Chcddk32.exe	105
PID 4880 wrote to memory of 756	4880	Chcddk32.exe	105
PID 4880 wrote to memory of 756	4880	Chcddk32.exe	105
PID 756 wrote to memory of 2456	756	Cffdpghg.exe	106
PID 756 wrote to memory of 2456	756	Cffdpghg.exe	106
PID 756 wrote to memory of 2456	756	Cffdpghg.exe	106
PID 2456 wrote to memory of 4816	2456	Dopigd32.exe	107

C:\Users\Admin\AppData\Local\Temp\7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe
"C:\Users\Admin\AppData\Local\Temp\7d07f74301cdf2aea3826ce3d2414b294d252eace238bab3271f7d150bb0faf9.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:316
- C:\Windows\SysWOW64\Ajanck32.exe
  C:\Windows\system32\Ajanck32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\Ampkof32.exe
    C:\Windows\system32\Ampkof32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\SysWOW64\Afjlnk32.exe
      C:\Windows\system32\Afjlnk32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:516
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3792
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 408
        29⤵
        Program crash
        
        PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4720 -ip 4720
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
467KB

MD5
083c0938b9da954e7b04e071966af6ac

SHA1
01e1682fdab45a349ebedadc2fc203a74d6639d3

SHA256
07205937eb3e84712af3941bc95f8f208b1d3c8a9d8f80f9c99b6c836d5e6789

SHA512
46c2f91a5913b7dd44ed880dbe5fec5b446354ef7e742e18ac693eb00a43c38d00b6c2c00c8f0a51642e4d5872453dede6690a8b512b23294ff44041ef3c4eed

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
467KB

MD5
cfadfdd07fd8cdd5f07f21d38532ab1d

SHA1
f3a5af28382024971965de4a0f254b87c106c19a

SHA256
0a2d2a22c3416f99dfe1cea0af53abb9d9976ed9a06cff2e8a79541d67c3164f

SHA512
adb2448d70a502128fd9f8afe8acc2419140e3bb9d75a37e457ce6b2d627cfc551955be1f5d77fa08ff3ae483e1aea9b20414993176d523a33395d6824954545

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
467KB

MD5
1d884bc7cc4c991ef22a112171655635

SHA1
7af73b85cab1a444c82c4717e9d464787036af62

SHA256
d64f9efca7ac518acd2f31d3e0aeb487763444849273041d05765324035326ed

SHA512
71ab44aab3fe0e261d6ee165ee220822c6ab521937d3c328ba3b3b1b77c8c72d722698fbf273eb905e6e70d0c9560b4560bf98323e1278644aeeb7d14ab428eb

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
467KB

MD5
76cf03edc4aba883ca5b5957ce0cdfe5

SHA1
7faaab659b9b81f818837cdc41598881d460d73d

SHA256
f536abc0bed0e251ab48a152989ef6f936e07ba39e0f5de642dbe05852f9dd6a

SHA512
b87a557ef5fb2b7e023723171d879e3967176a68f3ed65c39e23c7b51ba1c8477e6c9491f8f535a17ee6d6c7416ddc692e76c6bf5bbe3a3da6a536ec2757ed74

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
320KB

MD5
3e5cb9c07895ee73ca13d93e2b29243f

SHA1
093207ed95cf4df9bfab9595be334b9048636d85

SHA256
1b03cca3c9e213c1c2a29f59cd7e9f9c6e72ec7394241acfc8e1815fb8e32c58

SHA512
a35dba087d94c2a71894dd68cf5150a84a341121be5be3ef9473dcea1c6bc911276c0d182d3bd775d09b2794de4c3e02cb6d68e87547e6618268653f04401f86

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
467KB

MD5
b894239e97609041c88eb1f79fb4e050

SHA1
13419e159746a2cd6fb3e47915c7e9104d812947

SHA256
18c2a1e9b3ca11c2b2577742752b0267f928fb259de9e4315ae1866bacdccb16

SHA512
6172a1e2814802771e4f793727d38921e6673aec4dbea868d937b0aa4c3bec49f961ca879ca19d8fededfca976f12b5f309334b29b59574826a87cd81c5ad98c

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
467KB

MD5
266558fa7ce85b273d60f0688866a9d7

SHA1
5231b964c3710460bddf37dcdcd9ce25a34b8a89

SHA256
c1ec18efad0a8417aa1d700add33f3d75635f354071aa0553e04f55428bcb5c4

SHA512
9c394be4531b38d8406134628bbc8d5d959273f44917b94f8da6777b37e5147466f0dc73db61363eeb7500ace94e849b1628b11da7b5f4219744b57233da625c

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
467KB

MD5
a593700a720d7cdd72cbc46b5132a695

SHA1
3d93c4120f76d00da03ed8b20e2d0724041df52f

SHA256
fc8511ea57a0373676ea1836e03b9a4705f7588bd2b2e592179d49905ad49329

SHA512
da50717a73b51ea0b2beeead6ba144c20a0983612108cb968ac69c48441cc8e32b3d03928f9c9629fb00685c66c65b16277920e57b979b6b0dc42a9f40fc6395

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
467KB

MD5
fe064db55529bd8eac1296e28e1fd99c

SHA1
86ddebf00fb423a8b762167c669e02097efd7d88

SHA256
6448b1e61b979f5b8f4927029689606a4aeeef4b55efc0f65947df2901857834

SHA512
a1562b3500b61fc651dcf1becf29493bdabbb858a8c83a4c3794df9aea147c90ec5c1a4a6d07bc58259387facee9cbd6bfd084bab52511c1fac6fb95216837c5

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
467KB

MD5
7750bed5695c861c14881d5090c0dfaa

SHA1
7ce42f8ef369b437db6d0807c6710b10415e4ece

SHA256
1ba1bf058729fc293858cfd8f90e278971110568f37e96ffedec7bc49c67c493

SHA512
986ba6a62611e5fa895d3b10791f9c241fe5ecf152dd07da369b7d5809d417553cfc84d8d510c02cb26e5cfb0882b677163d588d76104e443de64339f4c5d4fe

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
467KB

MD5
ce9f85dc7aae3ece451fbbd61fe45373

SHA1
d42bfb2f73a7075e997e1721eadfb3fd74c20bef

SHA256
c3f0294a10ad548b9baba4659c2b6ac97e2f6c6aa1c3ebbcaf2552e7a8fef0ff

SHA512
93af535f807a8ef9b278729645048cea00d2976412b80a365dc927d2c8b888e7bd28527f0390d659bd40ae24f1de558eea5b54ba0b374813632c2770f66782fa

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
467KB

MD5
a4b8576d9523e6306d5ee4061a0d7c73

SHA1
00af2adc221f62ff3ddef7eed04c568d288c83a3

SHA256
54b889ed7c9ab70c238bbca79bd899a257b3891b7a11c2d2b4de7203cb73de91

SHA512
7a53eb2000a2d99a79895fafa1ea407f41ff2d4c7362af4b70867a2bc1ef181047771a6de0f144bc4e90c7ae1240aec6d81f8ea14f63d633c7aa832b9b0d84ac

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
467KB

MD5
51afeb72101d7e85ca48ca55780cff01

SHA1
d4f79151b28e4c5225260de7a17f566d6980a98a

SHA256
270383bbf11d9cd8bb2eb77f5c4c841203135f22e205a77b97a2573b80727d12

SHA512
d4940ba51cf535fcaa24ccd4fe1de8349adc6594cd092e8a77558aeab0bcd560768871fa94f8d96fb3268c5f7cddc8a43514e791ac7c7c7b351f7cb79b81f487

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
467KB

MD5
01203d8bb7ab77decfa27f8d0b807b94

SHA1
f05232cbb12bb6809fabaccaad317e8199750470

SHA256
f300dd2361ea8d212701d34ca3a8def7f7f6c0f3eaa091ad46b4ee63a0e30694

SHA512
58f27434d46fcf35b5b62d86b857b2aa3bfab193dd348b8e69e353df30742ce88c1fb0f2420903c496f083643f3427845600984332bd4d8ffca3e0bb1e1ad358

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
467KB

MD5
46cd439b500b4dfb03c4eac4b8c0efc1

SHA1
d5ee6b074e24da2237fc781a4fce0fa5cee6163d

SHA256
508fb4e6fd540b4cf93a60278543dba9724a751b69ed124ffce49a7abec3985e

SHA512
d7a3069a76f4b2ceb5fc75ba91cc115b6667b4e62332de644e7f34e67165a64cab8fb8dbf4ec10904f31ac94185c2ade5a18418c410b065f675d5dc4081d7043

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
467KB

MD5
23ecda65df070220cb5395fd7f2fc436

SHA1
f6cc19e5e7f61683024084d3768dcf49fccea9dd

SHA256
2f26ce0f7d7429bc92f7548e4ee0d36006593ee2f646ec4fd0c9af4dc5ec611c

SHA512
dbaa76e952b6d5395c3b7a80eac4f8878d3bd285a0ee9a0551de01a3efac0369ca6bfdbc3c36e999cffb9e089b195f2eefd95d369054539e37dbc6d4a9062d7e

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
467KB

MD5
ca315bf110161f5497c3ef28ba58a7ad

SHA1
5803236a7ad719f24e52d11c7a96871e2f9b4bde

SHA256
9f84883c5aba48a5da88c5a13d64fcc6ab24cf44d50a1353d3571130478a0418

SHA512
74994bec44768137f1f9685bd1be3187429d2b0cacd21d150386a6e9e2d2c19fc3760205d0b20a795e9633dad3f2cec4cc45486b5fbd7db6f929e00c3a7c3c22

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
467KB

MD5
3679449be001de9072ddd38fe05e74d6

SHA1
c1342a2163c28a3fe2a80cea3eb762c9a9bd03d7

SHA256
c8af311064d34126b7821320bc41b3ce4ebcfa88a28fdf50b0b2530ace4b49bf

SHA512
c731d8819b918074c1d8e246e9557da35dbe521db210b7303d3afd80257f304d8778a54dcf382b403b5d12c123357d0b7bcc9099dc370b9228442cac38c399f2

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
467KB

MD5
0773bc3322d4d4e82b1f856523c5d6b2

SHA1
0ab3481d7de2072b9a8f6a7fef2667af1284500c

SHA256
59f2b05d26c091a9fa4b4ce597e2ae351e3f2e22f78aec64c396f45a58056328

SHA512
6efaee08c1a3a7ba999a2455bd81a4cd9d3ddaf8651eed6286d6329c4bf3f8e4c771fce144111edb6a35efefe69255989cc87c9ef1bd6a2c67069ff1302bd5d3

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
467KB

MD5
763ada65297dd8cf5242282e44c5b0c2

SHA1
b79363bb3036bc1d522d3137561111a75d431afe

SHA256
5c2ad3b4e8620d35244461c6aab36eebc12f65e4e269997811944537a14dd731

SHA512
6710fbb5287f307aefb654fad6d69977d49bbb5af636ffcc38c9e6e4ae3429f61c2b0520486bb70cf109fc77e268bf8094ab17d7896e1b29ee8ad71907f1bb6c

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
128KB

MD5
e698e1321acfa055af1be82b7a026df1

SHA1
6e12036f700a66fc6fbabf32bf1e0457515588df

SHA256
f30f2e0be38f7348c489c0c2365e3adc085233e09ad6562d8bde796c76d750dc

SHA512
a379d6416dac63114df7052b836f133031c41a8a43917ec5f9e97bd3bc6c733dcf0710917826dc3c02a3da0f3c4596234f04778022525933ee01fb6ccd4c47a9

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
467KB

MD5
3847c90165cee0ce98b057fc681e6c7b

SHA1
78146b9aacaa95bfc0018ded6cc7f56b1635aa55

SHA256
5be923f9e7d274049fd03418fcb1bad4f8e042485c468139659d475276f0f238

SHA512
f8d39f0dd797d9fa9041db1d0b72c269e6e683d55e010f6651f09c5e693c9afc1ef4662686b605329ef2275fd2fd79767ca3162f90a670301d467047b2b063e8

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
467KB

MD5
935f2118cf931f6e3e992a01cb93705a

SHA1
3d8bf8da1549a490cfc6373bf7c057e715696aca

SHA256
e6353a4bb6ba7aa6dcd8d8cc487cd16d016b5db2bf130a385e6c49c39ace55c8

SHA512
5f90056b17984137c2fba93055ebf47171b79ca4906f2d41ea73abdc18fa07126b1eb0e2e9050ab2642140a512fb8980029ef28431c754ea0ba56b3e5e7da6a6

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
467KB

MD5
b712527ee7dd75d27fcf0314a4f8a644

SHA1
38166bbea88af5a9fbb7bdd2bcad0bf09eaa2580

SHA256
a807937387f736d1058434eaa21499fe42c7e8b89f69845ec7a8db9950e5c35d

SHA512
7a2d7ba8a19da85eb6f669780e988736834847c92daa4f61018a011a48913422f2c92c6524972026bf71fcfd8a31cf3c32688fdf46a8dcc8b1772568b4f33037

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
467KB

MD5
572607c1a31b03a74e19d8aad2750664

SHA1
bbce20bfecd4b1009d102532ebdf0124679dcc89

SHA256
37d2ffd3262feb45d88021494ec7d8735d0821768a6740e124c095e3c9bc58dd

SHA512
7d10e8b3a4c207f1bf7ace9f0f5aaf15d5e518a8b87a5c67c25feb6b754332daa69ef243b638ed7b6257e198d9818b1f7f480b173b4da4b3228870ba16fd3909

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
467KB

MD5
f2533990368eabf15b6e651f4ed0041e

SHA1
922135d5a1e0b1cc4a3cb66b5f16f3572566776a

SHA256
9819538d0941df44c3615ba3aa745cafc8f4171329886fcfde1e9a2ae24d6d62

SHA512
95a8cbea8a99c4a4a6bdcb92f60967aef3d0a4e308d1c9d602d6a41bcffb11ecaebe60f0b91d85ba414b68c12a7b7fb273be5222429153d06d06dead09c3de3c

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
467KB

MD5
ee32b4ad8b6753ba1c8d57d088242e18

SHA1
50b336db7b79a6795cd88f364ed64d4df8857b5b

SHA256
7d85cde8180f12f9284adac08f22da68b56c17d3133fd97aa8c40dfdf85a1707

SHA512
abbdada474e166a5b38b0424208714aec67388751b758be98636f373da93dc8fdb6237d638c19c1e2cbd0b092b4fc953454ae9733070964a7cf71124dbe19b5f

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
467KB

MD5
667a5d529fee2374c268edc372939fc9

SHA1
734259dff2d5f9f787fc7ad67db46a824d2780cd

SHA256
bf036a3c533bdbd4a4db8b0d1bf7fa28584a1b36e1be82c5a33d4c837aa14628

SHA512
6372d061b52b4158fc9f40732a37693d35182cac894ee3ddbf7e89e3c1401031ad9ab29d8d74c58ac50fc3f6bf1e14aa332048a843457539e19c3306867c1ffe

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
467KB

MD5
26c8ce2238983749d2d73f40caa007f8

SHA1
40b7c352dfd3a92ef2e834ae5dd0f4c4d0d1123f

SHA256
9b381ac3c930e3d90b51c127214ba88afb58eda500301708e259570da8e92618

SHA512
2df1f8a00dbbf843449160bab0f93c47433f7f8a0d6747d6246bdfe3e03cb14bd0af0497d78479d007b0564bd4157b9ebb1959ee2517111a5c7895a2e5b91aba

Download Submit
C:\Windows\SysWOW64\Oicmfmok.dll

Filesize
7KB

MD5
6e1123c58d25ad4d90730094ef185322

SHA1
e8a011a5a72e7d6614fb35a86a19949627dbfb84

SHA256
1d9b9b034c223ba26694923179b9e53719ecf7c23c2fcc956ec4b5f1e51bf305

SHA512
0fd7c987d76a701ae67db5e5a7546e16fe08612833ab2da6f46f069a58e9815bf6ef1a9cd33aab7d4a755abacc0275fcda0bc0adaab313b96d6694c2fbc320a5

Download Submit
memory/316-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/316-271-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/436-87-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/436-249-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/516-199-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/516-223-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/712-32-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/712-263-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/756-272-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/756-160-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/932-261-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/932-44-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1096-255-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1096-63-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1224-253-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1224-71-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1572-119-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1572-241-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1840-95-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1840-247-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1932-104-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1932-245-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1948-265-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1948-24-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2052-111-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2052-243-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2152-48-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2152-259-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2456-167-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2456-230-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2516-9-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2516-269-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2916-239-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2916-127-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2964-235-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2964-143-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3048-135-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3048-237-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3744-251-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3744-79-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3792-208-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3792-220-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3872-184-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3872-226-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4588-257-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4588-56-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4720-219-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4720-216-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4816-176-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4816-228-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4868-267-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4868-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4880-233-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4880-152-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5004-224-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5004-192-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads