8bfa465317d7f6b937e98d5b880edbc1f93d5f4cbd46c9181d2ab57af7283424

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0e20c4a24656783fdbe4ecb3125f630N.exe
Size

80KB
MD5

a0e20c4a24656783fdbe4ecb3125f630
SHA1

dd626c95bd0d1c468dc47a1ea34fec857be90512
SHA256

8bfa465317d7f6b937e98d5b880edbc1f93d5f4cbd46c9181d2ab57af7283424
SHA512

33a9bffdb8254d789d8f44d78f6cba6cc86e8e85ec2c3df2be0704e6b1fd136c46685c793707d8ebc495fa1f6d5e445bbede15669317a5b21dc54e1d61a9d3f2
SSDEEP

1536:xJu9iUA/uO58ZLbhjRwLHhjtqSCbliVWN+zL20gJi1i9:4iryLtjQhtqRiVWgzL20WKS

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjokdipf.exe

Executes dropped EXE 64 IoCs

pid	Process
4340	Olhlhjpd.exe
2948	Opdghh32.exe
2732	Ocbddc32.exe
4272	Oqfdnhfk.exe
2188	Ocdqjceo.exe
3892	Ofcmfodb.exe
2772	Olmeci32.exe
2568	Ocgmpccl.exe
1592	Ojaelm32.exe
4640	Pmoahijl.exe
1180	Pcijeb32.exe
4484	Pjcbbmif.exe
2424	Pmannhhj.exe
4024	Pclgkb32.exe
2228	Pggbkagp.exe
5080	Pjeoglgc.exe
4756	Pmdkch32.exe
4188	Pqpgdfnp.exe
4704	Pcncpbmd.exe
3508	Pjhlml32.exe
3468	Qnjnnj32.exe
3024	Qddfkd32.exe
3896	Qgcbgo32.exe
3908	Qffbbldm.exe
2924	Ageolo32.exe
4356	Ajckij32.exe
1060	Aeiofcji.exe
4516	Agglboim.exe
4804	Ajfhnjhq.exe
1388	Anadoi32.exe
2136	Aqppkd32.exe
3904	Agjhgngj.exe
1044	Amgapeea.exe
2888	Acqimo32.exe
4480	Aglemn32.exe
1788	Ajkaii32.exe
1160	Aminee32.exe
940	Bjmnoi32.exe
5092	Bnhjohkb.exe
724	Bagflcje.exe
4120	Bebblb32.exe
1528	Bganhm32.exe
2300	Bjokdipf.exe
512	Baicac32.exe
656	Bgcknmop.exe
2420	Bnmcjg32.exe
2556	Beglgani.exe
4836	Bcjlcn32.exe
2028	Bnpppgdj.exe
3840	Beihma32.exe
2860	Bclhhnca.exe
1056	Bfkedibe.exe
4336	Bnbmefbg.exe
772	Bapiabak.exe
2184	Bcoenmao.exe
4512	Cjinkg32.exe
1956	Cmgjgcgo.exe
5108	Cenahpha.exe
3716	Cdabcm32.exe
1896	Chmndlge.exe
1564	Cfpnph32.exe
4180	Cnffqf32.exe
1556	Cmiflbel.exe
1600	Caebma32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Akichh32.dll	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Ageolo32.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Qnjnnj32.exe	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Aoglcqao.dll	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bganhm32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Bebblb32.exe	Bagflcje.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Olmeci32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Pjcbbmif.exe	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Ldamee32.dll	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Qhbepcmd.dll	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Pcncpbmd.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Aminee32.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ocdqjceo.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Ocgmpccl.exe	Olmeci32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5744	5428	WerFault.exe	189

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocbddc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgcbgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olmeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0e20c4a24656783fdbe4ecb3125f630N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a0e20c4a24656783fdbe4ecb3125f630N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfpfmmm.dll"	a0e20c4a24656783fdbe4ecb3125f630N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmhoe32.dll"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdoemjgn.dll"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bgcknmop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4340	2748	a0e20c4a24656783fdbe4ecb3125f630N.exe	84
PID 2748 wrote to memory of 4340	2748	a0e20c4a24656783fdbe4ecb3125f630N.exe	84
PID 2748 wrote to memory of 4340	2748	a0e20c4a24656783fdbe4ecb3125f630N.exe	84
PID 4340 wrote to memory of 2948	4340	Olhlhjpd.exe	85
PID 4340 wrote to memory of 2948	4340	Olhlhjpd.exe	85
PID 4340 wrote to memory of 2948	4340	Olhlhjpd.exe	85
PID 2948 wrote to memory of 2732	2948	Opdghh32.exe	86
PID 2948 wrote to memory of 2732	2948	Opdghh32.exe	86
PID 2948 wrote to memory of 2732	2948	Opdghh32.exe	86
PID 2732 wrote to memory of 4272	2732	Ocbddc32.exe	87
PID 2732 wrote to memory of 4272	2732	Ocbddc32.exe	87
PID 2732 wrote to memory of 4272	2732	Ocbddc32.exe	87
PID 4272 wrote to memory of 2188	4272	Oqfdnhfk.exe	88
PID 4272 wrote to memory of 2188	4272	Oqfdnhfk.exe	88
PID 4272 wrote to memory of 2188	4272	Oqfdnhfk.exe	88
PID 2188 wrote to memory of 3892	2188	Ocdqjceo.exe	89
PID 2188 wrote to memory of 3892	2188	Ocdqjceo.exe	89
PID 2188 wrote to memory of 3892	2188	Ocdqjceo.exe	89
PID 3892 wrote to memory of 2772	3892	Ofcmfodb.exe	90
PID 3892 wrote to memory of 2772	3892	Ofcmfodb.exe	90
PID 3892 wrote to memory of 2772	3892	Ofcmfodb.exe	90
PID 2772 wrote to memory of 2568	2772	Olmeci32.exe	91
PID 2772 wrote to memory of 2568	2772	Olmeci32.exe	91
PID 2772 wrote to memory of 2568	2772	Olmeci32.exe	91
PID 2568 wrote to memory of 1592	2568	Ocgmpccl.exe	92
PID 2568 wrote to memory of 1592	2568	Ocgmpccl.exe	92
PID 2568 wrote to memory of 1592	2568	Ocgmpccl.exe	92
PID 1592 wrote to memory of 4640	1592	Ojaelm32.exe	93
PID 1592 wrote to memory of 4640	1592	Ojaelm32.exe	93
PID 1592 wrote to memory of 4640	1592	Ojaelm32.exe	93
PID 4640 wrote to memory of 1180	4640	Pmoahijl.exe	94
PID 4640 wrote to memory of 1180	4640	Pmoahijl.exe	94
PID 4640 wrote to memory of 1180	4640	Pmoahijl.exe	94
PID 1180 wrote to memory of 4484	1180	Pcijeb32.exe	95
PID 1180 wrote to memory of 4484	1180	Pcijeb32.exe	95
PID 1180 wrote to memory of 4484	1180	Pcijeb32.exe	95
PID 4484 wrote to memory of 2424	4484	Pjcbbmif.exe	96
PID 4484 wrote to memory of 2424	4484	Pjcbbmif.exe	96
PID 4484 wrote to memory of 2424	4484	Pjcbbmif.exe	96
PID 2424 wrote to memory of 4024	2424	Pmannhhj.exe	97
PID 2424 wrote to memory of 4024	2424	Pmannhhj.exe	97
PID 2424 wrote to memory of 4024	2424	Pmannhhj.exe	97
PID 4024 wrote to memory of 2228	4024	Pclgkb32.exe	98
PID 4024 wrote to memory of 2228	4024	Pclgkb32.exe	98
PID 4024 wrote to memory of 2228	4024	Pclgkb32.exe	98
PID 2228 wrote to memory of 5080	2228	Pggbkagp.exe	99
PID 2228 wrote to memory of 5080	2228	Pggbkagp.exe	99
PID 2228 wrote to memory of 5080	2228	Pggbkagp.exe	99
PID 5080 wrote to memory of 4756	5080	Pjeoglgc.exe	100
PID 5080 wrote to memory of 4756	5080	Pjeoglgc.exe	100
PID 5080 wrote to memory of 4756	5080	Pjeoglgc.exe	100
PID 4756 wrote to memory of 4188	4756	Pmdkch32.exe	101
PID 4756 wrote to memory of 4188	4756	Pmdkch32.exe	101
PID 4756 wrote to memory of 4188	4756	Pmdkch32.exe	101
PID 4188 wrote to memory of 4704	4188	Pqpgdfnp.exe	102
PID 4188 wrote to memory of 4704	4188	Pqpgdfnp.exe	102
PID 4188 wrote to memory of 4704	4188	Pqpgdfnp.exe	102
PID 4704 wrote to memory of 3508	4704	Pcncpbmd.exe	103
PID 4704 wrote to memory of 3508	4704	Pcncpbmd.exe	103
PID 4704 wrote to memory of 3508	4704	Pcncpbmd.exe	103
PID 3508 wrote to memory of 3468	3508	Pjhlml32.exe	104
PID 3508 wrote to memory of 3468	3508	Pjhlml32.exe	104
PID 3508 wrote to memory of 3468	3508	Pjhlml32.exe	104
PID 3468 wrote to memory of 3024	3468	Qnjnnj32.exe	106

C:\Users\Admin\AppData\Local\Temp\a0e20c4a24656783fdbe4ecb3125f630N.exe
"C:\Users\Admin\AppData\Local\Temp\a0e20c4a24656783fdbe4ecb3125f630N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\Olhlhjpd.exe
  C:\Windows\system32\Olhlhjpd.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\Opdghh32.exe
    C:\Windows\system32\Opdghh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\SysWOW64\Ocbddc32.exe
      C:\Windows\system32\Ocbddc32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3896
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1060
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:724
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1528
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:512
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:656
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2556
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2860
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3716
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4180
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        65⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        70⤵
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        77⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        80⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        85⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        87⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        90⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        99⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        102⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 404
        103⤵
        Program crash
        
        PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5428 -ip 5428
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
80KB

MD5
d0dbddc181e83e0b09a009303fb2e60e

SHA1
d25876e6e04118b123635677b1ae1f0b2f210684

SHA256
410ee1370413fa1db6a3207b38185e15ced7871ff9b92f0bf61441c25bdd99f1

SHA512
b1ccc8864e1231e49e9fc96603cc48c2d33f330321b448501aa64e67e8fbbf812291e9ee203b14815455f90310caca72a0a07a2d4093f1db9beb31bda9a15a1b

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
80KB

MD5
e2eec8b20fec0b12848190f028dd6218

SHA1
f229484a3f519c99235a0c3686db34fead9891e3

SHA256
68ab5bc5b536f6f51ea31b331f377e88a9f068c32cb265b84147bbd52e2fb8b7

SHA512
6bf39c53c2f2b8c99ef09c28bcc182ba6d4c77cc26714fb86699d825e226f9045043a258c86bacd6e46f0f542d8eaf83da0d38a4913ec908464d20e1366b24bf

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
80KB

MD5
d13076fb1c21ca52f6818d0d4199a48a

SHA1
8c355ba96ce00436446699b49255936c2d4b0ed2

SHA256
ad99b0914768d91324932b6c750171f22542f46d1e42810c181ae1e4fa7d93df

SHA512
43b43b6b38472124ee9a1d8ed8c1a481a9e56072eadc9f647a5b003d0886c994e16ffe69bf28810691e378166262477b7677a10eb220d18d1a32965ca4e707fa

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
80KB

MD5
f937abd77133f68abe70ce55198f15f4

SHA1
873de903061dd21568437401d85be9f606bc7512

SHA256
092d5ebf87d3789b2e1792482647d212034c107dfe312bc15dc0c0f995e9044c

SHA512
4c474fc968a357d159c7862a0886dbbed1082a33389ae0dff1490f3d1887e73413274183d2b288e1a28fa6f8cf0d3990990e9d0c36b750cb18522448a9d86eee

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
80KB

MD5
181f2eab9cff1710ba098158c9ef9d67

SHA1
bc1db0566675b7941f1722cd27c4152044477d8f

SHA256
f4e942405b14b27d2765e5376d3e83d056b03666dc05b3288576123dc15f2aab

SHA512
8dc33695e35b1e7bc767102bca55ff463faf035c462cd2dd91dce811bc464e85b9423a84a56c5cf393c83e69956f52f3224fde0f78aab9f4b6dfed90a7daf17a

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
80KB

MD5
9fbb4f22114bd919a82dcbd72c11b19a

SHA1
9521da7db2c45c9fcb66191737571e4cbe5e06a3

SHA256
3327e1421ce40759d91ff9458977f83d062766f8a80be054f2b65b27e2bc1631

SHA512
6ce7bfdc0cc526e6d8878309849db4c9e025ea16f596ab3d91e5b1ee1501122ef4e4cb41f358a1f872a13405b86e469685732617620b81ed5c1611636e09390a

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
80KB

MD5
a720e58ded9b746c467e95fc48405a04

SHA1
e389ba311cd3d87f8bd3e2c5dc17eb197ddddd9a

SHA256
ca41ed9c80c8e9e63dfaa1c5d335822974ca8e23e41cdf606d74023b6fd083c1

SHA512
192bcffac6e0a0e007d94b6d12458a15e729dd3ecc8cfb7cce65d2d53a5901533a69e98c7df1edee3f921021087de3ca302533bbddb585d2a9e146c8e3df4e1a

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
80KB

MD5
bf961781fe9483ec5b2bb0112be12829

SHA1
450fa2c92ec1a6924c1645744b7be89a82a985af

SHA256
e744c47a080481ee618c8b666cb33fae44ab806474cff3120b90bf6452a17e40

SHA512
d463098ad65affb7871e99102444bd96373991a4fdc3518c898c40b5229eb6d3e3b1979c96ca200b9a9d8e14290565de151d6aa4a0b5b07d9a31cf1027c8a148

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
80KB

MD5
511fb82cf592328a0d3e2281e93f3335

SHA1
b086172c6faa1c3e8086a10957bc4de9f7de1ca5

SHA256
26c28ccf60b4e1632b607509576fa14fa37e43d5e268b5872b534f788e0598c4

SHA512
f6835e33b61a249db07499ed18b9ce443783b41e28d7a971e5610631c614204e6d8b01a5c1be87964290dd3b1d9e986b58b25657ca928785cdb7c303862eaa53

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
80KB

MD5
a51c3ec25c976343036bbbc2548b6f9f

SHA1
5c732af71c0cce40ddd68ef676eb84963ae5ef65

SHA256
3ce1cad4ea58e8399dad91a3c06b48ed2dc5b04f3209b400a144c00cac2604ba

SHA512
efd14c566ea2179e4859accc59624ba28f68d42f79099c381a5fda846b146168d226c4c6073c5330e96d8c785b522d311ba96f04cd49031858c12ac67df353d2

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
80KB

MD5
071b0900daf59ac782bcd976958004e5

SHA1
3f78b928649325bb8430060666ff33613b296f69

SHA256
d551ed99e6ce7bda60d50837acd822facc23276bec2c93af5fbcc7cc2ac07799

SHA512
9df9780b3b38ecfd31b9c5432646dd73db191a302c6110609c719cf7b510841e19c320991c45f200608c7d11769eebc783a239c7d48e994bf445a5c4b7e24734

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
80KB

MD5
f3f7cf8d8e9f19fa66bfac36987fb468

SHA1
e53d94245def92fab47759ec82b7ad1b6b37165c

SHA256
5cb06dc8bcf628085f8e947d98836146232593a11bb565adf35d487fd128c3b4

SHA512
44d556bc4c39633eb8ac5a1a5d4be66555cac5d68926c6dc7e0e7050a008d38eb2f2bcd473c38810006667419528dd80bd7146481babb5b03683f102209d61d6

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
80KB

MD5
0d1cabc5d0bad6925f023c17e68e9f48

SHA1
97d4a41d84613764b211ae977d59f5e73e124a37

SHA256
26bee0e3495133c05d2f7821fdcbca6b67fa538effb3aef74fa9d0709f2ae08a

SHA512
c63593c3994634efb1bb9aa054ef22705653f9beac2139630213470f305dc90ac20567a0bc358868b491b1b80c83ddea76abe063c6e861b77f4925615cb5ebd7

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
80KB

MD5
7494e1651f22b1560db163bee5f7960a

SHA1
31544db7ab2fbface6e96640df5937f7a4fad28b

SHA256
4036fdd038cbfa71689fc5b90173dc85622eea107056e9bcd2d2386fa5f521f9

SHA512
dd474903a1bb9ef48acdf2e1f79b41ef5e031840eff0327281cf7f22ade7cad3d726a49431d5acb9725ca6ce7a5b2cbc5dbafb6e33ee2a4c83777809f3a77d8e

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
80KB

MD5
ed7d17b2b8fa7fe0bfebd20c8e219f73

SHA1
10a4a97323f229b82f2fd34d23b0688958c28cf8

SHA256
dccf5a28d7f1c1f758d6d29656d8643eafb66083c1773c05f4c5e7412c332670

SHA512
99e038b00e018d649bd019cf199593b625404122664c568ba7bf1da5252f27fcb846a94fc5b3c1e8d0a437d440349d380165e773f36d9f35770e9fe29bcf4e49

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
80KB

MD5
77fd30f1ac655bca9efe60fae8e82f93

SHA1
d60f73a130b61f9ee36dd037b69647d525b6ab7d

SHA256
ea6542211a77725ecc638914762eea475c841724bbf6787e850ac24074eea6b9

SHA512
d1a3fba0ab2800a970b18ef7326e81cd497d32a2a3ce52ef4242fa5ceed8fab32d8e7069cbde2f70334747f6a7700c1db3623e1270333142e7c5143941536364

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
80KB

MD5
9b5a60563f81f9911a2b79659e43697b

SHA1
d61e1051c017a60afdf20d9699855e3aa9d37b17

SHA256
e941f62b699cfb29a00b4ee6e7760a4b4ef70fb14ff63f92b2ff86a0226e1eba

SHA512
3191cf23a2d6c3162a0e5a06057d0f6f155d514f04ae9d431b27208fc7ac3ba1a5cdb51365e9de5c197726386ce296f8b0f00ae55ae3066b0f258c0de258adef

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
80KB

MD5
2e09c2d2133cae32aa3cd55ed18608f5

SHA1
ec3086940c93a46abbee435e3d7847b5e7eaf013

SHA256
5dbdb9a1d25add17a4dd154456153658418c5c630ffb1cf808b0b9002b80d7d3

SHA512
3c9ede60bc428bf91da759880e7d462efcfcce00d44ddb15341e11f1ddb1edcdc0725b9818230d9ebfcbe32b2b90a8609c9e091c3b5dc7e1758534322589b53a

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
80KB

MD5
b94cba4dd095472c89dadb9250ccb5d0

SHA1
b07848563cabb24ca057e291505256fa0ed7ae51

SHA256
56446083adcbbb109a6d1c895352dda9bb5ccc84538edd717b2cd6f1de22d391

SHA512
baa38a90f423b72507dc434e772b0d90cc0a322213a47487c8d656ffeb88c4b26d78a31c40c36457cf2a1c4fa45a537a56fb0410945b16bd064c3b034d70f63d

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
80KB

MD5
ef58d8474521d7cd8545fe8ae42f09da

SHA1
a9f19fe6148be5a1f93746e297740e377a5283e3

SHA256
306543d15951e3bacf4edf4641272343740ab0ac5b656842611d8843f44c0ec7

SHA512
9a8839ef227c6222e152d9ec1c134868a11f3bff5333156634038e1902fb97232f1b49ac9b330ecb86728cabe60f5ee5d4af6be987ed82a15ce41d97fa4f1d47

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
80KB

MD5
e04b4ca24e7fb90de849548b36a3addb

SHA1
ef157d82edec26dfb2f15d88a1fcb36dbe1d2598

SHA256
47229dc1585f2a52fe31106034347858bd0801d7d46794ec3f5f587dc2a58b89

SHA512
aafa2a7ddb033605d664a23dd1382e1972a0fa96b3a5ee7f50df1e93a4889f310bcd592e47ee134210a6406a592fff906d7f88fd4156b8b49bdd5461791a585b

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
80KB

MD5
916180988c24651a351e62188c228e70

SHA1
6c14422565b56962c78482c99e189cb45fbaefa5

SHA256
75453f05d4d68252b89211aa146acc14d8d2530772689a47603c1ec3ac6d65ba

SHA512
279c9a7e522520675fa6ee3c62dc5bcdbea008a047affd9b17a17075ca8460dfbeeb0959456ce52157a57fa65aba58a29d1ae66773456d312d0c914d8acd4591

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
80KB

MD5
67db7acdfcb37b89ce8f5849ef0f4327

SHA1
20e377aca84ce8c86a71298bf46120a45b393faf

SHA256
a4bda486f227d284ea902984e3810b497563355d0610c2cdd86c6a75e1369041

SHA512
0bb695168d821b648de3b1193ac3888ef20a7f6f11dc13bc896107157f798558abf9b2e7d98bc8030567011a4615858e3ab0439ef81b87e6a2b0dd67b110536e

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
80KB

MD5
f165642a993e38444425c0d21a40bef2

SHA1
403ba32499733fd6c28992cbee017e6be96a620f

SHA256
65674cec11db38eb42bf7bae647b8954f122c05478c5ba126e7fb37eb77699a4

SHA512
ec40b5a77e9cd7fcc3ec368df5f784a07408d221cd06bb0ed410fa8bf7bf92ff211f65c93e949182991dd725866e37f488f8ab3b592553db359a73586fa92357

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
80KB

MD5
81c9e02bc7a9d64f0555eb043d0ba381

SHA1
5e2bff961a92272328516e105a3a84166e392033

SHA256
d49bce4d0ca288d170f94f857faf8e3f5bcffe4e20e2620a1045f5d390b5799c

SHA512
5dee98d38150d6bc9ad0cc68d258ed9303818ebb07bd30edc386305f48bc705faa2214f9333ea0d49f3c22ce5a73a0db326b3e3aa50ccd224efd8ba8879f6bf3

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
80KB

MD5
95e7592252d2b7c45bb6e23296ea9ef3

SHA1
3a374eb5feb1bce4e7d47d9da62b4a209b307056

SHA256
2bfe874b52e482d666d61b9bb46a1f919e6e7b61cb70d1d3a072c8f78869420d

SHA512
cc8d84d13e9b5effc4715c1714b7645c534fef0357ca6c59d27aad05e6dbdaf651d69140e72765acc720e284a069635ccc95be40fccb6dc54877134dedee1542

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
80KB

MD5
6b3641d872abd4ad24b422e9551728ca

SHA1
4e530a2803090ede07ca8431f9aa2e05837b21f8

SHA256
e53fc25bf3537f42c1f6282f436055b7b4c19b46433e4e36375cb3fbff041d7f

SHA512
d84be5963fe62b3a12d914f788f23498dae0e9c68b47eba9234a2759917da8c7ec8e796ea7ee9ad6a5077fd3f102691957ba6d4f1763124e67e3262967ab09c1

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
80KB

MD5
74e1960763fe7cc96ccbafccf7ef6b18

SHA1
6db78875eb46fa43243a9164b180287248f7f203

SHA256
6afde317499b271ea39697a6de1e3aca2ff063b120c08145ab7622fece6ead9d

SHA512
2d63468afbf0ed80129fd22b275ea7f3daf3e65156713bbe554888d819ad55376841e92ca1509f961314f621fae3113ce9fc7f4945845ec4df165cd2c35f1f9e

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
80KB

MD5
8d259a9463576067ab2c853438e8a449

SHA1
0c297cb2a447608ea1d036b9d859f5375a17bf6f

SHA256
5d0ca1c023d4248bf9e5e37a5c7b61dd1e8027446733c0cf289d0b3e8d0e0122

SHA512
0e1647754ef137347c2e3cf7efadaef0c0d8674c0496c7f88caf6e638a856d15f9823efb6e29901751b2988edc83727a0285e4317520e84b484e662b65056cd9

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
80KB

MD5
bd284fa0957176500106226674c42aae

SHA1
2f17002c264f959cadd3164d2185ba983c84b2b1

SHA256
91e81ab84bac5f642c3880098bddb377fec3b71882a13545043691c7a0ea0be6

SHA512
7d2833bde7b970cdcb0ab89bc0e6a3a18846ddf7ebadc1890fb10a790af24855be9fa998dab4da2f21d0be86c5acbe16a0c4048049dd844824fcde62698f5ba5

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
80KB

MD5
1751b7692cc61af12b82e08c6575b722

SHA1
97c05fac4d5e3dd7b99f32f97b503f64fd0f039e

SHA256
614963e8ddab70fb0655cbe5593c63631684186868649978c975c0bb73b9824e

SHA512
7e047bf1d1d7f75f28df8cec817d727c6d872ebc7d5788650f362f7b8644b68f9b7de698f6350926dddb3b2ffb62a83b006a7fa3099abf954db46355d05dab36

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
80KB

MD5
661cbd8930f57e997cf654622d85a250

SHA1
e6cae591619cc9b2399bab45835927a259ac69d4

SHA256
74c90765c18d2823c550319945cdeaec35a09ca9b0742e029f0b811bfa77a1bb

SHA512
30b7a4d8769d36d471c2eff4b97b7885f0108ea7b7e058ba3df2d58d834c1425e879b15d952522b18fc11d8022d4155e66f9b3f43d52f6a6aa4b42fa8f13601f

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
80KB

MD5
25d92604d4008ec6021e2037706ea7f9

SHA1
e8681f66ab215fbbcc4d62332f6278f3df9ae776

SHA256
6abe34941e1a819f1b72d5cbb79c4d53f27248cc2f849144bc2a6021e69d578f

SHA512
514a637892665ac9b1c6b1047ae785599b252974c0f8c1b4ff3ca63fcd0f951e5aa45268fe12ef8e6d56838c7cf3012cbb0585368acebb0be9660f08cd5605ee

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
80KB

MD5
5652aae6d29f9651db8fa1d755f7a23c

SHA1
a15df0db61ffb53f981d6aa62612c00920997480

SHA256
fe2d6946e686c1d2eeaaa6ad6f07dec2833c3eec6788729ffbbff257041e335a

SHA512
0bc5996f0f38b9a25ce3be784ca7d1c8aa6262505fe4aeabfe9a5d0e6d8db1d9a3344dbedecad491e548224d4c69d372a189d0fd871333d6153e4a60a07aa7dd

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
80KB

MD5
b468dd73d3982c671c2e21a965f8b5c6

SHA1
26e7066478cbe9478bd62528bf9fd764674d68b3

SHA256
6332314885b5bb2a81082dc1654b9f1f212da12368b652e08a150f475c45e716

SHA512
3d1bb67eab094d8f8cd947a30be9a67c28b310aea54448798c08f891dee47b8fe9afd7a147da9dea4b7e6f02b1130ddd5fc7b3ac23aee821fe73b31794a61d5b

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
80KB

MD5
1ae00d5ba07e96aaf55954903d59004f

SHA1
4e30d7bfbd297c0f31da1b262a25275f36982059

SHA256
73726f01ab4e8d777c99cb09cb6cefb1b27f96f5ebac52fb33927c2884209975

SHA512
49c16c55f811629936781c7433a6819f72fdaab87fab90d7a1f7cf5023c70efec4490248950efb7913aa10c5f993568a995f114ea298140e71fdbaba117b812b

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
80KB

MD5
7bebc64c107c51b9de7e0d1508f2aa2e

SHA1
99425d4d94c0179213ee3e043d32d5e666107b67

SHA256
1ce83650fe1f5a8c0a8f69bab4953925727fde31a19c863b7ea0fca0361bfef6

SHA512
b3b27157cd12ae4591a48e6dc7db3115f3918a97d860e3cc95d9deba7962a44d876f1658219efb790459fd5e23c13cb56ebaf309813dfc1653d83587ea441f43

Download Submit
memory/512-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/656-434-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/656-366-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/724-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/724-331-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/772-432-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-386-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/940-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1044-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1044-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1056-415-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1060-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1060-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1160-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1160-379-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1180-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1180-178-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1388-259-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1388-330-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1528-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1528-414-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1592-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1592-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1788-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1788-372-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2028-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2136-337-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2136-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2188-124-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2188-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2228-214-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2228-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2300-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2300-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2420-373-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2424-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2424-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2556-380-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2568-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2568-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-106-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2732-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2748-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2748-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2748-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2772-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2772-147-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-408-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2888-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2888-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2924-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2924-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2948-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2948-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3024-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3468-180-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3468-267-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3508-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3508-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3840-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3892-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3892-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3896-282-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3896-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3904-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3904-344-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3908-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3908-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4024-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4120-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4120-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4272-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4272-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4336-426-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4340-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4480-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4480-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4484-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4516-245-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4640-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4640-169-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4704-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4704-162-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4756-148-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-387-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5080-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5080-222-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5092-393-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5092-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads