809cca6da630b8f2e63fa60949bb7300ad58c11c9444e3e2eb12ff72515dca64

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9983bc3b57abf4e0a5e412ff2e2449b0N.exe
Size

95KB
MD5

9983bc3b57abf4e0a5e412ff2e2449b0
SHA1

02c622a503482f213282e020d12ef33ef3babf82
SHA256

809cca6da630b8f2e63fa60949bb7300ad58c11c9444e3e2eb12ff72515dca64
SHA512

e0ae4a8fc383284df103ee09d00472bc17433c76195f72be837799e246b09b810e4fc7bd9f9d59a456af43a9982102a8f5122252626f702cd7ecf4fff4fb54a0
SSDEEP

1536:f3Hz+As+0TCZODal8PG906lqRtWijFOJHeS3MuQrtqbUKmz1Mdri1qRS2LgdOM68:f3Fp0OZODalHRcR2J+S3M9yNjLgdDrLD

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pilpfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfgfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oooaah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmjhlklg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmagch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bipnihgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpnpqakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bboplo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfcoblfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aflpkpjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aecialmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboplo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ciiaogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oflfdbip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmjhlklg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffkhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddqbbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcijce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcnleb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bflham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oooaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okfbgiij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piolkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmfqngcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmddihfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkabbgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpbgnecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkholi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpcila32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcnleb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okailj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qelcamcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aflpkpjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmfqngcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bflham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cboibm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmahknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okailj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aealll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfcoblfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpcila32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Obidcdfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acdioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acgfec32.exe

Executes dropped EXE 64 IoCs

pid	Process
4088	Odedipge.exe
2284	Ookhfigk.exe
812	Obidcdfo.exe
4600	Ohcmpn32.exe
4452	Okailj32.exe
3564	Ochamg32.exe
3168	Oheienli.exe
1704	Oooaah32.exe
2776	Odljjo32.exe
3180	Okfbgiij.exe
2888	Oflfdbip.exe
1172	Pkholi32.exe
4148	Pcpgmf32.exe
776	Pilpfm32.exe
3132	Pcbdcf32.exe
3340	Piolkm32.exe
4564	Pmjhlklg.exe
3884	Pkmhgh32.exe
5080	Pcdqhecd.exe
3992	Pokanf32.exe
4800	Pehjfm32.exe
3136	Pkabbgol.exe
2844	Pcijce32.exe
4280	Qfgfpp32.exe
312	Qmanljfo.exe
4840	Qkdohg32.exe
1536	Qelcamcj.exe
3488	Qpbgnecp.exe
1040	Aflpkpjm.exe
1740	Akihcfid.exe
2488	Apddce32.exe
872	Aealll32.exe
4060	Alkeifga.exe
4436	Abemep32.exe
2136	Aecialmb.exe
4480	Amkabind.exe
2548	Acdioc32.exe
3252	Aeffgkkp.exe
2800	Ammnhilb.exe
3368	Acgfec32.exe
3036	Aehbmk32.exe
64	Albkieqj.exe
1972	Bcicjbal.exe
4864	Bejobk32.exe
4668	Bmagch32.exe
2192	Bppcpc32.exe
1944	Bboplo32.exe
3068	Bmddihfj.exe
5012	Bcnleb32.exe
2804	Bflham32.exe
2052	Bmfqngcg.exe
2340	Bpemkcck.exe
2156	Bfoegm32.exe
2772	Bcbeqaia.exe
3352	Bipnihgi.exe
4360	Cpifeb32.exe
2336	Cfcoblfb.exe
3536	Cibkohef.exe
4944	Cplckbmc.exe
3468	Cffkhl32.exe
3432	Cidgdg32.exe
1720	Cpnpqakp.exe
1356	Cbmlmmjd.exe
5132	Cekhihig.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pcijce32.exe	Pkabbgol.exe
File opened for modification	C:\Windows\SysWOW64\Cpnpqakp.exe	Cidgdg32.exe
File created	C:\Windows\SysWOW64\Nfcnnnil.dll	Cpnpqakp.exe
File created	C:\Windows\SysWOW64\Okailj32.exe	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Oenflo32.dll	Qfgfpp32.exe
File created	C:\Windows\SysWOW64\Bejobk32.exe	Bcicjbal.exe
File created	C:\Windows\SysWOW64\Dbkhnk32.exe	Dpllbp32.exe
File opened for modification	C:\Windows\SysWOW64\Qelcamcj.exe	Qkdohg32.exe
File created	C:\Windows\SysWOW64\Ggociklh.dll	Apddce32.exe
File created	C:\Windows\SysWOW64\Gdokakcj.dll	Aealll32.exe
File opened for modification	C:\Windows\SysWOW64\Bflham32.exe	Bcnleb32.exe
File created	C:\Windows\SysWOW64\Kmqbkkce.dll	Ookhfigk.exe
File created	C:\Windows\SysWOW64\Honmnc32.dll	Oflfdbip.exe
File opened for modification	C:\Windows\SysWOW64\Ciiaogon.exe	Cboibm32.exe
File created	C:\Windows\SysWOW64\Qhfaig32.dll	Bmfqngcg.exe
File created	C:\Windows\SysWOW64\Oflfdbip.exe	Okfbgiij.exe
File created	C:\Windows\SysWOW64\Cieonn32.dll	Pilpfm32.exe
File created	C:\Windows\SysWOW64\Jkiigchm.dll	Pmjhlklg.exe
File created	C:\Windows\SysWOW64\Pkabbgol.exe	Pehjfm32.exe
File created	C:\Windows\SysWOW64\Alkeifga.exe	Aealll32.exe
File created	C:\Windows\SysWOW64\Aecialmb.exe	Abemep32.exe
File opened for modification	C:\Windows\SysWOW64\Bejobk32.exe	Bcicjbal.exe
File created	C:\Windows\SysWOW64\Lfijgnnj.dll	Cibkohef.exe
File opened for modification	C:\Windows\SysWOW64\Okfbgiij.exe	Odljjo32.exe
File created	C:\Windows\SysWOW64\Ibinlbli.dll	Acgfec32.exe
File created	C:\Windows\SysWOW64\Bipnihgi.exe	Bcbeqaia.exe
File created	C:\Windows\SysWOW64\Oihlnd32.dll	Debnjgcp.exe
File opened for modification	C:\Windows\SysWOW64\Qfgfpp32.exe	Pcijce32.exe
File created	C:\Windows\SysWOW64\Cpifeb32.exe	Bipnihgi.exe
File created	C:\Windows\SysWOW64\Qmanljfo.exe	Qfgfpp32.exe
File created	C:\Windows\SysWOW64\Opepqban.dll	Qpbgnecp.exe
File opened for modification	C:\Windows\SysWOW64\Bcbeqaia.exe	Bfoegm32.exe
File created	C:\Windows\SysWOW64\Djbehfpe.dll	Cbmlmmjd.exe
File created	C:\Windows\SysWOW64\Ochamg32.exe	Okailj32.exe
File created	C:\Windows\SysWOW64\Neiiibnn.dll	Cekhihig.exe
File created	C:\Windows\SysWOW64\Pcijce32.exe	Pkabbgol.exe
File created	C:\Windows\SysWOW64\Famnbgil.dll	Acdioc32.exe
File created	C:\Windows\SysWOW64\Bppcpc32.exe	Bmagch32.exe
File created	C:\Windows\SysWOW64\Dibdeegc.exe	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Cpnpqakp.exe	Cidgdg32.exe
File created	C:\Windows\SysWOW64\Nfmcle32.dll	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Fmbcdide.dll	Bipnihgi.exe
File opened for modification	C:\Windows\SysWOW64\Cbmlmmjd.exe	Cpnpqakp.exe
File created	C:\Windows\SysWOW64\Dpgbgpbe.exe	Debnjgcp.exe
File created	C:\Windows\SysWOW64\Nffopp32.dll	Dgdgijhp.exe
File created	C:\Windows\SysWOW64\Mqkbjk32.dll	Aflpkpjm.exe
File opened for modification	C:\Windows\SysWOW64\Abemep32.exe	Alkeifga.exe
File opened for modification	C:\Windows\SysWOW64\Bboplo32.exe	Bppcpc32.exe
File created	C:\Windows\SysWOW64\Bflham32.exe	Bcnleb32.exe
File created	C:\Windows\SysWOW64\Fkiecbnd.dll	Cpifeb32.exe
File created	C:\Windows\SysWOW64\Ohpcjnil.dll	Oheienli.exe
File created	C:\Windows\SysWOW64\Pehjfm32.exe	Pokanf32.exe
File opened for modification	C:\Windows\SysWOW64\Pehjfm32.exe	Pokanf32.exe
File created	C:\Windows\SysWOW64\Oahmla32.dll	Aecialmb.exe
File opened for modification	C:\Windows\SysWOW64\Acdioc32.exe	Amkabind.exe
File opened for modification	C:\Windows\SysWOW64\Bmddihfj.exe	Bboplo32.exe
File created	C:\Windows\SysWOW64\Aflpkpjm.exe	Qpbgnecp.exe
File opened for modification	C:\Windows\SysWOW64\Bpemkcck.exe	Bmfqngcg.exe
File opened for modification	C:\Windows\SysWOW64\Cffkhl32.exe	Cplckbmc.exe
File created	C:\Windows\SysWOW64\Pfdnkk32.dll	Cboibm32.exe
File opened for modification	C:\Windows\SysWOW64\Pmjhlklg.exe	Piolkm32.exe
File opened for modification	C:\Windows\SysWOW64\Pokanf32.exe	Pcdqhecd.exe
File created	C:\Windows\SysWOW64\Apddce32.exe	Akihcfid.exe
File created	C:\Windows\SysWOW64\Nkebqokl.dll	Aehbmk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5896	5796	WerFault.exe	173

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkholi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akihcfid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bboplo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9983bc3b57abf4e0a5e412ff2e2449b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbdcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piolkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmddihfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcbeqaia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookhfigk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okfbgiij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aflpkpjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmagch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciiaogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acgfec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pilpfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qelcamcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpllbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pokanf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acdioc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcicjbal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cibkohef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcila32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohcmpn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ochamg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpbgnecp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpifeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amkabind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cplckbmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cboibm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddqbbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odljjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cidgdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpemkcck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfdbip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmanljfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkeifga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeffgkkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehbmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcnleb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmfqngcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffkhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbmlmmjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dipgpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obidcdfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oheienli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfgfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aecialmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bejobk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cekhihig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleqfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmjhlklg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pehjfm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abemep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammnhilb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpnpqakp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmahknh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bejobk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obidcdfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcicjbal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjbpbd32.dll"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ookhfigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcnleb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpllbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Alkeifga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Albkieqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahmla32.dll"	Aecialmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oheienli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oflfdbip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bipnihgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acdioc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpnpqakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nonhbi32.dll"	Pehjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpifeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cekhihig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbfndd32.dll"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcdqhecd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbgjlq32.dll"	Bboplo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oooaah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcpgmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmanljfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aflpkpjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefnemqj.dll"	Aeffgkkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bppcpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	9983bc3b57abf4e0a5e412ff2e2449b0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmnegipj.dll"	Pkmhgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bflham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bflham32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpcila32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcijce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ciiaogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibinlbli.dll"	Acgfec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cplckbmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obkcmi32.dll"	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agdghm32.dll"	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjmqdci.dll"	Albkieqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdnon32.dll"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkholi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmjhlklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honmnc32.dll"	Oflfdbip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pilpfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhfaig32.dll"	Bmfqngcg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4088	1568	9983bc3b57abf4e0a5e412ff2e2449b0N.exe	91
PID 1568 wrote to memory of 4088	1568	9983bc3b57abf4e0a5e412ff2e2449b0N.exe	91
PID 1568 wrote to memory of 4088	1568	9983bc3b57abf4e0a5e412ff2e2449b0N.exe	91
PID 4088 wrote to memory of 2284	4088	Odedipge.exe	92
PID 4088 wrote to memory of 2284	4088	Odedipge.exe	92
PID 4088 wrote to memory of 2284	4088	Odedipge.exe	92
PID 2284 wrote to memory of 812	2284	Ookhfigk.exe	93
PID 2284 wrote to memory of 812	2284	Ookhfigk.exe	93
PID 2284 wrote to memory of 812	2284	Ookhfigk.exe	93
PID 812 wrote to memory of 4600	812	Obidcdfo.exe	94
PID 812 wrote to memory of 4600	812	Obidcdfo.exe	94
PID 812 wrote to memory of 4600	812	Obidcdfo.exe	94
PID 4600 wrote to memory of 4452	4600	Ohcmpn32.exe	95
PID 4600 wrote to memory of 4452	4600	Ohcmpn32.exe	95
PID 4600 wrote to memory of 4452	4600	Ohcmpn32.exe	95
PID 4452 wrote to memory of 3564	4452	Okailj32.exe	96
PID 4452 wrote to memory of 3564	4452	Okailj32.exe	96
PID 4452 wrote to memory of 3564	4452	Okailj32.exe	96
PID 3564 wrote to memory of 3168	3564	Ochamg32.exe	97
PID 3564 wrote to memory of 3168	3564	Ochamg32.exe	97
PID 3564 wrote to memory of 3168	3564	Ochamg32.exe	97
PID 3168 wrote to memory of 1704	3168	Oheienli.exe	99
PID 3168 wrote to memory of 1704	3168	Oheienli.exe	99
PID 3168 wrote to memory of 1704	3168	Oheienli.exe	99
PID 1704 wrote to memory of 2776	1704	Oooaah32.exe	100
PID 1704 wrote to memory of 2776	1704	Oooaah32.exe	100
PID 1704 wrote to memory of 2776	1704	Oooaah32.exe	100
PID 2776 wrote to memory of 3180	2776	Odljjo32.exe	101
PID 2776 wrote to memory of 3180	2776	Odljjo32.exe	101
PID 2776 wrote to memory of 3180	2776	Odljjo32.exe	101
PID 3180 wrote to memory of 2888	3180	Okfbgiij.exe	102
PID 3180 wrote to memory of 2888	3180	Okfbgiij.exe	102
PID 3180 wrote to memory of 2888	3180	Okfbgiij.exe	102
PID 2888 wrote to memory of 1172	2888	Oflfdbip.exe	103
PID 2888 wrote to memory of 1172	2888	Oflfdbip.exe	103
PID 2888 wrote to memory of 1172	2888	Oflfdbip.exe	103
PID 1172 wrote to memory of 4148	1172	Pkholi32.exe	104
PID 1172 wrote to memory of 4148	1172	Pkholi32.exe	104
PID 1172 wrote to memory of 4148	1172	Pkholi32.exe	104
PID 4148 wrote to memory of 776	4148	Pcpgmf32.exe	106
PID 4148 wrote to memory of 776	4148	Pcpgmf32.exe	106
PID 4148 wrote to memory of 776	4148	Pcpgmf32.exe	106
PID 776 wrote to memory of 3132	776	Pilpfm32.exe	107
PID 776 wrote to memory of 3132	776	Pilpfm32.exe	107
PID 776 wrote to memory of 3132	776	Pilpfm32.exe	107
PID 3132 wrote to memory of 3340	3132	Pcbdcf32.exe	108
PID 3132 wrote to memory of 3340	3132	Pcbdcf32.exe	108
PID 3132 wrote to memory of 3340	3132	Pcbdcf32.exe	108
PID 3340 wrote to memory of 4564	3340	Piolkm32.exe	109
PID 3340 wrote to memory of 4564	3340	Piolkm32.exe	109
PID 3340 wrote to memory of 4564	3340	Piolkm32.exe	109
PID 4564 wrote to memory of 3884	4564	Pmjhlklg.exe	110
PID 4564 wrote to memory of 3884	4564	Pmjhlklg.exe	110
PID 4564 wrote to memory of 3884	4564	Pmjhlklg.exe	110
PID 3884 wrote to memory of 5080	3884	Pkmhgh32.exe	112
PID 3884 wrote to memory of 5080	3884	Pkmhgh32.exe	112
PID 3884 wrote to memory of 5080	3884	Pkmhgh32.exe	112
PID 5080 wrote to memory of 3992	5080	Pcdqhecd.exe	113
PID 5080 wrote to memory of 3992	5080	Pcdqhecd.exe	113
PID 5080 wrote to memory of 3992	5080	Pcdqhecd.exe	113
PID 3992 wrote to memory of 4800	3992	Pokanf32.exe	114
PID 3992 wrote to memory of 4800	3992	Pokanf32.exe	114
PID 3992 wrote to memory of 4800	3992	Pokanf32.exe	114
PID 4800 wrote to memory of 3136	4800	Pehjfm32.exe	115

C:\Users\Admin\AppData\Local\Temp\9983bc3b57abf4e0a5e412ff2e2449b0N.exe
"C:\Users\Admin\AppData\Local\Temp\9983bc3b57abf4e0a5e412ff2e2449b0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\Odedipge.exe
  C:\Windows\system32\Odedipge.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\Ookhfigk.exe
    C:\Windows\system32\Ookhfigk.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\Obidcdfo.exe
      C:\Windows\system32\Obidcdfo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:812
    - - C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
      - C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3136
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2844
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:312
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3488
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4480
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:64
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1972
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4668
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2772
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3352
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3536
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3432
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5508
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        75⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        76⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 412
        82⤵
        Program crash
        
        PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5796 -ip 5796
1⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aealll32.exe

Filesize
95KB

MD5
99725b5f5e4320117e9a49e72490d149

SHA1
b9b6255c17b5da6803b58812066b103e4ddbade3

SHA256
571df7b07330e35eb7f9ce7480d0c7c5992cd5390513a5416b6ebbb585527084

SHA512
3468eb6ebda70583f70038d88f1a1c06c01482f9b588b977b44e10c012505f0b3c6adc59d8dadccb1fe3682b312c163f20bd81043d9572caf968f175b8f08597

Download Submit
C:\Windows\SysWOW64\Aflpkpjm.exe

Filesize
95KB

MD5
2a0b38f8b8a07157433ae64861dc71ac

SHA1
ce151184665415120ee839536792c7e4ebec291c

SHA256
ed9e6d28933db18d5c9dd0228d96ddab21caba697f9bace6c9a224611e5e3638

SHA512
a97aacbea6594487a329ba0b317fffa38d8f027bbf275b7c15dc402a39db773a77a1f35325fe319be8a7c1bc71f55c867f923b13fb9e718d3ddfc322ae058a8d

Download Submit
C:\Windows\SysWOW64\Akihcfid.exe

Filesize
95KB

MD5
f6e47465294c79f67badd20280945f5e

SHA1
e1f7609d51228935ffe0ade601344676b7bab046

SHA256
6121a9e1217f3c640589af1f05514b4056cadaf1fde7c1e65ff783488172970b

SHA512
2ccc1e6c6a4bbd0d6b5187a9fbf33c48ff57cc29646b7e989a17c4cdd6afe6b69acf2aa837a46844bd438547168711ffd7bb6d2ef073f4231787ca8c1ec50773

Download Submit
C:\Windows\SysWOW64\Apddce32.exe

Filesize
95KB

MD5
db466b2b85a1d45d0edd00a0cbafc563

SHA1
6815cc815dc42f549089b8acb578e7d88d842494

SHA256
3559b0334e39a5bc1f4696e14289eacc3f4e88ba3b4a5fb0f4049928ea4e96ce

SHA512
9d53b4bacd485e662e4e4226917a03e9156741f97bcd51f7c84ca5306404457fc66e75477be23c7a901d43fc52c7b569c82e2d2bf4a3ce89061f53a879bbc291

Download Submit
C:\Windows\SysWOW64\Cleqfb32.exe

Filesize
95KB

MD5
d285bb078a2c102f691085842b3b633f

SHA1
48b65a34fc54b1d0843a78e8b5438f9542385eac

SHA256
ece119b8f86d9f4f63324583633db7967b880edd47129165cd00d1209d9d330d

SHA512
a1c404238b2506b3d850a96e785e535e974b45f144df4114ca0963e1386ef4b5ddf057bd02ab4b8477349c2c784b626b5b41bc8624a93d0ecd345fe26c42cec7

Download Submit
C:\Windows\SysWOW64\Cpcila32.exe

Filesize
95KB

MD5
4417c4789a56787002be93eac2fd41ad

SHA1
704f4a7ff3eece2b7e25207ed0ddb6bf0965de77

SHA256
f0ac3a503e4573de7ddc2bbbf8552fbfdbd0df18228579d40b1707fe97b79cec

SHA512
56c85d2b059875a439fcad40bfdfe811a6e2e0d29a9a1621bf8998bd21cf427ea4b63e0a5d0f5c1b8378d195d93a88195940632d67d777d49887d7f4c93bc56a

Download Submit
C:\Windows\SysWOW64\Nbfndd32.dll

Filesize
7KB

MD5
02f0ce9a4b8b78219da89733b2ee302b

SHA1
613847f89966d6542e10a8fb425f98939b65c5bc

SHA256
cf02794b315fa7cacaeac3b8c40a8fb0dc9974726f6136f5c492211e940854f9

SHA512
f42ad1739370dea8913d755ca0e6c44eee25de107bc632dbe1632746dc485b06dcedd297b76e525e70261a4c9724106c8e733bb4e7cef4f975185ecc02a5db23

Download Submit
C:\Windows\SysWOW64\Obidcdfo.exe

Filesize
95KB

MD5
8d9c44740e0efcb5236a795ddaac96c8

SHA1
1e7d933d59c59ba056988e7b24d9b8a1845141fd

SHA256
125904aef3f5ee10cd1ea747891ee718a31e614f744333d83ecd69829d4bcf91

SHA512
79fee1d025180d4431864e482669a8aa348da214c651e94f5df0af7f0975cd346958ea3fa14ed7a5e5fe7b6bfbffbb7de22f90cd2de0414518626b88ddaa2019

Download Submit
C:\Windows\SysWOW64\Ochamg32.exe

Filesize
95KB

MD5
be68a708cfd5b5bb8a0917ed5ccc7494

SHA1
7445a8bec5fe0335f6dff96f7873a4dffd28c23b

SHA256
7c9cad1918c6ac0a7ba3c55cddcb22941ee7777861c142b7cc48ca35137e2dd8

SHA512
b95b5aa848f8d8e190f6b6aab2436c25125192d2e6fd6e1de0f3af3c49b4f4d0aee742f8cebcbb04226cc199ee09d0f1d440a0b23d4853b6dabd186f582f11e8

Download Submit
C:\Windows\SysWOW64\Odedipge.exe

Filesize
95KB

MD5
6c5633e17dbb16bf1de25262f87f850d

SHA1
ac006e4baabe08b1d2db89db8a3a6ab0e028e7b5

SHA256
0abdb396674c6461d20f1afb69a789ae4a629cbac2198e5bd27202e8560ecf5f

SHA512
55898619f4c472d3c388ce6693ab738b0bb53edcc84600defd294619839007f0825e6bd5e06b37725fc1a700cd04d93f9ae991a4e0dfa4c55cceab55b4cb6b17

Download Submit
C:\Windows\SysWOW64\Odljjo32.exe

Filesize
95KB

MD5
224d0ad6f9711f51ab83f45f9f88319a

SHA1
3ed3bc31cffdd866e229517ec4cbb680b2be1ea2

SHA256
dc017f818f6802f9ddd917bdf0426da55f663450f243f7b5b63486eee22c56b0

SHA512
62aa9a7648a524def96127f2326d9994a0ae8b7f62687d79527cbc1b159927157e97f91eb4532bba8dd55816caea5a410804b8b2314ca9330815d5ad971789c1

Download Submit
C:\Windows\SysWOW64\Oflfdbip.exe

Filesize
95KB

MD5
ceaaeca8055c8473bae1320dd4ae9095

SHA1
4ea587913adc02cea4b7544c2f99d8e9e37b464f

SHA256
90cddcc0d1e1a2e4b52c790b4bd14d0637602ab01f5bff1698e935d410c0a0b2

SHA512
54e6b920cf70f43d8e84125b2fa913e141fbd7a3b071b84b8b19c14c7dd1729781817a5c5949d86ac3476b7919681a147988c5716514aeb33ab566d9b41f6e13

Download Submit
C:\Windows\SysWOW64\Ohcmpn32.exe

Filesize
95KB

MD5
db15b84eff36cc0fcf1429da2a4b7f02

SHA1
0a804d50b8096f53cd0bc1ea62fa834bd800a541

SHA256
ea9db0094b0544c1f9d044b94ac4edb2a6aafba115308dd9f5d9d4e49dd5d278

SHA512
5f8ca17076e10d33426729764a52e0a3b7003e36ef5455750853007121e14b3291c44a20538c5f9273f97adc6b3137d22d133cb718fe25f8448d76887e2642b8

Download Submit
C:\Windows\SysWOW64\Oheienli.exe

Filesize
95KB

MD5
79df55c4f68aa7b259a48836fbc6e1c9

SHA1
8216428f93b874b748c0aa742bf0bb87b2934727

SHA256
5cba7c1175bef9a2b3e4a87ca9e6dab84a1e31503222b3204f7dcf7604253aba

SHA512
7ddc6fcfbab9853f770ec3e621463f9fc371801f176e241bc57237f5690f5f6bd52e22900f8180ea541acd7abbc68145712ee80a8a17d98f780fd0e4eef20bbf

Download Submit
C:\Windows\SysWOW64\Okailj32.exe

Filesize
95KB

MD5
7d5b3dc9881486dc38df4d63b7b10844

SHA1
aafa0973a0b599e653c0b8d2be021364063218fb

SHA256
732ac8d3c55f32b717d6bfe65daabe865e634dadbc86fb42b1cf00bdd5125a16

SHA512
cad2c1278754468f5bf44dcfe6c9988efac6a80111013e81d2f968e19e7f5c97e1bb6c5c9120961b2901db25d5e1185b87886479b624c4da24f6a23b551c3252

Download Submit
C:\Windows\SysWOW64\Okfbgiij.exe

Filesize
95KB

MD5
b19c0eb4659d6583eb99dc51ffe04f87

SHA1
f8d3dfb0df501d08b9b5dd2dc085c330fad3f826

SHA256
ecbb26488b21b7d4d9254e0ecf11c54c4facb74bcdf05e24be2e93802d6ea510

SHA512
ea65e746cf912c565b86b5d19d7b3f01307ecb264a0a59eb7aab658c1bb1cdb8c0e1ff0fcc12af5ad14b4a159daca5d4908c33afc911b9e2921269a245cc3486

Download Submit
C:\Windows\SysWOW64\Ookhfigk.exe

Filesize
95KB

MD5
10d29fea2fe603845900d8056cce7aaf

SHA1
aee97917f316eadfc5b774432cbe83774885a6c8

SHA256
3ce46a03a860bd3d4c5ef0ef14b8aa9c81ea5959ed518229855c60d5a0b947e1

SHA512
015e56234a0780584628d0b1c1c0da83d8fd840f3ccddcded8a18a17118a508ed949d326f686a2992559227fddde5abbb18836db4f6f19dc1798fdc5ab681dc9

Download Submit
C:\Windows\SysWOW64\Oooaah32.exe

Filesize
95KB

MD5
fe5e66f50a0c37d8fe2e95f559f84fec

SHA1
5f83c213ba192a17dae5a9a86efdcdeefce49216

SHA256
91c7ae5b14500f80b544d4e37ae36d12adb6e25aad1b4f319238726d6d974d0e

SHA512
8782b1396f8584581e8e423e0faa339635c5edcd0af237798251d46d882770d7bfd1f2f546430ff74978614b906333a7ab6123c39b8dcd9ee639127ed4876eb5

Download Submit
C:\Windows\SysWOW64\Pcbdcf32.exe

Filesize
95KB

MD5
4ea3c8bc1fde951448070ccb7c38906e

SHA1
dfe19c0bad8f6e8d538a58eace32db4c0206a4d2

SHA256
48cac4fe532fe4cc76a90132b0a847c227fc29e82692880630706612290412fd

SHA512
d8d5b02506329b5845e85945b3b1bdca31cffa235f3b7e7f62b993a02b80d9ec675018b26a598ce5c111135154538e3358fa706be6ad9fab68efdd3fa5198501

Download Submit
C:\Windows\SysWOW64\Pcdqhecd.exe

Filesize
95KB

MD5
63a3d253336cadcde534161706bce3c3

SHA1
14dd5fa89c076778b20ed74d21535e9e31584ffb

SHA256
0d9318af62e74ef09cb311592cb7543503e406faa3fc31b43b48917b601a1505

SHA512
10579d7e0a9202be48b1014c8a727da0f8f5957c231a4fd5b64369ab637bc79c698ba0207c5b4d06a5069250cbeef26c867bc256b2434f487dc811a9c67a5178

Download Submit
C:\Windows\SysWOW64\Pcijce32.exe

Filesize
95KB

MD5
cdab69acd77aa42fd9e4318f011a8009

SHA1
029be24059ea1cc1255e22a8b45ac152c2f91688

SHA256
53f24e29784e97ae9c56582e572db90df1ead91901b30b3c257061b18fd0c83f

SHA512
c72dd396ebdbcc1878c37d57d87ffca5c3337998026c9802c9c2214a248f74dd960dbfef50e40f8e7e63fe8e9873a262a205717b450299d33c4ddbeb8a4cf42f

Download Submit
C:\Windows\SysWOW64\Pcpgmf32.exe

Filesize
95KB

MD5
d07dc26747098f493ef88b4beebb4c6b

SHA1
6fb54589b5498f0d3730d7ee05c9bd1f59254620

SHA256
aefb8601b126e2ca99804beb8c5c1f3285f068d16c0422d5f5dd7422109045ae

SHA512
09e7c423c4ac4203d52f25fe0a55a830fe0ad94a7c39aed2fa273b487efaa8c264df0d5624bfbd4958b75ca658450afdd7cffee8e4adbfc7f96672024a882559

Download Submit
C:\Windows\SysWOW64\Pehjfm32.exe

Filesize
95KB

MD5
31617691a5521bfd595baaf8f7e2e809

SHA1
21ba04537d2b5a7168507aeddceb562b33939e02

SHA256
b5469f24259ccc4fb4b3da9be7b50bea0f552459ac8d6b3cb8bc31fe23d9d8f5

SHA512
2e3f9c2cf27cbeb82bc0bfe0e04024bf8c3496b569491ae83d234f9da4e573bc3f2fcee169c200053071efaa036a473a6dec067bf08786d0934b79fae427e072

Download Submit
C:\Windows\SysWOW64\Pilpfm32.exe

Filesize
95KB

MD5
b09c952785976a134fbf6fa85fe91036

SHA1
2d1a4f66d95de570c7d3117c9bb7ec86821ce7c9

SHA256
dd18b8a619e675a840d3767c996a49d7c00c8c40ae731796d01d584518fcda21

SHA512
fab5c3efa4afa2d24e8ea94393cbf5fe836666ea066ab8e3c8474cd2f39fe804c7f66b65f893782a81937454e6c345b4250e014631b2f260c9ee5e40029d0142

Download Submit
C:\Windows\SysWOW64\Piolkm32.exe

Filesize
95KB

MD5
2c449ff891b4b79f528fcd4c9e1559af

SHA1
c64b8de26baef80635541c15b7b8f09b05f18ca4

SHA256
e80fc5f60cd3e3e68ba7a22d1cb4d5b2a4ea5cc9c5b214e2b7c0ba1481b8f16d

SHA512
a48643dc4017133cebf8c6fc8bb38ec22e1cda5e6a6d0bfc8f00397f3589dea69568e11bad392f4fcc748cf729fc396ec758fc4e1d9540649c22980a3653de5b

Download Submit
C:\Windows\SysWOW64\Pkabbgol.exe

Filesize
95KB

MD5
149a50dd665777b9f9ffd9fc101b7af2

SHA1
0c5ddcb962b50c4515f902c2386c38196f8696ea

SHA256
a2554e1da5e5322af7e67f9633b16bdd7f7ce0e3ffcb120f07b99ac934d6db4c

SHA512
3dd570e3206e4159ea7bf161ade3ed7ef1b93bcf2b9242955ab50c071b60329937787af4d0c2c7633e8a140e5ba06b71450f645d138de2af044cc508356cfc8e

Download Submit
C:\Windows\SysWOW64\Pkholi32.exe

Filesize
95KB

MD5
670c949c1a7f0d34fc9ce5e96f600a15

SHA1
0e262d8bf84a4d2068a4b38882310e7b0ab2db5e

SHA256
7240bcadb5cd06353e8d0ce19dd0f081b16f18de849ae0da526c6f78c4477c82

SHA512
b4a207d108c79b8cf35c9e0401930ffc45a4a7d88d87eee1ca26bddf688f56159ae2ee0f32b2421a0a81e3b91d16dfcc81cf4635a40883c251f6518bca287d39

Download Submit
C:\Windows\SysWOW64\Pkmhgh32.exe

Filesize
95KB

MD5
88dc3513199878dbb1c99aa5125feee3

SHA1
781acadab6853619cb5fc002b25f219ffb9bc17a

SHA256
70d0fabae59b520d13b0b2df20bd416113ab0d0fe7de8c33316ca71e5ab7240a

SHA512
4a8c11e33e62b5fb6f342e874f28c2c3afcbadfe7b4a507a7dbf5449d32376edad446e424c4b32e9901e7cf6a2642cff32ff0541370c93e885632acadb9ee56f

Download Submit
C:\Windows\SysWOW64\Pmjhlklg.exe

Filesize
95KB

MD5
14d082ff25367366c45894b27d08ebc5

SHA1
cfd45ca13487b726803c32761b8116db9129fc73

SHA256
61427064254aa44c3d4f041818afd0c3c4bc7eb5ddddec97c8b7a17f3f4cc72f

SHA512
3ddab4de605c237752cef4be0d42fbb56ace4232d02321ef765f3b8908c092d11ae7dd79cb95565dc0cac162b1663b585ee823d0e0ca2e475cc5beac2f1f8cd4

Download Submit
C:\Windows\SysWOW64\Pokanf32.exe

Filesize
95KB

MD5
850cee4dfb8052309dbe22013f68c905

SHA1
ee70078956227e3190a75775b13051ad60bc7fc5

SHA256
17bca2705667b14ab99ad838a6ff88b47075654997be5e1e992fe1fef1a4d354

SHA512
53d1326c182364dead7836c5d31eeb9f939a0f25807a408d4f041dbb8bbd99ec59cacfd873047ab1af011e2b1a4fd69ec72c168a06a1b2a7dc2707d1f119457f

Download Submit
C:\Windows\SysWOW64\Qelcamcj.exe

Filesize
95KB

MD5
25537f45c69ae881a6a1793861898c59

SHA1
a4a18706a1c21a0fb71821975ffc50f18d6aceda

SHA256
0fce8aa7151552fd969725018c2773d7ff637f4dca4f2661e66edfd6d6b02e7a

SHA512
1559c6833f9cbc225babfcae77b27ea123f8a368a8f89e612058422e04d8eadbf5790d25d3e6f6face7b2f3bf53cf2a64e22f6e460c41d09ebb9bf31b2ae46c6

Download Submit
C:\Windows\SysWOW64\Qfgfpp32.exe

Filesize
95KB

MD5
0dfe0d22d985aefb308bb7980ffa35d4

SHA1
8697ce24c470f5dfa7e823ead29b10204e1fc711

SHA256
8748723c6854e813f2a0729f86d1fc765516b11d28c3c8d3062eaf12dd0f6b7c

SHA512
c8e51cd94e1f5c34899732566f44a12d54521fab3591cd3524936d24616e531c01040a9e09a8304d2e3e3633275b6b7fdaaefbd353d7251811d16290b1dac6e5

Download Submit
C:\Windows\SysWOW64\Qkdohg32.exe

Filesize
95KB

MD5
232b51f0deaec197b099f6d6d84ad2a9

SHA1
a0a59f323e2994293d571ee93d2aaa76398ad450

SHA256
8a48a365cf008fc944d7f6ad38799d3ad90b1a84416bf37f54c2e5fced75395e

SHA512
d251abbfa9575e967d1d4d018f7a8734d10a10ee122d1591d538a13953d0269eb5e654869a5614991923b7e48abec939c161238e83f970e8499c93b507d40d3e

Download Submit
C:\Windows\SysWOW64\Qmanljfo.exe

Filesize
95KB

MD5
006cdd499f475c08b99fe0680780fda6

SHA1
4c62baf9e57989135f6420c155e24370bcf61fc1

SHA256
31d52f0c10de546a9fb930fa56c46cf073794f200c7808e7cfa515a4d8711074

SHA512
815794540d05889d694a19cda22c9b104569e5bbaf364e8d722c68f2484351dac5e06ddc9ad391b2917b25a4299e18b83c33e520de7883477ed8f6f183fb25f8

Download Submit
C:\Windows\SysWOW64\Qpbgnecp.exe

Filesize
95KB

MD5
dc8bf4ccd14c3ba1e7d26a0c5e16d4f4

SHA1
a19a06ec9e2a440acf183a0f4b3c250a2a3ae90f

SHA256
1122f519986fca3e41d9fdcaebff62f39d1a4f3d8ccc3bff726a0a8c8fa048a5

SHA512
91d2867fc7366a6f3bd9b4aa89144787ccbcfb8e9cb059fedb4194d6251a510ce62bd827bc1064ddad79444c3b4ddd21ef140210c7fb06911447a2fcb4019da2

Download Submit
memory/64-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/312-204-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/776-111-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/812-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/872-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1040-231-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1172-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1356-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1536-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1568-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1568-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1704-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1720-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1740-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2052-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2136-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2156-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2192-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2284-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2336-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2488-247-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2548-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2772-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2776-71-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2800-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2804-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2844-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2888-87-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3036-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3068-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3132-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3136-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-55-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3180-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3252-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3340-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3352-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3368-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3468-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3488-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3536-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3564-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3884-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3992-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4060-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4088-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4148-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4280-192-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4360-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4436-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4452-45-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4480-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4564-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4600-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4668-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4800-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4840-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4944-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5080-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5132-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5176-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5216-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5216-559-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5256-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5256-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5296-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5296-557-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5336-556-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5336-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5380-555-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5380-484-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5424-490-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5464-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5464-554-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5508-502-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5508-553-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5548-508-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5548-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5592-550-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5592-514-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5636-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5636-520-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5676-526-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5676-549-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5716-532-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5716-548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5756-547-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5756-538-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5796-545-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5796-546-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads