8d334ca7d16ff62db6d07230bed6453d2726774c49274634e1c829c8e783ecd2

Analysis

max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca850c8e5b274aed5f83cdc8b15e56b0N.exe
Size

92KB
MD5

ca850c8e5b274aed5f83cdc8b15e56b0
SHA1

d22b6fb310c5260b82f2d0fc9b8c9ff762c533cb
SHA256

8d334ca7d16ff62db6d07230bed6453d2726774c49274634e1c829c8e783ecd2
SHA512

69d54eb4a88cd45a3fc8e3622a6b4da81c2646f0796d427f5805b5f17c3645d54e5848ef84342aa60bf0250b67177417ccc3899e43e777ca8a1efd882c2807d5
SSDEEP

1536:oG95EqG+xzrgv4RAA3Mi/3moMjXq+66DFUABABOVLefE3:xlxzr24RLHeoMj6+JB8M3

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nckndeni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogbipa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	ca850c8e5b274aed5f83cdc8b15e56b0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe

Executes dropped EXE 64 IoCs

pid	Process
2004	Ndfqbhia.exe
3984	Njciko32.exe
3864	Npmagine.exe
1912	Nckndeni.exe
812	Njefqo32.exe
2516	Oponmilc.exe
880	Oflgep32.exe
4484	Olfobjbg.exe
4540	Ocpgod32.exe
1392	Ofnckp32.exe
1892	Olhlhjpd.exe
4032	Ognpebpj.exe
896	Ojllan32.exe
2856	Onhhamgg.exe
3604	Oqfdnhfk.exe
2372	Ogpmjb32.exe
60	Ojoign32.exe
3428	Olmeci32.exe
2620	Oqhacgdh.exe
4892	Ogbipa32.exe
2532	Ojaelm32.exe
1952	Pdfjifjo.exe
1820	Pcijeb32.exe
1720	Pqmjog32.exe
3972	Pclgkb32.exe
2824	Pfjcgn32.exe
1412	Pgioqq32.exe
1448	Pjhlml32.exe
4656	Pcppfaka.exe
1576	Pjjhbl32.exe
1404	Pqdqof32.exe
3332	Pcbmka32.exe
1960	Pjmehkqk.exe
4884	Qqfmde32.exe
1964	Afhohlbj.exe
2788	Anogiicl.exe
2280	Aeiofcji.exe
4500	Agglboim.exe
4964	Anadoi32.exe
2880	Aqppkd32.exe
3496	Acnlgp32.exe
1948	Ajhddjfn.exe
1452	Amgapeea.exe
2632	Aeniabfd.exe
8	Acqimo32.exe
1080	Ajkaii32.exe
3068	Aadifclh.exe
4844	Accfbokl.exe
3104	Bjmnoi32.exe
3708	Bmkjkd32.exe
4980	Bebblb32.exe
4972	Bganhm32.exe
3880	Bnkgeg32.exe
1188	Beeoaapl.exe
1680	Bffkij32.exe
1436	Bnmcjg32.exe
316	Beglgani.exe
2868	Bgehcmmm.exe
2392	Bnpppgdj.exe
3052	Banllbdn.exe
1860	Bclhhnca.exe
2472	Bfkedibe.exe
4724	Bnbmefbg.exe
5076	Bapiabak.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gqckln32.dll	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Acqimo32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Lipdae32.dll	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bgehcmmm.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Ofnckp32.exe	Ocpgod32.exe
File opened for modification	C:\Windows\SysWOW64\Pjmehkqk.exe	Pcbmka32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cjbpaf32.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File created	C:\Windows\SysWOW64\Acpcoaap.dll	Olmeci32.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	ca850c8e5b274aed5f83cdc8b15e56b0N.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Dobfld32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Gpaekf32.dll	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pjhlml32.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Njciko32.exe
File opened for modification	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File opened for modification	C:\Windows\SysWOW64\Pqmjog32.exe	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Ocljjj32.dll	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Ojllan32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcgn32.exe	Pclgkb32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Agglboim.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Ndfqbhia.exe	ca850c8e5b274aed5f83cdc8b15e56b0N.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Halpnqlq.dll	Pdfjifjo.exe
File opened for modification	C:\Windows\SysWOW64\Pjjhbl32.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5900	5784	WerFault.exe	182

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olmeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogpmjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njciko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqdqof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca850c8e5b274aed5f83cdc8b15e56b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndfqbhia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekphijkm.dll"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	ca850c8e5b274aed5f83cdc8b15e56b0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfnphnen.dll"	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Booogccm.dll"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debdld32.dll"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdjlic32.dll"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoihl32.dll"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfbgbeai.dll"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chjaol32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2004	3932	ca850c8e5b274aed5f83cdc8b15e56b0N.exe	84
PID 3932 wrote to memory of 2004	3932	ca850c8e5b274aed5f83cdc8b15e56b0N.exe	84
PID 3932 wrote to memory of 2004	3932	ca850c8e5b274aed5f83cdc8b15e56b0N.exe	84
PID 2004 wrote to memory of 3984	2004	Ndfqbhia.exe	85
PID 2004 wrote to memory of 3984	2004	Ndfqbhia.exe	85
PID 2004 wrote to memory of 3984	2004	Ndfqbhia.exe	85
PID 3984 wrote to memory of 3864	3984	Njciko32.exe	86
PID 3984 wrote to memory of 3864	3984	Njciko32.exe	86
PID 3984 wrote to memory of 3864	3984	Njciko32.exe	86
PID 3864 wrote to memory of 1912	3864	Npmagine.exe	87
PID 3864 wrote to memory of 1912	3864	Npmagine.exe	87
PID 3864 wrote to memory of 1912	3864	Npmagine.exe	87
PID 1912 wrote to memory of 812	1912	Nckndeni.exe	88
PID 1912 wrote to memory of 812	1912	Nckndeni.exe	88
PID 1912 wrote to memory of 812	1912	Nckndeni.exe	88
PID 812 wrote to memory of 2516	812	Njefqo32.exe	89
PID 812 wrote to memory of 2516	812	Njefqo32.exe	89
PID 812 wrote to memory of 2516	812	Njefqo32.exe	89
PID 2516 wrote to memory of 880	2516	Oponmilc.exe	91
PID 2516 wrote to memory of 880	2516	Oponmilc.exe	91
PID 2516 wrote to memory of 880	2516	Oponmilc.exe	91
PID 880 wrote to memory of 4484	880	Oflgep32.exe	92
PID 880 wrote to memory of 4484	880	Oflgep32.exe	92
PID 880 wrote to memory of 4484	880	Oflgep32.exe	92
PID 4484 wrote to memory of 4540	4484	Olfobjbg.exe	93
PID 4484 wrote to memory of 4540	4484	Olfobjbg.exe	93
PID 4484 wrote to memory of 4540	4484	Olfobjbg.exe	93
PID 4540 wrote to memory of 1392	4540	Ocpgod32.exe	94
PID 4540 wrote to memory of 1392	4540	Ocpgod32.exe	94
PID 4540 wrote to memory of 1392	4540	Ocpgod32.exe	94
PID 1392 wrote to memory of 1892	1392	Ofnckp32.exe	95
PID 1392 wrote to memory of 1892	1392	Ofnckp32.exe	95
PID 1392 wrote to memory of 1892	1392	Ofnckp32.exe	95
PID 1892 wrote to memory of 4032	1892	Olhlhjpd.exe	96
PID 1892 wrote to memory of 4032	1892	Olhlhjpd.exe	96
PID 1892 wrote to memory of 4032	1892	Olhlhjpd.exe	96
PID 4032 wrote to memory of 896	4032	Ognpebpj.exe	97
PID 4032 wrote to memory of 896	4032	Ognpebpj.exe	97
PID 4032 wrote to memory of 896	4032	Ognpebpj.exe	97
PID 896 wrote to memory of 2856	896	Ojllan32.exe	99
PID 896 wrote to memory of 2856	896	Ojllan32.exe	99
PID 896 wrote to memory of 2856	896	Ojllan32.exe	99
PID 2856 wrote to memory of 3604	2856	Onhhamgg.exe	100
PID 2856 wrote to memory of 3604	2856	Onhhamgg.exe	100
PID 2856 wrote to memory of 3604	2856	Onhhamgg.exe	100
PID 3604 wrote to memory of 2372	3604	Oqfdnhfk.exe	101
PID 3604 wrote to memory of 2372	3604	Oqfdnhfk.exe	101
PID 3604 wrote to memory of 2372	3604	Oqfdnhfk.exe	101
PID 2372 wrote to memory of 60	2372	Ogpmjb32.exe	102
PID 2372 wrote to memory of 60	2372	Ogpmjb32.exe	102
PID 2372 wrote to memory of 60	2372	Ogpmjb32.exe	102
PID 60 wrote to memory of 3428	60	Ojoign32.exe	103
PID 60 wrote to memory of 3428	60	Ojoign32.exe	103
PID 60 wrote to memory of 3428	60	Ojoign32.exe	103
PID 3428 wrote to memory of 2620	3428	Olmeci32.exe	104
PID 3428 wrote to memory of 2620	3428	Olmeci32.exe	104
PID 3428 wrote to memory of 2620	3428	Olmeci32.exe	104
PID 2620 wrote to memory of 4892	2620	Oqhacgdh.exe	106
PID 2620 wrote to memory of 4892	2620	Oqhacgdh.exe	106
PID 2620 wrote to memory of 4892	2620	Oqhacgdh.exe	106
PID 4892 wrote to memory of 2532	4892	Ogbipa32.exe	107
PID 4892 wrote to memory of 2532	4892	Ogbipa32.exe	107
PID 4892 wrote to memory of 2532	4892	Ogbipa32.exe	107
PID 2532 wrote to memory of 1952	2532	Ojaelm32.exe	108

C:\Users\Admin\AppData\Local\Temp\ca850c8e5b274aed5f83cdc8b15e56b0N.exe
"C:\Users\Admin\AppData\Local\Temp\ca850c8e5b274aed5f83cdc8b15e56b0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\Ndfqbhia.exe
  C:\Windows\system32\Ndfqbhia.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\Njciko32.exe
    C:\Windows\system32\Njciko32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Windows\SysWOW64\Npmagine.exe
      C:\Windows\system32\Npmagine.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1448
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4656
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2880
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3496
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3104
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3708
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3880
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1624
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        70⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4300
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        72⤵
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        75⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2912
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:532
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        79⤵
        Drops file in System32 directory
        
        PID:1416
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        81⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        85⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 404
        96⤵
        Program crash
        
        PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5784 -ip 5784
1⤵
PID:5872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
92KB

MD5
5a664ab3c22cc5543acc5b73fa8af645

SHA1
c76e97abc476673f2938b297f7efe1ce4ce1d70c

SHA256
8f694c176fe6ef175d01c4fac8477a214fff576d594b41e651f6066946d94074

SHA512
d08ac11ca865afc3964c13f2482e9f3f0451d650c5a991ed6d1e92c470e2e6a90b5163bdfdc1ecf11d8d7fdb4e1ad81e39c314304a4a230d5495d170cf1d4bd6

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
92KB

MD5
c970ef76dd4ec4d8466bdcaad1aa088d

SHA1
c83db9757afa9cb217f7cafeb026d394d84a10bb

SHA256
1d36f98749dd5590b5f42b56376923eceb1fb7f81467b5a14c650fb1477170ef

SHA512
e1be4d12901fac4aefd1c2c163cea45dc74201bf1523ef4f76e056720919394664a6e7d038a529e9778b33ecca98669d3abdd2588052da47a1dd839242b11c2f

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
92KB

MD5
a111dbeac42dfb1cbd4cfbf249d5c523

SHA1
73d428de87d1a4967859c552fdcb01313ebebd5e

SHA256
7b1542662f764a542377a6ae8bc39ffac888b0ea967039187f45cb1f1f7d8025

SHA512
f82f5f6d37da04fe17b2234526dfc2957256a67750660d2a9bb4ff0a41d5213321650931fc62fb76cfa71f5a8c4cc1ceb87a8115b3dc2110ff1a0f23dc4f8abb

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
92KB

MD5
6f0918ca2dc6dd7b88245d1b26070331

SHA1
f79f40ca3bc943ef7c5054bc86db8170271a0eb6

SHA256
8e6ce6a3442629c72de32777c594275e85742d18d2201536e2decb5d5dae9999

SHA512
0c20fdbba7d728f82ec0d06ae56b0fd513084c2f76876600d2e6cef8b239b9d33d62e3076a8e3c73c2e964d41caf2a51df263089d561b0f78e78bba20c7cb524

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
92KB

MD5
7e185b00d6cfdf4ba6ba825fdce49323

SHA1
a62cf62a76af9e115826fa7a97d6de215b3062a1

SHA256
b8acef378d0ee969bead2517ef0dc1cffb9c5cdfb8cce3eca77ee9a18a1bb4e0

SHA512
acb4719dce4b1948cd51df4002dfbec7e1cb5bf58e3623b6ff7c06675dc112bb47c189ede247af1ed9a55c93f9d56f5bb48438591f84ab562ad090bcee304cb2

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
92KB

MD5
38040fa082e5cdf95d43241670b1d5bf

SHA1
f771c068090150c58383a2a2f99d540cb4c3943e

SHA256
4c44a1f5334733a1fa43c7d2164ccc63edb12190ff08f060d4df12e488d04dd0

SHA512
1de4610b9be329ed21a241e07c0fbd9b99d1b54cd80a38b3992f5b0d6625e22b4adb63b8a7460344224ce5a0db3a858f552a591510074f7378ad6c508db5307a

Download Submit
C:\Windows\SysWOW64\Ocpgod32.exe

Filesize
92KB

MD5
f5d08b6c20d3863fbc68b928b0c26e7b

SHA1
de10cb11b575969d4d26ca86d0a080df4bac8af9

SHA256
5dd6ac3296377f6ecbf57bef3af48f1c898437e8663a4256702956c5c5bd5092

SHA512
f9785a513e12872c03d0bc2e7bb3719a7dc61e2a2fea85f06b877001e4db039edfebf41970cda85eb8a13c8a94ff4a10b69713f9a13e366811ac2bb66305d3fb

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
92KB

MD5
5bc6aeef1f59c9c5f3e41ed654aebdb7

SHA1
60bad3eab00921190836d87c0f6f8e843c9013fc

SHA256
ee5ea1326370ce9123c54531ca9ea710799a321714c33f3178edf491546265fd

SHA512
d9cddca6abe86ba84e44260e669278d973bfc46f36ec030c639249d1a7ad1f553463bfc66c9a8ead735a020af980df0316833241726fe6d86d9295b8cb6e307c

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
92KB

MD5
464c7e157b873f4665a9f5dc19c4982e

SHA1
f08c0ecafd68823e9d74702c5769d55a9ccd0411

SHA256
85f50b8b8b076c3658bd63cfafb20f8fb847e96e1ba713ac5a40c9b4217166f1

SHA512
8cfcc25ab1be1232c15e38b9483abb04ae9e280a52927082b5054a08650f13b85ddf881999931a42ad7d871e4ab749f6f71c85ca9d9e9c347142ad8ae7aa0777

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
92KB

MD5
3041213d81d0ca29b00d29ba4d42d0f6

SHA1
12cc744f2469b62202c7600983410bfbab74e24b

SHA256
dd157b4cf4666789b028d1beead79b094d2b4bf4bf9918d19c7bf546543d5e8e

SHA512
c38914f7eab510c42b895f228d070a7745df47251c42a85174ceb07469d9be2efac2ee7d29e64b4ca69432ea40109be4cbb3ada01630b52014ee8466e4e386e3

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
92KB

MD5
f017a98ff0f782d2da1d0b3e4cc2f0cb

SHA1
ce113f38908066998689798537e696ad4374601d

SHA256
40049bf23a4cd50138d7ff4e3a09ac39a24672f611b9cad064513d344c6e3c90

SHA512
1757c3c58f4218384ebd8e74ecf24e8058de91057fa6fb6b86ea01d5e1af9b8ae77549c796e3e9708b09080724fd8d72e78594e1953cdf8ebcfd17eea87692b3

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
92KB

MD5
21a4149765baff49886e12bd93994360

SHA1
7c7cdf77061d432bce36df2f48eef51ed927a85b

SHA256
cb38f251c63d6cb715daad4f67795197146c8371f5b6b1a70bf65014c127ab06

SHA512
df3f069005b7cf20b2e47e9460b03ab25b131eedf8fb0a06c320ed34e5b7649d5699ac35305d1865287d29866b9f5467a0ad5353dcd023dc5e464fc0292e7dd0

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
92KB

MD5
41189d934f7ab1e989e1fbf67025605c

SHA1
fade57c72307b72c029862eea560bed8b53d6085

SHA256
68fe34c631d7ca0448df0d6ede149eaf90a5eaef127c18cf90de8c77e23960e0

SHA512
fb7adb56d37f12bf72b3caa1a0b4b035ed9e49363c2f5c5571356190d75fc985882c301ae62cd7b09e2c3221afde531bb688e9b11613539680bc7051a0b364c1

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
92KB

MD5
2c0ca9b5c5b48c89330c878f1acc6ebe

SHA1
6965acb629ab85b82c43f673618deb998de93668

SHA256
447b4af9b5abe00c8ac8676c059faaa15c93d24a360ab17656317c20567d4517

SHA512
23ee81f4edab40e8b707135f4280e8ab71ccad027f3a37ad70acf0c44d011419d3d1a240c1511dd01d8395127595aef8282d24d4d80af04cf1d8e8be2de069c3

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
92KB

MD5
ee32394dd809b7ac1fdab2e3d2b95b05

SHA1
9b8ed33068c0ac80bf463db0281f0ba3cd5dfb92

SHA256
85c7f555019de697fec1bce33a03aef8a8e85b6e25477b10b409654ae16ccc70

SHA512
ac45502bf881ea7fa95abf6f3b644437b0cf66bf7f11aad1223ddc17acf7c69e468b9c7553ed41436e18513816f92bb72aa27ce36e55a4c673462a4a69aadfd3

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
92KB

MD5
a8709a11a7c9a9cd59fabbfcef457bf7

SHA1
082ba9efa3a4b0865c6a6294d8772fafd10c8d6f

SHA256
ceb6c30a1ed40d2974c7a0311e0ab0be191769c598c5fd68560952a06e76f53d

SHA512
444a2d6fa445976a3af4b356d7fe3f33874888d1f5e3208aeea4cd9cf59d2fc99660eaaf1bf09162d17ae4587efdf731fbbe13046535fcfadbb64362a7504be9

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
92KB

MD5
5c966d1536499366e882af17169d10f7

SHA1
c3dafd396abf3430edd44b8be118ed1dbf284409

SHA256
7718196c7c26c9a9388c38a045f77395557ad679d3c66eb0385deac536f33f1a

SHA512
be2090511ca9ec9972ec6824b0730fef148e982cc6a05b7cd6e2c4385e4dbf44bd4298f0953a076c525139ee5d42f8df766f3faec8efcf798731dc9188c2d401

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
92KB

MD5
ea3b24892bbe4a53f3a1a95c424eff16

SHA1
3cc95c875c68cc582af5395743fbd04ea1803e02

SHA256
1f0476a35257d47cf36ef4c7db3cfd7cdc18543d92634555dc44cb95ad72467b

SHA512
60e08f14a12b71056d0cbf9ab2b3eeefb9d489884d820a21d9ab9668e7b9f5d83b8a6e55034688c5a787da3d8fd8064fcc580d9da771e4c40c414f088f8abd6a

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
92KB

MD5
91e173ca0b67e9341bcf3861220ab129

SHA1
9de2dd5977fa31667f8bda56ffd6ffd92e7d45e3

SHA256
e43e89e720c417bdd24b1f11a032882c8b0485cf0301a12056fd19bc1ae683c5

SHA512
27d3d453e9bb2e6091160de1709d2d343af67871402aceccaa846bc1b0b2a2641379b58b51a4e7ddff411c3aaea6ff70a04f3c12cecb185036748c092507c77c

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
92KB

MD5
4d9a0363bebf7ee4d7e4e6239c340ec2

SHA1
1742c5c50f4cf428e855c406df33b8fff99006bc

SHA256
b99711d0c1d2630889bd1be1b677058c652c5930ca9c60947cd0873c3af922e8

SHA512
04b2c744d14acd7b767f0255294caace953fc29359f04208280de440fcd7ca38cb4f74b2a89d740fa3bafb3c8346fdd103423641a0bbfb17af6005f9a4cf1f21

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
92KB

MD5
845d875c447b85c7c83ae7e66f7eaaf6

SHA1
fe6124dcd59abb8e955d42ec4c928ed77123bbcc

SHA256
345eb9f46b4b6ae53e4413410c6fc37bf46b073aa987571fae3092d0672b532c

SHA512
244d8ee38bcb511c4ebcbd3fbc5c6c0ce93feb2cf5937e53e06d4800f0fb3e5b8b99d0584d1ff69417919294a8fbfea9e848ac501b8ab88cbee96f3439a10c3d

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
92KB

MD5
a35022be5e821a7eda158e0ae200d3ad

SHA1
e5bb6fa8081589e0d32fedc1071465162398bc1a

SHA256
89427a50d5066301e2c84e3938af9971f2f0d99322adab5160b8dcc0b8ee4f44

SHA512
acffab9cac70df8f8e0b5cffe64b8a54fd4310fa8178de54fb68df8bcc69bf8b1bf9052f95233defb35d0fb9106d29996f0e3fd7810031b1e2a260e545717ad8

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
92KB

MD5
edc5b9a0b001eab62c092274ba786123

SHA1
c0fcb36e33ad093881ff3f4ee4311f5639b1257a

SHA256
5d51b838fe0bdec009139b4fcdcc49b2cf89b647669785c52211033d9e71e7e6

SHA512
e3718ac9577d17367044339c5bc19d99bc87d870ab961080e508aa9a4be95e6fc6b583bebb8276784714b415a7998501ea462890a9178e953b88b769549b89b5

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
92KB

MD5
e59e551243e8852f530e962474732a4c

SHA1
a389bb145e068fb03d251f6012e583a0711fe84c

SHA256
e54df0b36c3b6a86681fb9a4ccf66f3a30721a126a8e59815b01a6cc09ba8ff9

SHA512
b40576508e7e34d113ced1b8045c942ce900c2b6d20da2116db3723ebd141a71a77224cdcfcd7ac4073856e25b98f155d01fc421c322a56796973a07bba71dce

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
92KB

MD5
212f6c5a1fffabc486ac9ddd7489fcac

SHA1
62fc88265f2887813eb043a91c23ce074914ec4a

SHA256
3c54f18dd78e44fd3984e73a19084bc5052911a7894281f087724f014ba2684b

SHA512
ed5af7bf4b673e86418be99c05fc5672dd86ae0d0b1121fa9aeb9fc9d8faf12a737222fc1627b361f92b809b83893b8c8f40aef01777a5d25e65289a478f09dd

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
92KB

MD5
8491093a9a3d56ac2c974425972c7512

SHA1
9b6612007591c25f0d3512c8b92f6804e484cb9c

SHA256
62a9386de2b3600b598cc00851dc607f94b0899511a4682b2465c39c17ee6544

SHA512
ddeda6edc840137721439b0258917220bd6f1d4fdc8fec398f38840f2c7aa08e8847cbe328c70fd7e5bdce2f2e7a1da6bdcd65deec5869c98f179cc2f2c3148f

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
92KB

MD5
101594712d693defe24002b9d1677f76

SHA1
61fcccde96633dec78d0d8ef638b3d36aea1426f

SHA256
3e3f28726e7913698747d07426f04ee114b01c3b73907a19f2b06a4670b8a157

SHA512
5fe4394a1a472e5de8c091d72006c547eb08b354058235cc3e98b6591b852aa6a4c9d21ce5061ac3aabd28568849e95d2f444dc51a70772e2a32f8ae87a353dd

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
92KB

MD5
f2b8075e41751e71dcb4254d9b8a4d83

SHA1
df420be4ed4b8bf65c8d6e6a8770066bdfd43599

SHA256
ae1c85417053f82032227c36f05a215d6d982ff5c2ace2b79b6bddff2ab417ba

SHA512
ff3d4d6d86d8ad60cf39828ce2434cd05ab78e49f9f53152e08d3e9a219660420667989a6b48396e8002c47a94954778d957e2558e9e3b7da80117a1728b3b68

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
92KB

MD5
a4b82693653d8766faf8cf890ec351f5

SHA1
eadb02c6b14c2d40871af3bce6dd69f93c626896

SHA256
ed18f6079be0cc94415cd8ee1d27dec82c3c87813831e5ccff04070fe8af2944

SHA512
98d0d093ebc03556621c606ebb70357b7d9ab559b8283159500120b465dd3059f788c352673be0682d805488f9f7260ed2591e5d1ad73a68a82f379f6545a78d

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
92KB

MD5
ef351b2183f03b7c78b01b7e1de91eb5

SHA1
f255bf003361b8646b70dee157e327701d11ff8f

SHA256
b97faecc94c654733343a35ba9252901eb06eac0b65e82687b15ccfcde63f69f

SHA512
58e3cbc3f9b6d393cd6c9c6b04ab075800fb0c1a8335f27e93e88fa0934055572ea8e33d5db4b0f39e1dc628e8cf5385cc16d5e1d7a443ff4015ba81967f6066

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
92KB

MD5
161ff1deb4d863b77702251d8377e83c

SHA1
b5e2ac76586ee49db191907e1196519e20342c9c

SHA256
77a0fc02bb38ed3c19c51a4879d1fddecb5b1b8b75661254a95fab48ee1e1ed4

SHA512
8f2eaa4c0e01998f545151cdcf510b5332640dfa59522487fd966d71605aebafb203c2e8973a55e480de0bd9b06c9e6243afb83ebbe800700968bc8a981cefd1

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
92KB

MD5
9962ffebbc539686993a5c92ca7af323

SHA1
e69da46387ef13bce9060b69e2992b22153d2ac9

SHA256
44f2ddf1a0f18a67d3eccb108acebca4bd2a073f668f37ab8aafad7dfd4612a5

SHA512
04c4efeeb3e63e1f45bf7396e1a2d44d153697e88359ddae0163be7da1ea0bada1da55c4f4ba96503f5c8787940461d508ef49c4e41fd98c712a354a058dfada

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
92KB

MD5
1ed4bf401e4418b27c9843c27cd15164

SHA1
da592bd099e35d0d7802dcfd6f6f8bb951beb8a0

SHA256
f8e1c12192535589105b269be647e166b503cc887f64a0dd465cb5e71e95682c

SHA512
22bd8ce2fed57e4a776778adbdffc05501072e1c96b0ab3eda2ef4f9151a6eea6526643c305391667a26cce27a86da45d670e08e20a9c38bb3fa40da05180c32

Download Submit
memory/8-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/60-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/316-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/532-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/812-580-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/812-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/880-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/880-594-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/896-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/976-467-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1080-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1188-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1392-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1400-483-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1404-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1412-221-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1416-533-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1436-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1448-225-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1452-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1516-461-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1576-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1624-473-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1680-395-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1720-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1820-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1860-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1892-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1912-573-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1912-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1948-317-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1952-181-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1960-263-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1964-275-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2004-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2004-552-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-287-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2372-129-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2392-419-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2472-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2516-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2516-587-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2532-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2620-153-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2632-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2676-497-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-281-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2824-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2856-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2868-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2880-305-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2912-521-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3044-503-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3052-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3068-347-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3104-361-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3140-509-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3332-257-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3428-149-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3496-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3604-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3708-365-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3836-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3864-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3864-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3880-383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3932-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3932-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3932-539-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3972-206-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3984-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3984-559-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4032-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4232-455-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4300-485-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4484-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4500-293-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4540-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4656-232-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4724-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4796-515-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4844-353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4864-495-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4884-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4892-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4964-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4972-377-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4980-371-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5076-449-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5140-546-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5188-553-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5240-560-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5284-567-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5332-574-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5380-581-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5424-592-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads