e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe
Size

1000KB
MD5

4ac96c17d166be0379ed5bf64191f833
SHA1

083be555ec61f1f8c6dcae53b85a0e72c8792b8d
SHA256

e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb
SHA512

a5bd8975e9a1854feead7bd928061d1936d8da4104ee1b1efe4730dd3a4f40b27e89301e74b0470484fbd95d82d9a8e3014673e6011056fde46a8581a0b6fc98
SSDEEP

12288:EC9CeM/ktHBFLPj3TmLnWrOxNuxC97hFq9o7:F9CeM/ktHBFLPj368MoC9Dq9o7

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akpoaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boldhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apaadpng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opqofe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgohf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bklomh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfpinmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdialdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckebcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe

Executes dropped EXE 64 IoCs

pid	Process
3428	Njhgbp32.exe
372	Npepkf32.exe
1452	Nglhld32.exe
4260	Nnfpinmi.exe
3728	Onocomdo.exe
968	Opqofe32.exe
4428	Omgmeigd.exe
1504	Pfoann32.exe
452	Pccahbmn.exe
3596	Pdhkcb32.exe
648	Pmpolgoi.exe
4980	Ppolhcnm.exe
3512	Pfiddm32.exe
3928	Panhbfep.exe
2828	Pdmdnadc.exe
2356	Qfkqjmdg.exe
2820	Qobhkjdi.exe
1344	Qpcecb32.exe
2480	Qdoacabq.exe
60	Qfmmplad.exe
2100	Qodeajbg.exe
1092	Qpeahb32.exe
4508	Ahmjjoig.exe
2280	Akkffkhk.exe
3712	Aaenbd32.exe
2400	Adcjop32.exe
724	Aknbkjfh.exe
2032	Amlogfel.exe
3956	Adfgdpmi.exe
3536	Akpoaj32.exe
4300	Amnlme32.exe
1100	Apmhiq32.exe
2524	Aggpfkjj.exe
3264	Akblfj32.exe
3392	Amqhbe32.exe
1424	Apodoq32.exe
2956	Ahfmpnql.exe
1880	Akdilipp.exe
4484	Amcehdod.exe
1824	Apaadpng.exe
768	Bmeandma.exe
3212	Bpdnjple.exe
2452	Bgnffj32.exe
5156	Boenhgdd.exe
5196	Bacjdbch.exe
5236	Bdagpnbk.exe
5284	Bklomh32.exe
5316	Bmjkic32.exe
5356	Bddcenpi.exe
5396	Bgbpaipl.exe
5436	Bnlhncgi.exe
5484	Bahdob32.exe
5516	Bhblllfo.exe
5556	Bkphhgfc.exe
5596	Boldhf32.exe
5636	Cpmapodj.exe
5676	Chdialdl.exe
5716	Ckbemgcp.exe
5756	Cnaaib32.exe
5796	Cponen32.exe
5836	Chfegk32.exe
5876	Ckebcg32.exe
5916	Cncnob32.exe
5956	Cpbjkn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	Panhbfep.exe
File created	C:\Windows\SysWOW64\Qodeajbg.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Ahmjjoig.exe
File created	C:\Windows\SysWOW64\Opjghl32.dll	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Cjijid32.dll	Njhgbp32.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Coegoe32.exe	Chkobkod.exe
File created	C:\Windows\SysWOW64\Oppceehj.dll	Nglhld32.exe
File created	C:\Windows\SysWOW64\Qpcecb32.exe	Qobhkjdi.exe
File opened for modification	C:\Windows\SysWOW64\Bahdob32.exe	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Cnfkdb32.exe	Ckgohf32.exe
File created	C:\Windows\SysWOW64\Ppolhcnm.exe	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Domdocba.dll	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Omjbpn32.dll	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Bdagpnbk.exe	Bacjdbch.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Pmpolgoi.exe
File opened for modification	C:\Windows\SysWOW64\Amqhbe32.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Bkphhgfc.exe	Bhblllfo.exe
File opened for modification	C:\Windows\SysWOW64\Chfegk32.exe	Cponen32.exe
File opened for modification	C:\Windows\SysWOW64\Chiblk32.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Dgihjf32.dll	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Pmpolgoi.exe	Pdhkcb32.exe
File opened for modification	C:\Windows\SysWOW64\Aknbkjfh.exe	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Bmjkic32.exe
File opened for modification	C:\Windows\SysWOW64\Pfiddm32.exe	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Aaenbd32.exe	Akkffkhk.exe
File opened for modification	C:\Windows\SysWOW64\Bmeandma.exe	Apaadpng.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Chnlgjlb.exe
File opened for modification	C:\Windows\SysWOW64\Pfoann32.exe	Omgmeigd.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File opened for modification	C:\Windows\SysWOW64\Qodeajbg.exe	Qfmmplad.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Ppolhcnm.exe
File created	C:\Windows\SysWOW64\Mlcdqdie.dll	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Kioghlbd.dll	Qpeahb32.exe
File opened for modification	C:\Windows\SysWOW64\Apodoq32.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Qnbidcgp.dll	Apaadpng.exe
File created	C:\Windows\SysWOW64\Bahdob32.exe	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Cnaaib32.exe	Ckbemgcp.exe
File opened for modification	C:\Windows\SysWOW64\Nnfpinmi.exe	Nglhld32.exe
File opened for modification	C:\Windows\SysWOW64\Pdhkcb32.exe	Pccahbmn.exe
File opened for modification	C:\Windows\SysWOW64\Bklomh32.exe	Bdagpnbk.exe
File created	C:\Windows\SysWOW64\Dddllkbf.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Qfkqjmdg.exe	Pdmdnadc.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Eehnaq32.dll	Boldhf32.exe
File opened for modification	C:\Windows\SysWOW64\Cpbjkn32.exe	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Chkobkod.exe	Cpdgqmnb.exe
File created	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File opened for modification	C:\Windows\SysWOW64\Dkqaoe32.exe	Dhbebj32.exe
File opened for modification	C:\Windows\SysWOW64\Omgmeigd.exe	Opqofe32.exe
File created	C:\Windows\SysWOW64\Apodoq32.exe	Amqhbe32.exe
File created	C:\Windows\SysWOW64\Epopbo32.dll	Bgnffj32.exe
File opened for modification	C:\Windows\SysWOW64\Cdbpgl32.exe	Cacckp32.exe
File created	C:\Windows\SysWOW64\Qdoacabq.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Geqnma32.dll	Amlogfel.exe
File opened for modification	C:\Windows\SysWOW64\Bhblllfo.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Cponen32.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Nglhld32.exe	Npepkf32.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cogddd32.exe
File opened for modification	C:\Windows\SysWOW64\Aaenbd32.exe	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Pdmdnadc.exe	Panhbfep.exe
File opened for modification	C:\Windows\SysWOW64\Qdoacabq.exe	Qpcecb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5940	5672	WerFault.exe	172

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfpinmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Panhbfep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfkqjmdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnlhncgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmpolgoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpdnjple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omgmeigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aaenbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckbemgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chfegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njhgbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opqofe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qobhkjdi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cogddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amlogfel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgcihgaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nglhld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akpoaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pccahbmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akdilipp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmeandma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhblllfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckebcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cncnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnfkdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onocomdo.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occmjg32.dll"	Pmpolgoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qnbidcgp.dll"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjijid32.dll"	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlkidpke.dll"	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahmjjoig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpojkp32.dll"	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Boldhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnflfgji.dll"	Cponen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddjmo32.dll"	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgni32.dll"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iohmnmmb.dll"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdhkcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opjghl32.dll"	Amqhbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfoann32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfpagon.dll"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cponen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdebopdl.dll"	Akpoaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Npepkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqppgj32.dll"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddllkbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akpoaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aaenbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oppceehj.dll"	Nglhld32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3428	3384	e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe	91
PID 3384 wrote to memory of 3428	3384	e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe	91
PID 3384 wrote to memory of 3428	3384	e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe	91
PID 3428 wrote to memory of 372	3428	Njhgbp32.exe	92
PID 3428 wrote to memory of 372	3428	Njhgbp32.exe	92
PID 3428 wrote to memory of 372	3428	Njhgbp32.exe	92
PID 372 wrote to memory of 1452	372	Npepkf32.exe	93
PID 372 wrote to memory of 1452	372	Npepkf32.exe	93
PID 372 wrote to memory of 1452	372	Npepkf32.exe	93
PID 1452 wrote to memory of 4260	1452	Nglhld32.exe	94
PID 1452 wrote to memory of 4260	1452	Nglhld32.exe	94
PID 1452 wrote to memory of 4260	1452	Nglhld32.exe	94
PID 4260 wrote to memory of 3728	4260	Nnfpinmi.exe	95
PID 4260 wrote to memory of 3728	4260	Nnfpinmi.exe	95
PID 4260 wrote to memory of 3728	4260	Nnfpinmi.exe	95
PID 3728 wrote to memory of 968	3728	Onocomdo.exe	96
PID 3728 wrote to memory of 968	3728	Onocomdo.exe	96
PID 3728 wrote to memory of 968	3728	Onocomdo.exe	96
PID 968 wrote to memory of 4428	968	Opqofe32.exe	97
PID 968 wrote to memory of 4428	968	Opqofe32.exe	97
PID 968 wrote to memory of 4428	968	Opqofe32.exe	97
PID 4428 wrote to memory of 1504	4428	Omgmeigd.exe	99
PID 4428 wrote to memory of 1504	4428	Omgmeigd.exe	99
PID 4428 wrote to memory of 1504	4428	Omgmeigd.exe	99
PID 1504 wrote to memory of 452	1504	Pfoann32.exe	100
PID 1504 wrote to memory of 452	1504	Pfoann32.exe	100
PID 1504 wrote to memory of 452	1504	Pfoann32.exe	100
PID 452 wrote to memory of 3596	452	Pccahbmn.exe	101
PID 452 wrote to memory of 3596	452	Pccahbmn.exe	101
PID 452 wrote to memory of 3596	452	Pccahbmn.exe	101
PID 3596 wrote to memory of 648	3596	Pdhkcb32.exe	102
PID 3596 wrote to memory of 648	3596	Pdhkcb32.exe	102
PID 3596 wrote to memory of 648	3596	Pdhkcb32.exe	102
PID 648 wrote to memory of 4980	648	Pmpolgoi.exe	103
PID 648 wrote to memory of 4980	648	Pmpolgoi.exe	103
PID 648 wrote to memory of 4980	648	Pmpolgoi.exe	103
PID 4980 wrote to memory of 3512	4980	Ppolhcnm.exe	104
PID 4980 wrote to memory of 3512	4980	Ppolhcnm.exe	104
PID 4980 wrote to memory of 3512	4980	Ppolhcnm.exe	104
PID 3512 wrote to memory of 3928	3512	Pfiddm32.exe	105
PID 3512 wrote to memory of 3928	3512	Pfiddm32.exe	105
PID 3512 wrote to memory of 3928	3512	Pfiddm32.exe	105
PID 3928 wrote to memory of 2828	3928	Panhbfep.exe	106
PID 3928 wrote to memory of 2828	3928	Panhbfep.exe	106
PID 3928 wrote to memory of 2828	3928	Panhbfep.exe	106
PID 2828 wrote to memory of 2356	2828	Pdmdnadc.exe	107
PID 2828 wrote to memory of 2356	2828	Pdmdnadc.exe	107
PID 2828 wrote to memory of 2356	2828	Pdmdnadc.exe	107
PID 2356 wrote to memory of 2820	2356	Qfkqjmdg.exe	108
PID 2356 wrote to memory of 2820	2356	Qfkqjmdg.exe	108
PID 2356 wrote to memory of 2820	2356	Qfkqjmdg.exe	108
PID 2820 wrote to memory of 1344	2820	Qobhkjdi.exe	109
PID 2820 wrote to memory of 1344	2820	Qobhkjdi.exe	109
PID 2820 wrote to memory of 1344	2820	Qobhkjdi.exe	109
PID 1344 wrote to memory of 2480	1344	Qpcecb32.exe	110
PID 1344 wrote to memory of 2480	1344	Qpcecb32.exe	110
PID 1344 wrote to memory of 2480	1344	Qpcecb32.exe	110
PID 2480 wrote to memory of 60	2480	Qdoacabq.exe	111
PID 2480 wrote to memory of 60	2480	Qdoacabq.exe	111
PID 2480 wrote to memory of 60	2480	Qdoacabq.exe	111
PID 60 wrote to memory of 2100	60	Qfmmplad.exe	112
PID 60 wrote to memory of 2100	60	Qfmmplad.exe	112
PID 60 wrote to memory of 2100	60	Qfmmplad.exe	112
PID 2100 wrote to memory of 1092	2100	Qodeajbg.exe	113

C:\Users\Admin\AppData\Local\Temp\e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe
"C:\Users\Admin\AppData\Local\Temp\e9d56a04736d696dea583c17d79e3f10d3e7b13eba2f77acdc299c3aabef19eb.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\Njhgbp32.exe
  C:\Windows\system32\Njhgbp32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\Npepkf32.exe
    C:\Windows\system32\Npepkf32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\SysWOW64\Nglhld32.exe
      C:\Windows\system32\Nglhld32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4260
      - C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:648
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1092
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:724
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3264
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3392
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1880
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1824
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:768
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3212
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2452
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5236
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5356
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        69⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5004
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:840
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        74⤵
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 412
        83⤵
        Program crash
        
        PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5672 -ip 5672
1⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4448,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:5788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaenbd32.exe

Filesize
1000KB

MD5
f5417ced6208e597168565c634fc0f2e

SHA1
c26ae7fdc4240c9e9f7cfde512021d1c9a1b39b5

SHA256
17504c645723eba5f77898803c8984601fd3994985f08f39e376dd434805f63f

SHA512
4ce2f4fd1a1da85799ae2fd8561fd9bf33a7b3a6582b864f50bdab50ae2d6d243e9b2f3ba5d65f0a39e6262e408afecaf9bd131c6bb9ba4888738cd6be0de348

Download Submit
C:\Windows\SysWOW64\Adcjop32.exe

Filesize
1000KB

MD5
f8ff18048dee604d4aff078bfe0791f2

SHA1
f1c3c5c9a74725f1abb27c651f5ae2111a5d7f9f

SHA256
2e14c6aa6f24839dde3a1daba194b6060c11e9afc8d599167277ef68304ec8a9

SHA512
c04192c19e333bd98a6a1b1f39b638287ae285f3f05214957e5e4a5436d8197d4df5a8828487f8fa4b4d7d858d84c687fa8a100941b0c64c89923e26148811d2

Download Submit
C:\Windows\SysWOW64\Adfgdpmi.exe

Filesize
1000KB

MD5
4eb1747d4e981f9e98a05d5f6ce3f175

SHA1
2fdf9a09382237376c0e38c7f3ecd79cfd866261

SHA256
c9d9caaa11b36348b52308e775f60e706c4984afa74b5ed1917af177bda1a350

SHA512
a4fb7a8bc1117e45d8561f80f77463324454df1219de1140e60d91efaabef9354b30029f69de9a1c07a7bb18c31b681e99a8c7374592b20b0ab35e960a5e5c0d

Download Submit
C:\Windows\SysWOW64\Ahmjjoig.exe

Filesize
1000KB

MD5
e057a53849c5c616271b0309de7ffafb

SHA1
f6ea9b1ae9ee9d2a9e8c2384614da9e9fe678c56

SHA256
bb299052e6cb5364b11c3682ebd05e2c4e8344bf3d8e47d80bab72c706de23df

SHA512
e3da102fcd8073b9adb48b896fa93d8b209bab59c8cd15a92ba049a713193aae1a34927fb9ee96aa8e8a0c5064ef58e25e1c4409412f3b86f6cf0059e5ff2d95

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
1000KB

MD5
a0bbcc794208a1941c4ea0bfac26214e

SHA1
8c3307224b93d31cd5981087f03d90ee6f74ffc5

SHA256
192ff962a43678b6169b4458c9b10de022467cffbce65f747f5c866032bc6db3

SHA512
f997c6050a9a19df13b2e9c498a7e42cbfd3b1a74e9b1ab6cc6a77e1bce68bee4f70be58e40a93687143e2ec948b6c022d8cbc6c495f0c33616583f980f1926e

Download Submit
C:\Windows\SysWOW64\Aknbkjfh.exe

Filesize
1000KB

MD5
707d29e6374c8f03fd6e21e94424ec86

SHA1
9e086d8dbb50a2b506f750d58387f2e9663cdda2

SHA256
a4713736866328b4371cfe0254b25ce626a29f14f4a65b13d6dd6f4f0d4f128b

SHA512
035ab1df4d5f59f4aee3a63c557345bf2db4682764311f764962beb5d5678fb2bd65c55a5bb851635c1d391de90f053d8063f72ae42aed2d4b78fc023fdbb420

Download Submit
C:\Windows\SysWOW64\Akpoaj32.exe

Filesize
1000KB

MD5
6753ea30c4a17c71a198e34092b0dd78

SHA1
94a6c96fd4ce942a019afc2080dd10408d08562a

SHA256
d66dbc21fbf9b0b90e103052123b30c126c0a9a15b9f343f92ec890c360340f9

SHA512
ccbfb4e95e0629d46c0e0d91e7982cec7d0849074fc7031e973b9680b1c59108fdc05e9e0395b44844818e5e479791aba57d93e837dedc6fe1a5926027cf0e85

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
1000KB

MD5
c84a6161df5387d41dc356539bdf7f2c

SHA1
95307108a801419859247d70cf86367f068dbe93

SHA256
d420785e6bb9f1d32437da2b195a7a09e19a976c052d7273845158a02e371483

SHA512
9129110732a68db9ff4ba686fe2737f5744740cfe40253ce3786268b59aba776a8290e74a3ee9786d620889b7093c640db4382610d7636219a2ec81dde343be9

Download Submit
C:\Windows\SysWOW64\Amnlme32.exe

Filesize
1000KB

MD5
c05185cb1556d73178b48c26bec9caa1

SHA1
e94b4803b822177dcb96dfe67ac536a1dcec1d60

SHA256
fedf67d15236b348a65d996ee66c50055cb85e51670d0f3d0e4c86ff48f62e4f

SHA512
e28487eeeead573681422110c19f622cd9a90b9d3421cc6a936b944fa513f6c31c831e5ec1202db808a022265cb052e298538b9a42d419e9d6d511446eb58a06

Download Submit
C:\Windows\SysWOW64\Apmhiq32.exe

Filesize
1000KB

MD5
4d0af100ebe71e1dafe0d506411fdda2

SHA1
7789ed8db8bf7c825a8f75f9bb010f9e00034f58

SHA256
ee27330a70a379e6d6a889d84b40c5c9a4f28837e43bb0e17cd54d78f8c5eb4e

SHA512
500a711757487958c7a5000d928633e382d549598fdc0b9cd496e7d0699299792c7850c0de1af9b7aa3ddf628486e13e379a872d2acdad7d73f89104f57c11f0

Download Submit
C:\Windows\SysWOW64\Figmglee.dll

Filesize
7KB

MD5
3994308cb55a6d064806667f2c4f7f8a

SHA1
05f9946858acad146f92848c66d4cd74714cc522

SHA256
975c3135cd706bbda7cda4570463bc172dec1242ecfcb688cb94a94a45c7be12

SHA512
0fd2b8cf75eef6ab19da81826c844d40af2d6ea4d0d9d5d4ee9e07aabfab85518b2cc2f97a2caeb0d833c1f5da3eb130487631b37405f2883325fba4892a2e51

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
1000KB

MD5
dfec7eb7b32412ea966430aca76ba005

SHA1
2ddbfe2422cd8b6069d45490149ed13c6af6d9e3

SHA256
0b98bc58b22fb65a912994dd6f89736e83f443bd11eccc04c06a67450380d9ad

SHA512
e49356cc3780d402e4da8f679d73ce1cb2cd508b4649956675ade0cc9c01a2f2f3a09835df612c547bd099a87e574c9a8598061e6d6ab8b3cb0571a15ef522a4

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
1000KB

MD5
47ddcebb691122796ced6396309f78ea

SHA1
82ce85914776b7f1c4507b22ac35f5f04518444d

SHA256
37951535becfbd0b97ad59779fe082e9f99d4cf8dc740733375fded144c5d75c

SHA512
f8f1a9513c916d7faacdef7dd3fd9c0841cfad444be8e84d8666834ca45e90e89ec8a5d383ce03cd1ebf9069753faecc73f5d78b0f769c155fe295e40429fbca

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
1000KB

MD5
d84078583348895b7e5da040338cae02

SHA1
db4c56e65b84dbdc4bb0088aa7b357b1d90abf1e

SHA256
5142b6aa0debad3e608110492f7c4ef94f7821f5bea821a499df92960df218d6

SHA512
08ba87ddd665f88ab8a5c6be2196e1e390d7ce26e072e4c37e10808c3f490920c9e80c1f44dc4390058e9d3422c8f31fdeeb3e1868e36060db95ff877efe38b0

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
1000KB

MD5
bb6a86a3fa88905dec8b17e692c10f3c

SHA1
47058e14c131be465c961d5be6494aca1b7e5983

SHA256
a34ab267ca0ace3e0a6de44d17f4844096cfc1f0a5102e27e647d3cb5b36f3df

SHA512
5c97e534b3c1188ee99ca40a4dee694274cbed974de9844a845b8f4ad774c8daafbebcef598d6bad4d5923560b03376b0295e7ea07d96ed12ce4ee76994358c7

Download Submit
C:\Windows\SysWOW64\Omgmeigd.exe

Filesize
1000KB

MD5
8fe92ef971811159a69e3d34876b8206

SHA1
3cd85d5bb185742ab38faabb6b81c66811da7e3f

SHA256
10e169b11f2d18f61c341b9899bb8a707461edfd2e55f67ba28c55e91e146353

SHA512
c61f62896719837b5fe1c0f7a96898c554db5724b4e39e66ab2cc2139883ef87be58356828bb28492b7a3c8cd212419ec08206c87571ccf474f06e1dffa757d9

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
1000KB

MD5
cb348990f3c7d76e2a7f9575a248fa6c

SHA1
183c3d0e495f8598823b607b37b52cefe4efd491

SHA256
cfe0e6c2883a0dfeec394944f16cada40232ac74fabb209941665d066326de68

SHA512
de6b48444aae320803bc5a1148d53ecb07a8d145b3ca8c8ce72d43a16a1f12fb5646ab2f19dfade43e55ae403e2e3a9ff6fafcf50b2c17ccdb2edc96272c7f11

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
1000KB

MD5
929225b4b1401637f0999ec24f08f10d

SHA1
58a791c469f7c9a286af5fb09aede7a565e608d8

SHA256
fd3a26fba4fe80e28a2cbc182d76ffded5b1012d59981bc46336f6fb0548e41f

SHA512
1b2812e8923101895749f49a28a38cccab22e489fa25c6109dd33ffd2c5bcb363d3fada9088ea7797d65e219652f52bd7c251fe5cfeaa130728be4967b52a2fe

Download Submit
C:\Windows\SysWOW64\Panhbfep.exe

Filesize
1000KB

MD5
dd9ef5f3e511785e6c4c90fa63128dcb

SHA1
31716b33fc38a872892443914bd22d1b27f1fd7e

SHA256
b337aa7430a8128263a6b96c90f781636e671c1c203cdd4896bc335a10428bc6

SHA512
7d52ef48b09b91b7e66a16a953917250d64c0d212c9c9356900b394790b58579f411d22f5b8b7302deb9dcdf0f0c5a7809338fa0583de79015fc44b6f733ea0f

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
1000KB

MD5
5dc239fdde1c487a86e44ca1cc414859

SHA1
59f0065eeb3dfe0dcd3860f7a663e9caeb213eba

SHA256
a310dd199217760c2c3db71cf9292f14e6a258fb2261608e103cbd1d56de1165

SHA512
fc44c034ccc20ce8df327b434f98e0fa68561af60a9ef851cbb64de47dac8aaba914b9df42ad6647d9e22ad84199f903f804cdba53bd311ffb65eb3b607b6b6e

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
1000KB

MD5
5b7cb8d8baf1909e2d8a13531dc15145

SHA1
5e65f87ba46a7c66b2a7b12b5094e3b51ce606ff

SHA256
c479b1a6adee3431af01d20dadaea7dfa139c013e4f692b6f99212c9348dfc7e

SHA512
b161ca0a9644737e230db10f6635b76ae6b3017ef74d63598856f434697a2894983506c48a7b8cd1deb8add9dde6e5179c9dd177e864f29bd9444e52b06c349c

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
1000KB

MD5
9daf460dacbf3fbc2988df2644a94046

SHA1
0c640baf6d40ad597ee9034b475a1055aa58ec14

SHA256
8030b0a7a211b315d79f575b4c5efbd531b8c1dfa6c040cdb00472871330d3c0

SHA512
44d8ef221051206b93efc15320265b05dd459873c40299b9eae5f722dba6c2eb40dd926497614510cb1a3834c5be13f1fe401b48da751814db54f9c43959bb17

Download Submit
C:\Windows\SysWOW64\Pfiddm32.exe

Filesize
1000KB

MD5
91fd49221ace68636a1e11b106e858da

SHA1
1242888cd4cdc7a5177ca5a5093df8ea436ff90e

SHA256
146258ec204abc93a95aee37b07d8c83bb8d4c3bf8b6058ce0c9cc0768d3e941

SHA512
37c8b408f6e326a19baf6970fa322741ea055a8601fbfffbb58488b012817d9238878760c53a1402109fa2e1ae744e421e4f77b46426a46ba894f4374c232483

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
1000KB

MD5
3c22bbf1133b758469f4db05bb0d18a8

SHA1
efd9113976d05afca3885e2278a2a3d6471d14d1

SHA256
2f87bcab04b863d3f0ac75c4c48839fff00c8bac7ec85a9200524c40df39a821

SHA512
5c3b52ebdcd6641b6c98bf0b1bf610e642d159061b8c9d2c2e394c44740dba2038ee45cb0ca9058e5622cf4b33cc8a111c39ab97a57c61081422147bd6903486

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
1000KB

MD5
b82f11a5c3a6ec22d3fa65623ff30b70

SHA1
97758c6de6b39fa241ddf530304f0564238489d2

SHA256
893a82e6fa4c5a2f3ec05344b640aef45dcdbe524137fedd4b82909db3339c35

SHA512
61178d97a9ff33fa1ddbdaa21e11baa31701fbb7d42bd123165332f15f3788b24f030048f8e551ebac2852b3c76629a714dd31d90485a81af2f11ef0a7dfb463

Download Submit
C:\Windows\SysWOW64\Ppolhcnm.exe

Filesize
1000KB

MD5
4211eacb8c70fe51a70cbb854bf83e0d

SHA1
7a218d910d0db6732cf9a32c74481ac7c7779a5b

SHA256
ba783bdbcc55d4028085834cc5430acac7dcc4ea98bfce2ec0d2594fdadffc56

SHA512
931f7462072e720aff9380a33eef0d54842a815b17af291d04a5069bfeb89ba4b9209c4075c560ae4c82d7de8926ff61048495d1a1bdb7ba8b85337df8679478

Download Submit
C:\Windows\SysWOW64\Qdoacabq.exe

Filesize
1000KB

MD5
def7dd297dc3ca90a1cbfa83143287e8

SHA1
57c5c0c1ce69c8ff737aee86410d63669e57c382

SHA256
8c7e492af1d5a5ea10ec7fec27db9ea9934044a5004373f0cca1589bf93e5e46

SHA512
92959c5e2587a4b1cc641c9915ce5a3e84063f801f1527632f23a9c095e63bbbfabf43217363fec1a74a71becd02af16451f1bace3d6429458f871ff684f041f

Download Submit
C:\Windows\SysWOW64\Qfkqjmdg.exe

Filesize
1000KB

MD5
b1b3fdb6523198282b0dd86e1ba5f221

SHA1
5c39c89dd3519404850531a73b485cae162753dc

SHA256
e9268e06378b00e5637c76afd46425050a84ad170f520c445f4b52a6dc41e12b

SHA512
197d85e812c720db28471cd7a6c8b098a750226dabe27f124ac8e4f1bf26698a3b6176fdae172db0c4cc3199beb936e3c11865c7e22b53d87be98e9782df6216

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
1000KB

MD5
933b81d2e4aa508ae0868f28a4652960

SHA1
76589e70ed697503c9611370e80db211d40fb4d3

SHA256
f58a7b0af31d03861773ee964c109f5c5081ab4570028c585a2e60af01623c99

SHA512
f9f737abfc638ef1af74920eff5e7e67b5bf1376e26e0b0e1ba97f1db276183e8080738f4f207c2049e1da243a10fc98289db9669d04fb0089761ea9bf487e47

Download Submit
C:\Windows\SysWOW64\Qobhkjdi.exe

Filesize
1000KB

MD5
61515af9a2f6c1d306e2149817b42d96

SHA1
3482f2c30de801af631920ad6c543bb7ac1fe40a

SHA256
3689d66d946dea3c46eaa86e7e084b56256fd617274487a2aceea6e3824e0423

SHA512
3717ddc4be13bef462637f0bd3244bb48954d63bb16a646e123aabc97d605052f198fd6af824ccba64f3473621690a16b21a555d87c7a924b68fd353f3ee8aea

Download Submit
C:\Windows\SysWOW64\Qodeajbg.exe

Filesize
1000KB

MD5
16696ff5f4a3177afee66e54b7ebd9a5

SHA1
527264f984f8e08d132909e8b50c028c5038d9df

SHA256
8b2f972715ed0c54c8ce444cf75db7958ec04a958c310e9fa6346ec75553597d

SHA512
dcff401ef7b9cc9403572fb3205ba4336ce39fbf6e5c94906a416178f495a2bb15c1a7a5828f55d3c577fb4b3aa4c5522eb116806856be41895d4af496ba3bfe

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
1000KB

MD5
a9cabe03624754f943550201e148fcb3

SHA1
6659299ee5ba3d825e06594d2ac6a58cb26f9ddb

SHA256
b86e5010e7ca2d182d31d2750a6812cecfb6dc4b71a7eea5bf62cbea5db987ff

SHA512
711d8f14c052087415e60ca04beb734a67eb423c6d254936cd8f5894f06b502a56832daa1448dfa258cb7aa0aa8c6f5307714a0ac65024f852eea387566b2d0a

Download Submit
C:\Windows\SysWOW64\Qpeahb32.exe

Filesize
1000KB

MD5
a8561b7c332cf3bf0b0b30133912008d

SHA1
a99e08d589db9c2312ed48686505217588594fdb

SHA256
b388eac1471316f51c454030912668015c77fdd9dccaedd6955e331125e30f4c

SHA512
1f9512e142daf8557a40f170c01368de56ea7af1413f071f2505409183516c78bff614b92feb077503086425be68a390b8fc170aa8c0e86dc5bcdebf1b3a8dd8

Download Submit
memory/60-164-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/372-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/372-559-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/452-554-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/452-72-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/648-92-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/724-221-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/768-315-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/840-501-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/968-557-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/968-47-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1092-181-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1100-261-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1228-495-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1344-149-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1424-285-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1452-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1504-555-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1824-309-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1880-297-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2032-229-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2100-173-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2280-197-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2400-213-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2452-327-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2480-156-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2524-267-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2820-141-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2828-124-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2956-291-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3000-483-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3212-321-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3216-550-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3264-272-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3384-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3384-549-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3392-278-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3428-551-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3428-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3512-109-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3536-245-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3596-79-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3596-553-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3712-205-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3728-44-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3928-116-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3956-237-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4260-558-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4260-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4300-252-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4428-556-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4428-56-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4484-302-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4508-189-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4680-507-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4980-101-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5004-489-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5156-333-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5180-513-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5196-339-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5224-519-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5236-344-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5284-351-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5308-525-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5316-357-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5356-363-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5388-531-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5396-369-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5436-374-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5460-537-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5484-381-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5516-387-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5540-543-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5556-393-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5596-399-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5636-405-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5672-552-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5676-411-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5716-417-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5756-423-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5796-429-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5836-435-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5876-441-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5916-447-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5956-453-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5996-459-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6036-465-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6076-471-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6116-477-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads