a7977b8f6be2d719e67fe22729355f297c23e03759fbadddf7ba7a8bce3ba5d4

Analysis

max time kernel
105s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b7f4ca845d368cefa49576e8baa73390N.exe
Size 400KB
Sample240826-eyfjeswekl
SHA256 a7977b8f6be2d719e67fe22729355f297c23e03759fbadddf7ba7a8bce3ba5d4
MD5 b7f4ca845d368cefa49576e8baa73390
SHA1 dfdf7d5ce71cd510a3feba566ff168183ca0b3f1
SHA512 f24181888f9f2d81b45a2e5b4b50527916b96a7d505e2d38654c2b3bcdd9cab47f0cd8826bf4c2e2b161999a21ade0b4e5885ccbf426f5cece6d9b54132c4fcb
SSDEEP 6144:6vIw1ddLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:6gwVRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	b7f4ca845d368cefa49576e8baa73390N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	b7f4ca845d368cefa49576e8baa73390N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe

Executes dropped EXE 64 IoCs

pid	Process
1616	Afjlnk32.exe
768	Anadoi32.exe
2852	Afmhck32.exe
4060	Andqdh32.exe
660	Aabmqd32.exe
4736	Acqimo32.exe
4844	Aglemn32.exe
1836	Afoeiklb.exe
2788	Anfmjhmd.exe
1620	Aminee32.exe
3380	Aadifclh.exe
2956	Aepefb32.exe
4604	Agoabn32.exe
3852	Bfabnjjp.exe
736	Bjmnoi32.exe
2820	Bmkjkd32.exe
692	Bagflcje.exe
3448	Bebblb32.exe
388	Bganhm32.exe
1300	Bfdodjhm.exe
1132	Bjokdipf.exe
4824	Bmngqdpj.exe
4492	Baicac32.exe
3544	Bffkij32.exe
3960	Bnmcjg32.exe
2768	Balpgb32.exe
3356	Beglgani.exe
4192	Bcjlcn32.exe
1516	Bfhhoi32.exe
4516	Bjddphlq.exe
3560	Bmbplc32.exe
1000	Banllbdn.exe
1172	Bclhhnca.exe
3688	Bfkedibe.exe
4600	Bnbmefbg.exe
2656	Bmemac32.exe
3548	Belebq32.exe
4380	Chjaol32.exe
3644	Cfmajipb.exe
3016	Cndikf32.exe
4564	Cenahpha.exe
1988	Cdabcm32.exe
4048	Cfpnph32.exe
4524	Cnffqf32.exe
4208	Cmiflbel.exe
2228	Ceqnmpfo.exe
936	Cdcoim32.exe
3680	Cfbkeh32.exe
4740	Cnicfe32.exe
2212	Cmlcbbcj.exe
2484	Ceckcp32.exe
5144	Chagok32.exe
5180	Cjpckf32.exe
5216	Cmnpgb32.exe
5256	Ceehho32.exe
5292	Cdhhdlid.exe
5332	Cffdpghg.exe
5372	Cnnlaehj.exe
5412	Calhnpgn.exe
5448	Ddjejl32.exe
5488	Dhfajjoj.exe
5528	Djdmffnn.exe
5568	Dmcibama.exe
5604	Danecp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Cdhhdlid.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bmngqdpj.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Ceckcp32.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Beglgani.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Beglgani.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Aglemn32.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bmbplc32.exe

Program crash 1 IoCs

pid	pid_target	Process
5132	2556	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aabmqd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7f4ca845d368cefa49576e8baa73390N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	b7f4ca845d368cefa49576e8baa73390N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfiloih.dll"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	b7f4ca845d368cefa49576e8baa73390N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Cfbkeh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 1616	4632	b7f4ca845d368cefa49576e8baa73390N.exe	83
PID 4632 wrote to memory of 1616	4632	b7f4ca845d368cefa49576e8baa73390N.exe	83
PID 4632 wrote to memory of 1616	4632	b7f4ca845d368cefa49576e8baa73390N.exe	83
PID 1616 wrote to memory of 768	1616	Afjlnk32.exe	84
PID 1616 wrote to memory of 768	1616	Afjlnk32.exe	84
PID 1616 wrote to memory of 768	1616	Afjlnk32.exe	84
PID 768 wrote to memory of 2852	768	Anadoi32.exe	85
PID 768 wrote to memory of 2852	768	Anadoi32.exe	85
PID 768 wrote to memory of 2852	768	Anadoi32.exe	85
PID 2852 wrote to memory of 4060	2852	Afmhck32.exe	86
PID 2852 wrote to memory of 4060	2852	Afmhck32.exe	86
PID 2852 wrote to memory of 4060	2852	Afmhck32.exe	86
PID 4060 wrote to memory of 660	4060	Andqdh32.exe	88
PID 4060 wrote to memory of 660	4060	Andqdh32.exe	88
PID 4060 wrote to memory of 660	4060	Andqdh32.exe	88
PID 660 wrote to memory of 4736	660	Aabmqd32.exe	89
PID 660 wrote to memory of 4736	660	Aabmqd32.exe	89
PID 660 wrote to memory of 4736	660	Aabmqd32.exe	89
PID 4736 wrote to memory of 4844	4736	Acqimo32.exe	90
PID 4736 wrote to memory of 4844	4736	Acqimo32.exe	90
PID 4736 wrote to memory of 4844	4736	Acqimo32.exe	90
PID 4844 wrote to memory of 1836	4844	Aglemn32.exe	91
PID 4844 wrote to memory of 1836	4844	Aglemn32.exe	91
PID 4844 wrote to memory of 1836	4844	Aglemn32.exe	91
PID 1836 wrote to memory of 2788	1836	Afoeiklb.exe	92
PID 1836 wrote to memory of 2788	1836	Afoeiklb.exe	92
PID 1836 wrote to memory of 2788	1836	Afoeiklb.exe	92
PID 2788 wrote to memory of 1620	2788	Anfmjhmd.exe	93
PID 2788 wrote to memory of 1620	2788	Anfmjhmd.exe	93
PID 2788 wrote to memory of 1620	2788	Anfmjhmd.exe	93
PID 1620 wrote to memory of 3380	1620	Aminee32.exe	94
PID 1620 wrote to memory of 3380	1620	Aminee32.exe	94
PID 1620 wrote to memory of 3380	1620	Aminee32.exe	94
PID 3380 wrote to memory of 2956	3380	Aadifclh.exe	95
PID 3380 wrote to memory of 2956	3380	Aadifclh.exe	95
PID 3380 wrote to memory of 2956	3380	Aadifclh.exe	95
PID 2956 wrote to memory of 4604	2956	Aepefb32.exe	96
PID 2956 wrote to memory of 4604	2956	Aepefb32.exe	96
PID 2956 wrote to memory of 4604	2956	Aepefb32.exe	96
PID 4604 wrote to memory of 3852	4604	Agoabn32.exe	97
PID 4604 wrote to memory of 3852	4604	Agoabn32.exe	97
PID 4604 wrote to memory of 3852	4604	Agoabn32.exe	97
PID 3852 wrote to memory of 736	3852	Bfabnjjp.exe	98
PID 3852 wrote to memory of 736	3852	Bfabnjjp.exe	98
PID 3852 wrote to memory of 736	3852	Bfabnjjp.exe	98
PID 736 wrote to memory of 2820	736	Bjmnoi32.exe	99
PID 736 wrote to memory of 2820	736	Bjmnoi32.exe	99
PID 736 wrote to memory of 2820	736	Bjmnoi32.exe	99
PID 2820 wrote to memory of 692	2820	Bmkjkd32.exe	100
PID 2820 wrote to memory of 692	2820	Bmkjkd32.exe	100
PID 2820 wrote to memory of 692	2820	Bmkjkd32.exe	100
PID 692 wrote to memory of 3448	692	Bagflcje.exe	101
PID 692 wrote to memory of 3448	692	Bagflcje.exe	101
PID 692 wrote to memory of 3448	692	Bagflcje.exe	101
PID 3448 wrote to memory of 388	3448	Bebblb32.exe	102
PID 3448 wrote to memory of 388	3448	Bebblb32.exe	102
PID 3448 wrote to memory of 388	3448	Bebblb32.exe	102
PID 388 wrote to memory of 1300	388	Bganhm32.exe	103
PID 388 wrote to memory of 1300	388	Bganhm32.exe	103
PID 388 wrote to memory of 1300	388	Bganhm32.exe	103
PID 1300 wrote to memory of 1132	1300	Bfdodjhm.exe	104
PID 1300 wrote to memory of 1132	1300	Bfdodjhm.exe	104
PID 1300 wrote to memory of 1132	1300	Bfdodjhm.exe	104
PID 1132 wrote to memory of 4824	1132	Bjokdipf.exe	105

C:\Users\Admin\AppData\Local\Temp\b7f4ca845d368cefa49576e8baa73390N.exe
"C:\Users\Admin\AppData\Local\Temp\b7f4ca845d368cefa49576e8baa73390N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\Afjlnk32.exe
  C:\Windows\system32\Afjlnk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\Anadoi32.exe
    C:\Windows\system32\Anadoi32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\SysWOW64\Afmhck32.exe
      C:\Windows\system32\Afmhck32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4060
      - C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3852
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2768
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3356
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3560
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1000
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4380
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4524
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2228
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3680
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4740
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2484
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5372
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        76⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6104
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        82⤵
        Drops file in System32 directory
        
        PID:4908
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 396
        84⤵
        Program crash
        
        PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2556 -ip 2556
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aabmqd32.exe

Path C:\Windows\SysWOW64\Aabmqd32.exe
Size 400KB
SHA256 3b5fe931ab0aa100323abd236975c9e5c852755ebbad9c8df4077650e82caf2f
MD5 5c8d5ae242ea7a295fecc300758667c0
SHA1 ad7ecdc882bf55edcdb4fd76f17c5a0accdf73db
SHA512 4d05e84a3e0309d7b4ce2100f4181e237108c9dafb0d8466900dfe1a1d1b9ba6c089019e748d925c49acb8542114ffea8c75b55011bce77301414aba93e7757b
SSDEEP 6144:9Tj8iD97dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:91Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aadifclh.exe

Path C:\Windows\SysWOW64\Aadifclh.exe
Size 400KB
SHA256 03e1187c312799216edee0519adb0528de941777b28576035fbc339247f4f130
MD5 72e3732b91a72a5df636be633e6ff2c4
SHA1 c8dfb3d17d64168aafe8209429569e4c93045aa0
SHA512 3c07f8665c8e2edc64f46b04f0a58c3ec62ad0ce58bf541cbb136a7c9d2e5c8ebc09c87b93f59ae8632d5c9671fa3b90f6609b790d769b0fe1c67f897b43f161
SSDEEP 6144:2/LPg5vb8qodLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:2/LPgt8vRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Acqimo32.exe

Path C:\Windows\SysWOW64\Acqimo32.exe
Size 400KB
SHA256 65a0a7888af61e8909c5e048d030366112658a8a45e5a01fe95a3072928d6c1d
MD5 b3092b6baf7172198f2a7b5d9813c1a8
SHA1 5f692ba3258236f980b988035d6a8060e1189d47
SHA512 c559a8e644724b779c89b88885b640311b55afccf2fcb53534cb53838dc369d3cef7ca0d3884956dadcbaf22bf741297177f04e3b888a43a67bc61660cdb1fea
SSDEEP 6144:g5Gr48auUwdIRkwFJ1xG0/kdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cj:g540sRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aepefb32.exe

Path C:\Windows\SysWOW64\Aepefb32.exe
Size 400KB
SHA256 fc63db7b90bbbbc692c89e8a654e983e7fde6ea50dff07c2c386eb0aa2cfb2a9
MD5 1e7107325c6f1844855c4e77b897cf70
SHA1 51512c1bcdc8090082d92a32eeaadaff83018df9
SHA512 7766970a05a9c3ddb53ab742a5184afc4a979d92c17e8e36c151770a05440cb94b7114ced978a355471a42961e8b5d4381491731b6167923e5d14e819811e20a
SSDEEP 6144:KkXmKNdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:KamIRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afjlnk32.exe

Path C:\Windows\SysWOW64\Afjlnk32.exe
Size 400KB
SHA256 f7f9e026d07db385e7a77f6411b9f4a63565c1966da785b705700ccf449565e4
MD5 de071be5e30b8ffea3666cb4e829299e
SHA1 e1e99add78deb8a7286e1d51b82c4fd86277d09f
SHA512 558d6125aa85be03ed8292ebed78039e396b640089234150eaf435818cfa3426b2023e91f861c09435228b1b3debd8b71604da14fc9a441f7efdc21e2f6e15e8
SSDEEP 6144:O9TaWG6dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:OlaKRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afmhck32.exe

Path C:\Windows\SysWOW64\Afmhck32.exe
Size 400KB
SHA256 e4f1b1ac47c29818b0357db80c6eb63fa9e6ed04a35a18963dd2862adf1ac327
MD5 1258f448daf5608922846240ccb070aa
SHA1 71bfcf55b0287cc76691e5065be54f92300eb0c8
SHA512 9dc12a1019c0e708d058b967c0076c99920a666561a11c240843c84d328507ef02c369f6e125e9fd2a3d4883e4e74b70311e6af79795e6dc99e01d8ffffd38f0
SSDEEP 6144:JrhgR2qrM/9dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:JrhC2qrmRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afoeiklb.exe

Path C:\Windows\SysWOW64\Afoeiklb.exe
Size 400KB
SHA256 cda970be6c749a60073df3acb9957f35b3130cc92e4178f6de9e5483f6fca68b
MD5 b5b176bf58acfd1ce35109823735d421
SHA1 18cc5ce623acd37b5be65cd214d7c3dcd2261c69
SHA512 bfb066889a5aa0ebdb598d345a6088ad2c8a417c1dfc5871226284765f58308a8fc164020e6ac6519a61a03012fe720e3b0c4cc2a6d4c709a137db4df386e26f
SSDEEP 6144:JBTdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:5Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aglemn32.exe

Path C:\Windows\SysWOW64\Aglemn32.exe
Size 400KB
SHA256 c16f395ff46ead5ddf93ff9675fcb8fe77deb07de3cb47892ab5778710f7d6f8
MD5 b33f1400c961357910a63e7ee3943ece
SHA1 024d237a1868dd21014ed02d318f441f452ab5ff
SHA512 27bd93fecf90000492689122dc76167565985dfc4d29736d8809a18725dcdf27e4c320d949064fdb1033e9e02cbe6a9225311e71162d9ee7b4750a2cb954edd3
SSDEEP 6144:iDZbfnNO2SdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:oE5Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Agoabn32.exe

Path C:\Windows\SysWOW64\Agoabn32.exe
Size 400KB
SHA256 4940359bacb26a3767f687bdab5bc5db43b30f55d4a2e44766cc2606f81d859e
MD5 102c9ebb37d1f63ed56b6d5004bcc3db
SHA1 70e2899293647ad1898554f5374f7ab1862fa0ae
SHA512 e9279c97cc61a8a4e04432937c52291e0e7e114a9f58b8bbcf943f7b913b762268e54e8be0842c60200916252c69755df2c3924e23174f056d97fc31627493a9
SSDEEP 6144:dSwfUyKPdK2uIdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:TUyKPYSRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aminee32.exe

Path C:\Windows\SysWOW64\Aminee32.exe
Size 400KB
SHA256 260dd422fb17b1a5986e205ec6d085464cc04107059af88a0e2f707e01389746
MD5 60a786099054ee0bf415d2d29d407640
SHA1 b9810825806962a13fdd21aa76690d4e87f04f68
SHA512 e3eb0dd8326049e65b80b3f5a31839ad979a5804c746501bbbe117fe5b256e035749bd4447f0273a7776f8fa3faeef8e3e2c5fdd6e2157ab6f4b60fafb66aae1
SSDEEP 6144:3/ZGQGjdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:3RGQCRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anadoi32.exe

Path C:\Windows\SysWOW64\Anadoi32.exe
Size 400KB
SHA256 13a75a75f4d3fce1445e03924e149418a5e2356ef2f88e4d56ed2117e775ed31
MD5 5e9ba4ab35008bc0613078237a727d67
SHA1 423bf759831bf0fbc01ed03128b337a2c911cbdb
SHA512 55f9ddec223410b7df44758cd8e169ea2eddf5c6280728c31f2eb4895df53e06b829ac23c4271f30d8a8e8f6a5d8aaf97288dfd122f8f5ed0dc4b170bf7a4a8d
SSDEEP 6144:eXqU11dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:eaUpRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Andqdh32.exe

Path C:\Windows\SysWOW64\Andqdh32.exe
Size 400KB
SHA256 fde234d5ada4694061732d1f5d955d492f5f1a0541a421b819ed32b054d52078
MD5 924bf8f01072e18bf8fe70ba0468d93b
SHA1 2596e182fe919de17a0d1927b917d554d6dbd70c
SHA512 7ca98bbc3c4a4aa2a4a2b30d650ee01c33e51ab224d41d8614cd6fdd8ce6df70fe33581a02db201eb3e11580c33dd19f717a3870081aa891d77273badac09304
SSDEEP 6144:rPJxRTVLdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:rPDRTrRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anfmjhmd.exe

Path C:\Windows\SysWOW64\Anfmjhmd.exe
Size 400KB
SHA256 91305be3d78041e4781be27898167aed1cba204693458f7d2ebdeb4512cf4394
MD5 aae8740251ce31ae7af56274c88174d0
SHA1 d7d24b15a4bfed4c4c695e3f6172a544b631f0c5
SHA512 7ccf2bb1294a08373cea7dc702e63f3ae018d22200c9456fb475b19e372dbbdf5b0543bada4662b43e8c3b641bd33749099746780d51e161c6e106f1eddb6f43
SSDEEP 6144:M1jxZ9YMZdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:M19hRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bagflcje.exe

Path C:\Windows\SysWOW64\Bagflcje.exe
Size 400KB
SHA256 64d68ab4259e0dbfa5d3d6895b7bfdc0b531132d04690d387b9581f5bc68ce93
MD5 5712409c6403be893278a7ba49246e63
SHA1 f49bf967bd0b2d4bfd506212f96387d88946f65d
SHA512 1c1994889fb9bf6be6e85757a922ddf47d6e548945680a7e57d239463641c511b5448b94468370652e18b686343e373f3d62231036584fe38911399e2207b6f2
SSDEEP 6144:ohR9KcZzdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:oXRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Baicac32.exe

Path C:\Windows\SysWOW64\Baicac32.exe
Size 400KB
SHA256 e78339d280a02e3d0a0fba9470374d083803b6f8e8ee1fb887dbfa199df02805
MD5 ff09f3c63f6a80df25778a0528e48af2
SHA1 ab0ecb8f737419a4f66fe232dd300b64da1b4d65
SHA512 2ce3c414ac64c3f86193b901b66655dbf0e52f7e8d1181580eead5afa2744dea8f562332cb3361db8d6e682b1434c4992fe2a46a4d964923dcdb13740fa7f5f1
SSDEEP 6144:pJJaEdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:pjRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Balpgb32.exe

Path C:\Windows\SysWOW64\Balpgb32.exe
Size 400KB
SHA256 74e375ac4891975f9eda2fd94dbecfa53a3fc2c13a29254f58bf8c64a3febbea
MD5 6049ecda5dd8c9ce49cb70ffe12fef4d
SHA1 6aa7fa84190efa6684d28b3aac6934bfcfcec420
SHA512 004182a9d6e0903efe5269cfdb6a553d6b4dcfaaa03d73dc9dc5797c4904effa26c8e21bb741542b0ce639aae7c661ee416cff9c4bd92114c2d029fee7c3e7ea
SSDEEP 6144:ilNpmzrjX1+CdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:6sRhRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Banllbdn.exe

Path C:\Windows\SysWOW64\Banllbdn.exe
Size 400KB
SHA256 8c5e36626a648a49f3e87b7b9c17227449e8d1c03a0fa024a732c0aa0ea8308f
MD5 0c9924b6e18641b8705dd7ca37fbddcd
SHA1 eb81e4eada392996e26a3c72b2ea299225765beb
SHA512 09e460eaa498479bb3eb12c29fdc3c53f75480c2929df7fb64762890ddab0d7f586ffc8783e0429261dd0ece02d5955bb5dfc833580988063c7dd2a4344e39ab
SSDEEP 6144:5YgfLencdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:53Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bcjlcn32.exe

Path C:\Windows\SysWOW64\Bcjlcn32.exe
Size 400KB
SHA256 2aa7eae812da62df052746850ac6f66c328a7f9184d31b26789a9af72978c117
MD5 173366fd5d7f0bc959bb71a538dad3bf
SHA1 5b22e606fa54b3665fcd9fc52620c80d13b70aea
SHA512 a2b75bb76a9b9d7d754587cafbd6087f3b5d8039ea79b217838bbf2929f338e0929014c534b7e5d8ff96e259e9b8061fb53b5ad9e222e01f9f966ec3c521f85a
SSDEEP 6144:LvsSffydLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:Ds4GRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bebblb32.exe

Path C:\Windows\SysWOW64\Bebblb32.exe
Size 400KB
SHA256 cabc49331f8dafbcded40d86a0b31de30288905f6c6cd0c7f04a1ede3b12cde6
MD5 70cfda503f3c353db3773ea93760edec
SHA1 5dfc13cd6d85ecd09a2d1db5ce75c08ce588b2b0
SHA512 f801c6978ca115d459e684fb548bc9434e850e173b68cc26e510f23c008932d876ce6db82cbe3494c76e6c605b3f9a8330e6cde9a1b06e53fff441669be88932
SSDEEP 6144:MXNcoigKR8dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:acoyuRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beglgani.exe

Path C:\Windows\SysWOW64\Beglgani.exe
Size 400KB
SHA256 00717fa59ef29915304d962ce1c1e304dd650802783919d06249af3ad73f4ab7
MD5 a756c24c222db6ee9130051a20ab30fc
SHA1 4f520d7ae0da0d2b9bc524a0e44fc8101b7d572c
SHA512 1e85b2b4e6c45386692d1ffb0d8ec02de5f6249f11f758fe613eff5419246f7e47d074981de0047fd8d0cdbed1e6b6c2cf2226371db058a63c98341b6288c0ce
SSDEEP 6144:WxMlIbRdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:Wm+Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfabnjjp.exe

Path C:\Windows\SysWOW64\Bfabnjjp.exe
Size 400KB
SHA256 0080974bf601a19bc3ec3c995e303262c5066375d5094ce116ec60a39295bbef
MD5 448706ea282851dd9ec47fb35a6579ba
SHA1 17cb7eb089ba91e99fa87dd7f9835dfee2e44cfe
SHA512 12ce9902d98da85c33be30c5ad1732d0a75c438ddb0dbf86bbd4427d55b5b419d4947159b676754c318dea328a932fc6b76798224d72c54b3a300a6596293d70
SSDEEP 6144:R4xc3v8H2dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:CxAvtRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfdodjhm.exe

Path C:\Windows\SysWOW64\Bfdodjhm.exe
Size 400KB
SHA256 e36fe33d7b7987da141c0e7deb2f957f0e4920ce8f237b3cebaab7233973bfd4
MD5 a03a5044552fd84d51c2bfb097ccd9c4
SHA1 ad7907517fcd49580be985c5990f0e2dacf6044d
SHA512 65c532b43df329e59d3109a0db7438b734f996ed3a0d17b895937343005f62e716ffb03b9123204815f3da038f579dc89d72e7ef1e371e38b5fba9a0b098f5af
SSDEEP 6144:lghVCdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:lwERrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bffkij32.exe

Path C:\Windows\SysWOW64\Bffkij32.exe
Size 400KB
SHA256 6b83cebb5c43e965eebcfa5d1dc6837ea9def7bce79406cb32f89d4037f6f5b8
MD5 db41bddef8f5fb541f029fd7d8d0d700
SHA1 d7cb009d00480dbaf57c838bd933ee283102f728
SHA512 088691b1b0b8efab8caa7f536b3ff04672ce3bd26e062669a0c46c2363797d668aea0affe3212b486daa8c566e125bc7f45cd656f082dd3ce6af83b151005676
SSDEEP 6144:3PyxoNDltdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:aSNDtRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfhhoi32.exe

Path C:\Windows\SysWOW64\Bfhhoi32.exe
Size 400KB
SHA256 31a8e46b5b3f1054d53f25c7afbd6d4e38ca759bc725e35b9d8ccd32c35b1f01
MD5 f661285149d077c7daefd56a46031394
SHA1 e6be45cacd85897d9ae57cce3650a9e54bb99cb9
SHA512 a44303508e2758cfec715a8c79e3ee27b6a9098a2fec39044f6f55535b8a4f15d43ba1a7e596fb37e52f79e34132b71f7185c1c8f77c6cafb25ac4d29554f629
SSDEEP 6144:RzAoMg0dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:SJRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bganhm32.exe

Path C:\Windows\SysWOW64\Bganhm32.exe
Size 400KB
SHA256 5292805b0d6ce55d955a731061682e0135f5213b1178b1d4e4e738194c60803b
MD5 a4fee8b58870e32c48ffcf0fb04042e6
SHA1 b97972a2971b98de6ee384bc34b01e9114137278
SHA512 1a302d01e0d2ff0a7a1fbd1abad530a5671b1c0f7f1d0538586c8660350be5abb29774cc2818d09b12445225ccf930768435957476b0b79d7e6b94049da4b60f
SSDEEP 6144:2VAxV3dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:2CRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjddphlq.exe

Path C:\Windows\SysWOW64\Bjddphlq.exe
Size 400KB
SHA256 83a7da831f6f84cb93332c4f2bdbad0c879e12c93e874304e31d5805488984b8
MD5 0fe78098fdc40d520984fd6216e07cd5
SHA1 63795f26ee063c01bc247879120ac0cd6eb5fde5
SHA512 22705057af91803be0e95190dbac6dff525c47397d051f393241871523dee00d3753e300b45dd4649cccdf5ebc71ea762033c8bd1552c4fcc0915a4b168990c4
SSDEEP 6144:sTGkv6TvidLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:SGkvY2Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjmnoi32.exe

Path C:\Windows\SysWOW64\Bjmnoi32.exe
Size 400KB
SHA256 eb57c1860a3df8335f7b9c4c081bd0265f783eb9165d3c37db16e7ef1fd8bd36
MD5 b30bda4839c6e9fc71e60bab7d153f86
SHA1 56767ab0506f784abe9c204581a2bf531551dcc8
SHA512 01970d1a4b151a2b679bd10ad2666a544d23f610673b801242f54f30c6743149bc69dbdc82fcc6e264635660511021a32728e4aecda2bb853bed5713a5473b51
SSDEEP 6144:0EUbSMe+dLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:NUbSMhRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bjokdipf.exe

Path C:\Windows\SysWOW64\Bjokdipf.exe
Size 400KB
SHA256 82c02f0186f0cf1b028a9f57d0778ec80d9e4e76d91b8f502ca49528ce7791e0
MD5 5862521ece5e12090bb8362c8ddd7c37
SHA1 6157950ce7b58e7ea97b61ab79673f55244a5efe
SHA512 2e4781159d5e6544d745fbb92256fc4cfcc27eb47e2825f95bca5648c5104225af63cd87e9cd468cfc82fbda892b3e15176026a263afa63154a3f277ecc85bb4
SSDEEP 6144:/WEMdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:kRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmbplc32.exe

Path C:\Windows\SysWOW64\Bmbplc32.exe
Size 400KB
SHA256 ed488f9100b332005c6a38a502a76db4fa6daafabf532abcfe14e2116a9f6a5b
MD5 8ed23455895c2e7062d45d166e4ddb3d
SHA1 d8218c4254d342c09fa987ef19ee441e3acd37e7
SHA512 8da8b88072b38437ccd5b4650b2d3eea8e590c3e4d09818c174196a3aafc51b312354a1a3128406902534af321020dd19bf56e4a4a84a023fd6ada6760d82771
SSDEEP 6144:oHC/GBhdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:oH5Rrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmkjkd32.exe

Path C:\Windows\SysWOW64\Bmkjkd32.exe
Size 400KB
SHA256 2bb73abe5fe949e17d483ea9dae9ed8de1311b2476ebeeb4cc6474590ebea813
MD5 7111badb5e68fdc18d45dc83485d78d4
SHA1 e0a953660eb2384b8126bc69e9628fdc9b60d77c
SHA512 a218e6992f338f1d9397964bbeb713778f12587fcfa39db419a821ebd845a964fd32b5f3202b482bf2fdd3e2bca403231d117d695dd1f336122fe8c749d5eee1
SSDEEP 6144:5vPXVrFdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:NPVTRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmngqdpj.exe

Path C:\Windows\SysWOW64\Bmngqdpj.exe
Size 400KB
SHA256 19360d8efd9d3c5f615163cffdb97da1f5cea3eea8442859d7cbfb55a67e910c
MD5 3d8829baee314a7ae986c453d1e630f7
SHA1 46f293cd58915c29973606326a50f54893592bbc
SHA512 7e5b07d0e4f7c0f445770e3d24b4308cbb1abeb47f517a79876b7d659191c8ae18c08537dba6fd1347fbe3216b700039f93bb3a9c852671eb366467a9b1d8161
SSDEEP 6144:sW1ifREZdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:sjRGRrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnmcjg32.exe

Path C:\Windows\SysWOW64\Bnmcjg32.exe
Size 400KB
SHA256 a004bcef226d9536b31a0e864d869612c0731f322fb23ecd39d2dcbbefe8e173
MD5 7125f7da24df3b85d12bfc4f9e495176
SHA1 3bf77ef343572c834b6115858982703eff785ca0
SHA512 32d7759cebf16dcbbfd2835223526f416cfcc2598bc33e7f9cd29b297769225482360afc6a26bea964e52b30e2e1a9c05d9626d0107d6142b15a7c22c77ceb97
SSDEEP 6144:hMrfoBdLAY/Xr4Br3CbArLAZ26RQ8sY6CbArLAY/9bPk6Cbv:qrfORrgryg426RQagrkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-158-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/660-45-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/692-142-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/736-125-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/768-539-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/768-17-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/936-346-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1000-260-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1300-166-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1348-547-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1448-549-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1516-236-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1616-9-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1616-538-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1620-85-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1836-69-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/1988-317-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2212-364-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2228-340-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2556-540-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2556-543-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2768-212-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2788-77-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2820-134-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2852-541-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2852-29-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2956-101-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3016-306-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3356-220-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3380-93-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3448-149-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3548-288-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3560-252-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3644-300-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3680-352-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3688-271-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3852-117-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/3960-204-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4060-33-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4192-228-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4208-334-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4332-554-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4332-521-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4380-294-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4492-189-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4516-244-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4524-328-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4600-277-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4604-109-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4632-526-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4632-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/4736-53-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4740-358-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4824-180-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4844-61-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/4908-546-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5180-380-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5256-391-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5256-597-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5292-595-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5292-397-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5332-403-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5332-593-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5372-591-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5412-414-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5412-589-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5448-587-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5448-420-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5488-426-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5488-585-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5528-583-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5568-437-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5568-581-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5604-579-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5644-577-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5644-448-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5680-575-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5720-459-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5720-573-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5756-571-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5756-465-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5796-471-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5796-569-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5836-567-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5876-565-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5912-563-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5912-487-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5948-561-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5988-498-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/5988-559-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/6024-504-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/6024-557-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/6064-555-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/6064-510-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/6104-552-0x0000000000400000-0x0000000000453000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads