098d4e0845f92fa87f1678ae9cab85c77fb7aa341db859728c2085a42a031dfd

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a57b949c50d289bd2873d81d8ac04370N.exe
Size

570KB
MD5

a57b949c50d289bd2873d81d8ac04370
SHA1

64a8b060606cfebb7ada508c20d419c760e61772
SHA256

098d4e0845f92fa87f1678ae9cab85c77fb7aa341db859728c2085a42a031dfd
SHA512

449c75d4ff5730d7a551f6fcabeaa76691125230d4e1e785496ebde71fac5939634232ed850de65e01bccfed6d1c9c40c243e7bd4a415bd6e95f7ce766237356
SSDEEP

12288:jx5RSPh2kkkkK4kXkkkkkkkkl888888888888888888nusMH0QiRLsRf:jx5RSPh2kkkkK4kXkkkkkkkkhLg

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplobcpp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnafno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phajna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqkiok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nggnadib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a57b949c50d289bd2873d81d8ac04370N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amjbbfgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Moipoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baegibae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boldhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcifkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcifkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amqhbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocjoadei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkmomfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npbceggm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmeigg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe

Executes dropped EXE 64 IoCs

pid	Process
6008	Mnhdgpii.exe
4404	Mqfpckhm.exe
3592	Moipoh32.exe
4276	Mgphpe32.exe
4932	Mfchlbfd.exe
5960	Mnjqmpgg.exe
1888	Mmmqhl32.exe
5828	Mokmdh32.exe
4380	Mcgiefen.exe
4264	Mfeeabda.exe
5064	Mjaabq32.exe
1684	Mmpmnl32.exe
6088	Mqkiok32.exe
5060	Mcifkf32.exe
1224	Mfhbga32.exe
2668	Mjcngpjh.exe
5856	Nnojho32.exe
4252	Nqmfdj32.exe
4204	Nopfpgip.exe
5808	Nggnadib.exe
2980	Njfkmphe.exe
5472	Nnafno32.exe
3256	Nqpcjj32.exe
2356	Npbceggm.exe
3960	Ngjkfd32.exe
540	Njhgbp32.exe
2968	Nncccnol.exe
1652	Nqbpojnp.exe
5500	Npepkf32.exe
5636	Nglhld32.exe
5240	Nfohgqlg.exe
3724	Nnfpinmi.exe
5972	Nmipdk32.exe
1384	Npgmpf32.exe
3544	Ncchae32.exe
4916	Nfaemp32.exe
2972	Nnhmnn32.exe
5656	Nagiji32.exe
5804	Nceefd32.exe
5412	Ngqagcag.exe
3348	Ojomcopk.exe
5812	Omnjojpo.exe
4344	Oplfkeob.exe
4260	Ogcnmc32.exe
64	Ojajin32.exe
1208	Onmfimga.exe
748	Oakbehfe.exe
5752	Ocjoadei.exe
1988	Ofhknodl.exe
4312	Onocomdo.exe
4212	Oanokhdb.exe
1284	Oclkgccf.exe
2072	Ofkgcobj.exe
4240	Onapdl32.exe
2232	Oaplqh32.exe
5704	Ocohmc32.exe
5444	Ofmdio32.exe
4884	Ondljl32.exe
6072	Oabhfg32.exe
6044	Ocaebc32.exe
5308	Pjkmomfn.exe
4836	Ppgegd32.exe
4320	Phonha32.exe
2432	Pfandnla.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Njfkmphe.exe	Nggnadib.exe
File created	C:\Windows\SysWOW64\Mgnddp32.dll	Caojpaij.exe
File opened for modification	C:\Windows\SysWOW64\Bgpcliao.exe	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Kllfakij.dll	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Bgpcliao.exe	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Jgqjbf32.dll	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Iocbnhog.dll	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Nnfpinmi.exe	Nfohgqlg.exe
File created	C:\Windows\SysWOW64\Omnjojpo.exe	Ojomcopk.exe
File created	C:\Windows\SysWOW64\Hiebgmkm.dll	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Bmeandma.exe	Bkgeainn.exe
File opened for modification	C:\Windows\SysWOW64\Mnhdgpii.exe	a57b949c50d289bd2873d81d8ac04370N.exe
File created	C:\Windows\SysWOW64\Mqfpckhm.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Jhijep32.dll	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Bdfpkm32.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Bjlfmfbi.dll	Cdmfllhn.exe
File created	C:\Windows\SysWOW64\Figmglee.dll	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Cpdgqmnb.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Kmephjke.dll	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Qmgelf32.exe	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Ojomcopk.exe	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Iohmnmmb.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Bpfkpp32.exe	Bmhocd32.exe
File created	C:\Windows\SysWOW64\Mfchlbfd.exe	Mgphpe32.exe
File created	C:\Windows\SysWOW64\Gabfbmnl.dll	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Njhgbp32.exe
File opened for modification	C:\Windows\SysWOW64\Amlogfel.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Mjaabq32.exe	Mfeeabda.exe
File created	C:\Windows\SysWOW64\Hilpobpd.dll	Mcifkf32.exe
File created	C:\Windows\SysWOW64\Qbkofn32.dll	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Nqmfdj32.exe	Nnojho32.exe
File opened for modification	C:\Windows\SysWOW64\Pjpfjl32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Ciipkkdj.dll	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Ppahmb32.exe	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Qkhnbpne.dll	Ahfmpnql.exe
File opened for modification	C:\Windows\SysWOW64\Ofkgcobj.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Akblfj32.exe	Ahdpjn32.exe
File opened for modification	C:\Windows\SysWOW64\Nnafno32.exe	Njfkmphe.exe
File opened for modification	C:\Windows\SysWOW64\Onocomdo.exe	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Ahaceo32.exe	Apjkcadp.exe
File created	C:\Windows\SysWOW64\Iocedcbl.dll	Amcehdod.exe
File opened for modification	C:\Windows\SysWOW64\Qhjmdp32.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Cdkifmjq.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Mjcngpjh.exe	Mfhbga32.exe
File opened for modification	C:\Windows\SysWOW64\Nfaemp32.exe	Ncchae32.exe
File created	C:\Windows\SysWOW64\Ckkpjkai.dll	Ncchae32.exe
File created	C:\Windows\SysWOW64\Ofhknodl.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Hgncclck.dll	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Iafphi32.dll	Pjdpelnc.exe
File created	C:\Windows\SysWOW64\Gikgni32.dll	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mnjqmpgg.exe
File created	C:\Windows\SysWOW64\Phonha32.exe	Ppgegd32.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Oanokhdb.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Cklgfgfg.dll	Boldhf32.exe
File created	C:\Windows\SysWOW64\Mokmdh32.exe	Mmmqhl32.exe
File created	C:\Windows\SysWOW64\Fnihkq32.dll	Mfeeabda.exe
File created	C:\Windows\SysWOW64\Coqncejg.exe	Cgifbhid.exe
File opened for modification	C:\Windows\SysWOW64\Cdmfllhn.exe	Caojpaij.exe
File created	C:\Windows\SysWOW64\Eekgliip.dll	Cnhgjaml.exe
File created	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Mnhdgpii.exe	a57b949c50d289bd2873d81d8ac04370N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	4896	WerFault.exe	232

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amcehdod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhmbqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nncccnol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncchae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplobcpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqfpckhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amjbbfgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahfmpnql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgnomg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpiplm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nopfpgip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnfpinmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjfmkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjpfjl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnhgjaml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a57b949c50d289bd2873d81d8ac04370N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjaabq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oabhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phajna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahmjjoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aknbkjfh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apjkcadp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdbpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfchlbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojomcopk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogkmgba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boldhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgqlcg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnjdpaki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmfdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfaemp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjdpelnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpmapodj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofhknodl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnifekmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdfpkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdkifmjq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oclkgccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnkbkk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofmdio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpcecb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmipdk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnafno32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbjqfjb.dll"	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocaebc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgegjnih.dll"	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbcpc32.dll"	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oppceehj.dll"	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbfan32.dll"	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppcbba32.dll"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjceejee.dll"	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnpofk32.dll"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kllfakij.dll"	Nqmfdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjnlmph.dll"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnfpinmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhhlki32.dll"	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikjllm32.dll"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckkpjkai.dll"	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obqhpfck.dll"	Mfhbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaagdbfm.dll"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qjfmkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	a57b949c50d289bd2873d81d8ac04370N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Domdocba.dll"	Boihcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciipkkdj.dll"	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leilnmkp.dll"	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghien32.dll"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dicdcemd.dll"	Npbceggm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 6008	2420	a57b949c50d289bd2873d81d8ac04370N.exe	84
PID 2420 wrote to memory of 6008	2420	a57b949c50d289bd2873d81d8ac04370N.exe	84
PID 2420 wrote to memory of 6008	2420	a57b949c50d289bd2873d81d8ac04370N.exe	84
PID 6008 wrote to memory of 4404	6008	Mnhdgpii.exe	85
PID 6008 wrote to memory of 4404	6008	Mnhdgpii.exe	85
PID 6008 wrote to memory of 4404	6008	Mnhdgpii.exe	85
PID 4404 wrote to memory of 3592	4404	Mqfpckhm.exe	86
PID 4404 wrote to memory of 3592	4404	Mqfpckhm.exe	86
PID 4404 wrote to memory of 3592	4404	Mqfpckhm.exe	86
PID 3592 wrote to memory of 4276	3592	Moipoh32.exe	87
PID 3592 wrote to memory of 4276	3592	Moipoh32.exe	87
PID 3592 wrote to memory of 4276	3592	Moipoh32.exe	87
PID 4276 wrote to memory of 4932	4276	Mgphpe32.exe	88
PID 4276 wrote to memory of 4932	4276	Mgphpe32.exe	88
PID 4276 wrote to memory of 4932	4276	Mgphpe32.exe	88
PID 4932 wrote to memory of 5960	4932	Mfchlbfd.exe	89
PID 4932 wrote to memory of 5960	4932	Mfchlbfd.exe	89
PID 4932 wrote to memory of 5960	4932	Mfchlbfd.exe	89
PID 5960 wrote to memory of 1888	5960	Mnjqmpgg.exe	90
PID 5960 wrote to memory of 1888	5960	Mnjqmpgg.exe	90
PID 5960 wrote to memory of 1888	5960	Mnjqmpgg.exe	90
PID 1888 wrote to memory of 5828	1888	Mmmqhl32.exe	91
PID 1888 wrote to memory of 5828	1888	Mmmqhl32.exe	91
PID 1888 wrote to memory of 5828	1888	Mmmqhl32.exe	91
PID 5828 wrote to memory of 4380	5828	Mokmdh32.exe	92
PID 5828 wrote to memory of 4380	5828	Mokmdh32.exe	92
PID 5828 wrote to memory of 4380	5828	Mokmdh32.exe	92
PID 4380 wrote to memory of 4264	4380	Mcgiefen.exe	93
PID 4380 wrote to memory of 4264	4380	Mcgiefen.exe	93
PID 4380 wrote to memory of 4264	4380	Mcgiefen.exe	93
PID 4264 wrote to memory of 5064	4264	Mfeeabda.exe	94
PID 4264 wrote to memory of 5064	4264	Mfeeabda.exe	94
PID 4264 wrote to memory of 5064	4264	Mfeeabda.exe	94
PID 5064 wrote to memory of 1684	5064	Mjaabq32.exe	95
PID 5064 wrote to memory of 1684	5064	Mjaabq32.exe	95
PID 5064 wrote to memory of 1684	5064	Mjaabq32.exe	95
PID 1684 wrote to memory of 6088	1684	Mmpmnl32.exe	96
PID 1684 wrote to memory of 6088	1684	Mmpmnl32.exe	96
PID 1684 wrote to memory of 6088	1684	Mmpmnl32.exe	96
PID 6088 wrote to memory of 5060	6088	Mqkiok32.exe	97
PID 6088 wrote to memory of 5060	6088	Mqkiok32.exe	97
PID 6088 wrote to memory of 5060	6088	Mqkiok32.exe	97
PID 5060 wrote to memory of 1224	5060	Mcifkf32.exe	98
PID 5060 wrote to memory of 1224	5060	Mcifkf32.exe	98
PID 5060 wrote to memory of 1224	5060	Mcifkf32.exe	98
PID 1224 wrote to memory of 2668	1224	Mfhbga32.exe	99
PID 1224 wrote to memory of 2668	1224	Mfhbga32.exe	99
PID 1224 wrote to memory of 2668	1224	Mfhbga32.exe	99
PID 2668 wrote to memory of 5856	2668	Mjcngpjh.exe	100
PID 2668 wrote to memory of 5856	2668	Mjcngpjh.exe	100
PID 2668 wrote to memory of 5856	2668	Mjcngpjh.exe	100
PID 5856 wrote to memory of 4252	5856	Nnojho32.exe	101
PID 5856 wrote to memory of 4252	5856	Nnojho32.exe	101
PID 5856 wrote to memory of 4252	5856	Nnojho32.exe	101
PID 4252 wrote to memory of 4204	4252	Nqmfdj32.exe	103
PID 4252 wrote to memory of 4204	4252	Nqmfdj32.exe	103
PID 4252 wrote to memory of 4204	4252	Nqmfdj32.exe	103
PID 4204 wrote to memory of 5808	4204	Nopfpgip.exe	104
PID 4204 wrote to memory of 5808	4204	Nopfpgip.exe	104
PID 4204 wrote to memory of 5808	4204	Nopfpgip.exe	104
PID 5808 wrote to memory of 2980	5808	Nggnadib.exe	105
PID 5808 wrote to memory of 2980	5808	Nggnadib.exe	105
PID 5808 wrote to memory of 2980	5808	Nggnadib.exe	105
PID 2980 wrote to memory of 5472	2980	Njfkmphe.exe	106

C:\Users\Admin\AppData\Local\Temp\a57b949c50d289bd2873d81d8ac04370N.exe
"C:\Users\Admin\AppData\Local\Temp\a57b949c50d289bd2873d81d8ac04370N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\Mnhdgpii.exe
  C:\Windows\system32\Mnhdgpii.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\Mqfpckhm.exe
    C:\Windows\system32\Mqfpckhm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\SysWOW64\Moipoh32.exe
      C:\Windows\system32\Moipoh32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4276
      - C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5828
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5856
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        24⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        26⤵
        Executes dropped EXE
        
        PID:3960
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:540
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        29⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5636
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5240
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1384
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4916
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        43⤵
        Executes dropped EXE
        
        PID:5812
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        44⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        45⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        46⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5752
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1988
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4212
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1284
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        54⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        55⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5308
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        63⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4836
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        65⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        66⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        68⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1584
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        73⤵
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        74⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        75⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3876
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:700
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        79⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5600
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        81⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1980
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        83⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        85⤵
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        86⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:444
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4352
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3112
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        91⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1520
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2964
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        96⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4372
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        101⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:372
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2724
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        107⤵
        Modifies registry class
        
        PID:4192
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        108⤵
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        110⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4188
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4628
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        120⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        121⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        122⤵
        Modifies registry class
        
        PID:868
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        125⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1348
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        129⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        134⤵
        Drops file in System32 directory
        
        PID:5140
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        136⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        140⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        142⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        143⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        145⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4904
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        147⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 212
        149⤵
        Program crash
        
        PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4896 -ip 4896
1⤵
PID:5888

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
570KB

MD5
32a8a5464ff647f8bce8efc31e074690

SHA1
cab7cca3eef82d3910317dcca1a46eb56995649d

SHA256
4ee8fa62b6afaae71d7d426606e06b4c3d6327d298480b97d40bb907c3e5f61b

SHA512
a1d8cc23dee73d597986bc61b8db5efcf0e244dcadfa1dfb2fe5c2148cbef539925e3d1dfda535582511c9321eca3429144a4763ff8774dcb8a075139c37034f

Download Submit
C:\Windows\SysWOW64\Cpdgqmnb.exe

Filesize
570KB

MD5
1999d6eaf706caf6b842bd4ca0513126

SHA1
86f179e168f3e90668eedb9ae55e82642f09a9f0

SHA256
b6598d94f4e0a960fe1bd83808017f395e0358f96507e6c63832cafa3a73b6b8

SHA512
6d5b8af64674a1bc5613c8f470985a8d82558f232ac34087ff9b6215ebeab11bb7dcfa73455089bda38b92c3cd26e2df1c30c0252d040aa9dbad6c83d702282f

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
570KB

MD5
4a41d5d1679ca9431825eced19bddb7c

SHA1
c569201f453c5471eea1fccc6a2cd2c2b3bdf92f

SHA256
cb7c84980a25a51bd68286ceccfd985817544cec3ee55665696770ab19b7da78

SHA512
c7487aa9c40933fd4bc6c50d8f85c3d908a6c4a24d536150b1f7befc37343ed1b535398bf7a3d89b8c296bb80e5229d80fed6c3365eb9af665ac98ea50b141ea

Download Submit
C:\Windows\SysWOW64\Jnifpf32.dll

Filesize
7KB

MD5
a1781a0c523554a5727787ce7b7ab31b

SHA1
09fe46d2756d4ef90ea02917a33472667987e03a

SHA256
3721dfe4dfee50f1d2c75e02ec68a3f00a8728b5341d5cdfd8b9810f21c2b252

SHA512
d0b1adb1429f2beda11c56e9b185cb96b04784d058086e33f97846cdc7abae1025b57ff32012649a576fdc712c786601d12c353ab49fe9d9cd84ea963b4403bd

Download Submit
C:\Windows\SysWOW64\Mcgiefen.exe

Filesize
570KB

MD5
d1e66086593b060973cbe642b8ba5a53

SHA1
7f8bb0b8a6092687daed6befb19ebcdd64e3b88b

SHA256
0f9ddfea9561539dc4d549838ec1d368c833dd078f97db95aa8ab01bd438a870

SHA512
238da00c72a194966e215dc2fe0e746c19a28942f3949ce38fbc54f720d7f4f983ac3b8d8530d6748237123bbbb3501b374745403e0c1c0d934334f44b0571fa

Download Submit
C:\Windows\SysWOW64\Mcifkf32.exe

Filesize
570KB

MD5
08f3e8610978465c5def5e21e9b08c91

SHA1
740dbd8bc4ba94760f00035e5035e763a8a8bf01

SHA256
c15847de3cfc752094ab0ffef678f3ac47c99046693309604065e2955d3a6a05

SHA512
789dfe1fbda0272ce12db4245927c9db69a1167f6e975479d5a037604269f9326ac417e0101f37a5b0a7dbcd293830fc164f110054014a17b93bec65764f0621

Download Submit
C:\Windows\SysWOW64\Mfchlbfd.exe

Filesize
570KB

MD5
3837307ce628f65fa77e1610688bc40c

SHA1
cdae9385bd443ea61836af9b6005785fabdf6ea4

SHA256
8d4810d119785c4fc43ce9107a10317f6310d435ed59175c42ee6e9549a7e84f

SHA512
0891ca705b8f65f492c61e839c4e157b3ecb9750c59949ded4034d6b29843d89d0e30aa21a8c2e073bde1ad5834ddfe5dedc6609df7273876f2efab78dbd0d3d

Download Submit
C:\Windows\SysWOW64\Mfeeabda.exe

Filesize
570KB

MD5
7fe5d022a170938119235f60c44d3152

SHA1
d13156837ecc6ce3588ebfb1095a01fd3db85ec0

SHA256
8db10c857841c45df53928fe7dbe1a836d263456c05cd8692e89d54c25d4d471

SHA512
bcdf73d83ea387f602a41ec8292a3d0a7c38708d7cdbdf97308af0a6e09011e8120aa58a3fd649d3f56221dd8c264419e32d10f23c28818226b44106cd0b7c4b

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
570KB

MD5
3d43dfc653f26896b6aab26c6db6cc83

SHA1
bedd7bfafb8b99b2a9595652e206962ffd6458dc

SHA256
5e1045329ea1b088eedf9b3fe184fc89d06122af2ad804559e26aca2f5e97b2e

SHA512
b568f91c01602c38656df85e8afc6cbe8546d4ba8e0d40740076ac6ced3ee57c759a43f6c7489a7a982e52aa4fcd175892092ac6a7691acfab33cde1d9213f26

Download Submit
C:\Windows\SysWOW64\Mgphpe32.exe

Filesize
570KB

MD5
9048b99fb9e08bf480d82a8ef88f9021

SHA1
5d6327f76c3d66a54532d30ca3e24ec1846fd5bd

SHA256
9fd640457b3822459f02f498d41762c9b08e90a9d263ceec116198651aaa9b39

SHA512
60857a04ff382d6c15c02d461566762626b3be732afff3b1f613c89c6497f03328428b8edfbe724a57287320b15ffbaa31754c84ada50da51fbd1c4abd2d940b

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
570KB

MD5
9487a0925fa0ae2019a85c665a4322cf

SHA1
99bfe3aab1d933320e08e0ddb764c69bd6eac599

SHA256
8a36c6080edd168dde1444bf8aa8848dc7a77574b9c970f92bcc1ffdeb4ac954

SHA512
237a909f4b727d2364d9d6051aadda462205e841403fdea06c264d170767a6684a43d89bca85c74cabbfeae7367ea1d6c704a1b7ea75cc3583baae8e13a7688f

Download Submit
C:\Windows\SysWOW64\Mjcngpjh.exe

Filesize
570KB

MD5
567d39c302d0d007903a523ef817e6e1

SHA1
d87164aec78671f9cbe6d62bab0b68106538fe1e

SHA256
d95593379aa3a5822f9d288ee5044921cf6ffa861f876d3d5938a698f7a01eb2

SHA512
0c737a929e3aa0683b5857561fe36b14b22ef239450ed92bb981d58276aabaadd6de57470bac30dfcb24249c67a66aee7732cfc14a78eb1a21185c9d7570f4f6

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
570KB

MD5
2aec6e47d180ccf08367074650fd4908

SHA1
c4679f7bd23f5625a9bf52a15c46d546a9036984

SHA256
08c384e7feb6365a91821a408c6812fdde8310794f07e21ef9f07d75d5af534b

SHA512
52255b701ab56e9b792359783325beb91885da7a65a5cd8d4afe4e4ec510c1a35214251626ef337e8b28ec735cadbbd6d55a677b4518d507901b10627c3b5120

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
570KB

MD5
eafa4d6e69f83099a518843bd696fd8e

SHA1
b6244790c4b10c701cdba16feda0dfe54ce1641b

SHA256
ab093a50aa67d7e396a70094feb2031d2fcd6730042bd27964542a94823792c3

SHA512
7a3b33140347c3b1ede817c818f8cc85bc386dc2a899df55ea27b60b9e231ede7643f7676185b42724fb40d5b8114ff4bc640980f317c86caf066329a6fef6a5

Download Submit
C:\Windows\SysWOW64\Mnhdgpii.exe

Filesize
570KB

MD5
83441d9b3861a9e46d0356283c59555d

SHA1
0cbb3d46e4f57bc0144e322a69d23ff0b968c298

SHA256
c2a5ab367a6d5ebf8797d3feb5c7d64357634d30d0c19b133851bde527b1318e

SHA512
2e2c522dd5a6c781aa75e3774d512284e9c296612956d87a012a483ace009a5e3d702f39f8caf5475d53308435f89e49d68653571223e1df54446d7633e763fb

Download Submit
C:\Windows\SysWOW64\Mnjqmpgg.exe

Filesize
570KB

MD5
da96c20071819e02b22b696265441197

SHA1
82d2eca4df25d3a2c91cdffc9d758937642838eb

SHA256
c4cd832c1608dae29a76a75d7f5903cf039dfffe0628f5828c6df5562fcbb9d8

SHA512
b111fa7c16f1c734bcf694fe403b0aea1ccac52172ab7703a3ac22b1fd5195a52376cfd5cc4fbbfdb454bb9c1ac5ed7457b6df8b969cd43de5f00293154a4afb

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
570KB

MD5
78e87f0af9874f4150b6af83070067c0

SHA1
f935559317042c27b2cd4d71fc7effa4e83801d0

SHA256
71063becfc2c6a158049bffd75ad15891be8b38a3e4baeeb3e1964f7b19832ef

SHA512
5924b6f62268e9b570b53a809a38129e19991dd5ae32963ef153028d6c3de9438ea572ba3989bc099c053d45695acf9f49344b37cb9fa8422616b5e4daa85d7d

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
570KB

MD5
43625aae40db029c73dad5688d1e580a

SHA1
452736ad5b7852e2871b84a61eb86388d7b6b8fe

SHA256
393012de5b9559df6bc10bf6e86473045b6124caad5c3a48c58848b37ab62b2a

SHA512
29d23feefc3e976b906a7083037238b0ce86c7628ed4e464d15014ec759d128d8f460d1e59ccb531a8a6b7aaf91eb979cc4b47c0f6223872ba828cdc2f3bd658

Download Submit
C:\Windows\SysWOW64\Mqfpckhm.exe

Filesize
570KB

MD5
7573b589af63b00a0b8f290eef367b14

SHA1
3a0f0b1a7189a1527a1fa95870c892f7c5cf6132

SHA256
5cf97a40d535b8c945b92bbb59badfb84354fba44bc59549704fd98efbbe7ba6

SHA512
34496c605992debf96bad90d09b50cab267515fc94c3c655150ece987f2fa53e98c90147aad08a907850f5114e468e4e6b78b64a0bb0b3a85fccc96116714c89

Download Submit
C:\Windows\SysWOW64\Mqkiok32.exe

Filesize
570KB

MD5
4ad5978dde023f7a4defe107256cadcf

SHA1
c81ab91e0c34852bbd10c43954b619e9d3de91e6

SHA256
32e7fc386f0da3936713aacd463c49867fa09111d1842704810a58fbf11002d9

SHA512
a0f6afcf056a10b7efa2a4af721f78c58ddb63daf8ea69344d655389e408b9036a3016064f29acce60b8ec31b2076d4c39c0f78a5467329b1f6b5fa9a1c9bf03

Download Submit
C:\Windows\SysWOW64\Nfohgqlg.exe

Filesize
570KB

MD5
e5b43e70b69f000a08fa2d65e2e3a40e

SHA1
4cd4502150dd20a82f8a9c6d65c6867b63aedb55

SHA256
a443feac2d3a2cfcc362fcd511441398f8d1143e704143f822e228434845178a

SHA512
e843b320601f2cf364339c33bcd9e355f6552ec58e0d62f943dbbcbcb0b3c5415a8d9a74c314a0ae81c508e09216dfb5426adc6e07bae0ab18579c9132958ec2

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
570KB

MD5
1341266950ad4dcba837ee7ae0def162

SHA1
b659ac36d8bbdd311aef895c308ca6419eef776a

SHA256
1a2cd51bb66791826864debc4e56c665d200012e1f0e989e8beebcfa0d21a815

SHA512
272f667ca5d1a67546ef996c83d5553433b1149caca0bbe3e26fd055b0a3e90760c6386047ede7bc4afac3057269e0b807f278f44c32eccf63216a615bb4525a

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
570KB

MD5
d225f4eba1e9a5536145070e74e51be9

SHA1
56f7a6de7a75afc3d069f091447b04d751c90c08

SHA256
9da9e192b38f46f2875e8c4e1ac53eb808ec1aeafda0b4997b4ddc35af4d8b04

SHA512
5c89b1c50fdfb53a8d4be17ac98373487ad373716776e6c962fe14f0f31e66aed6d7de3b7fdc85e984091a457804882f87183198124f67d2dec3bfb2ff85f415

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
570KB

MD5
f0e34b5837975237fe0dd56057eed52d

SHA1
6edd4a1e993ee25fe2edaa81a71725840a26ee87

SHA256
c1dee3fdcbd05c090635a3ad4c1a508ac489fd35c51d18dcc09ab0b69cc36f56

SHA512
27a7a638652d0980e1e4692ef610be54e474372f88f9df269913dba1ecfc54d159298055f8e3f8898c29645177333a6503b10291ffa23d572807481e4368872d

Download Submit
C:\Windows\SysWOW64\Njfkmphe.exe

Filesize
570KB

MD5
00be3d8b37804acfd194dedcbc5b485f

SHA1
440b0946f34e0e6446eeb73b17b6c9cbc0fb318b

SHA256
39543c3298f761cee25697ac64b742337f43f9233dd22c26793b6c90594c3470

SHA512
03aff71fb16e711302df0166aff1d7fa7024297d1123e4cdc7891953f3da914f3c2226072ac1dd5a68a7b523d0eda3bb0dedc9ce4ab6bbd3c026491b1efa8199

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
570KB

MD5
9758b12aed208de092a7e6f7c517534f

SHA1
70d1f1468b40f9eae165218813ef26c72919e881

SHA256
76fc7b3e9b93bda3e999645dd7aec38fd9b5758b1f9d24a4ab6d863805d9df7b

SHA512
8b6aae6d4cf6acfad8bb64b7ac32e62642b61a15b0b0b8201415ae5dac78b0c998850fd84d3ccd4c79c07d799bdcd19bcc73216c6698a996c412a6f766b174a3

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
570KB

MD5
fb3b6a3ebbfc9dd6dcce16bee81f703f

SHA1
1345193b96560c23e19eaff5e9dcab2d4001eb79

SHA256
805de276ac2935d5c920f24a0b5ede6d767a92a6f173a63bbe66bc86ce1e252f

SHA512
7cb91df6ce55a50510f915843c672ba5681d4b7138b212cee67a1565226bc786304e742ce054dc636c1ec02174b0403dc673073305cd5ca1a365caa236b64f9f

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
570KB

MD5
6296fef67d2bdd1ddae1bb0f5d5456f1

SHA1
391331756e73defb848bce04deb0ad9542bab61c

SHA256
7d560584d583512e09efddb8e2ac371a1e1aa533c362ada9a2d8906dd81823b9

SHA512
32a299f58b55f136334d9fd165c55fae8396b73b8231235ff8f418d1bae5a675ecc21f99280d2d5a59648c14fc09f6722196403704b460437f2c6d526b4a4a40

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
570KB

MD5
69f1cdd284d40ddb36a738bf9ba9bcd0

SHA1
0d0cb52fd80e041a0f9925624c5f91927d9009b0

SHA256
bba0e36b10f9586525e3d90b471e2ad453e56300b11cefa6398007fd16841c7e

SHA512
44b377e6ba75a0e0d6ca7459e0365a3aa2be64b45f6fa7919598e0b3c51a50a4d9269721ed21babf7e12a60c0018f885a870822e2c8b47e746f8f3f76c4b346f

Download Submit
C:\Windows\SysWOW64\Nnojho32.exe

Filesize
570KB

MD5
3d5482300b580319d22281071d5be764

SHA1
d4e71eda388be9d46d550fe625399b632c83ad44

SHA256
f5d1cbd27a3749874299e8333713e6d1c66d2f1aaf24b277586370fb54ad611a

SHA512
7419c1af29c154a539880ce454c1d71310b98ecf719f8095a81bceadd913a3e52a4eafe26569a32305f6996bd7f4ea83a75be7a6a6e8681516873df01e109a54

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
570KB

MD5
3448ef04681dc60c8e8f06797da01621

SHA1
d5ab3eb4e27c4336d925cdda0c819c7a2b18cea2

SHA256
fc97aac956bed1956c00c7c9415095e5698b0eb7ddf5162eb2fc18ee34e799b2

SHA512
944a9c52700f969ad8e94664aeb33d282735066f68fa3e0ca9313d6f282b97240a5103af87e74a650bad00f841c3eed7d3daa8c5ab1ad8f195f88f8718254515

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
570KB

MD5
fe09f2cc9913562e58996635896fbee2

SHA1
99e46fc89374f59ca2dbca354f2e99d3445925ab

SHA256
4fea02e3e43c9eda3d64f2a54166c0617c16a3581b5869f80e25661755106a07

SHA512
e1235e757dd715eadb7cac739b6e659354436ba2d32aeed61f0b1aaceb51c385fd259acbf668437ecfd335a8599d831aabb038e851ac85179fb587447521c19e

Download Submit
C:\Windows\SysWOW64\Npepkf32.exe

Filesize
570KB

MD5
e7ae8fbe2dd7e94870d0b8fe0c44c440

SHA1
a679286d12e490bfc7ed2fc2b432425871fded35

SHA256
52cd9567bd6ca75f0890dca0d76f115dfe3b676a95d23f9ad0ca6e1d6ed461fb

SHA512
c8374d0bfb928fc9f5bdd7db96ba934b8199aee7434a17bf5f24192d41210704af4cebdeac845e7fde24b8edbdcf0007f1f39c7d4381508d4d4f0e07935b03f3

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
570KB

MD5
bf8d86ea0fbe2f658c982c28d48239f9

SHA1
804437379e400b3b521920cf02a008169ba79476

SHA256
98f2def29d70aa9832b7b3e115e3a68405ac021f51b5b8313a693b652db1f93b

SHA512
65dcc2edfb13923a31ce8bc143c6fc6095ca6c7eca44d887e0e7875743b9b4d225f2fe6e21f8922ca8afb8592cf11141e599b03e9eebe9f52284f2adec3011c8

Download Submit
C:\Windows\SysWOW64\Nqmfdj32.exe

Filesize
570KB

MD5
f709e7c710ca84daafce7825cbee8ce7

SHA1
6ed6fb55474e6a32c9c4d652a02f68c4cae2a3ff

SHA256
734e94ca4d435dc9638a64a159b21967a1b1f77062a83929138d4c08cebead9b

SHA512
09fb88602dd34898dd8369f20a338277e6cc104c317f8cae576ef5165abb62ae6625d5f2f36c326ab21427ab2cb3e5a6ec4b9dad084b6bda67057c3df8ec3bf3

Download Submit
C:\Windows\SysWOW64\Nqpcjj32.exe

Filesize
570KB

MD5
9213259c0e5c316fc48697ba5992a652

SHA1
0596845c4c4418440022790cdfd3680a6379a898

SHA256
8217d1e24d0bbb8c7a8c95e3f122fe4555c41158f4178d8d60301ce524c2ffae

SHA512
0d348ba51d440ce4ce4f15f06b81d13507ddc30441e177e3ebb8da6dbbde700916745bbeea862dad3b27bb26440bdaae922ae20dd94e8283469b0d300712da0b

Download Submit
memory/64-338-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/228-575-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/444-587-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-212-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/700-525-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/748-350-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1208-344-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1224-124-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1284-380-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-605-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1384-272-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-612-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1584-489-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1652-228-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1684-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1888-60-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1980-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1988-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2072-386-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2232-398-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2356-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2420-543-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2420-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2432-453-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2504-570-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2668-132-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-581-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2968-220-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2972-290-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2980-172-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3112-600-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3124-477-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3180-495-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3256-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3348-314-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3592-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-557-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3724-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3876-513-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3960-204-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4204-156-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4212-374-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4240-392-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4252-148-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4260-332-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4264-84-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4276-36-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4312-368-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4320-447-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4344-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4352-593-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4380-76-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4404-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4408-501-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4424-435-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4476-483-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-441-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4884-416-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4916-284-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4932-44-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5064-611-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5064-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5176-507-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5240-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5280-459-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5308-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5412-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5424-465-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5432-471-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5444-410-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5472-180-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5500-236-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5516-618-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5600-538-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5608-531-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5636-244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5656-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5704-404-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5752-356-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5784-563-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5788-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5804-302-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5808-164-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5812-320-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5828-68-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5856-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5960-52-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5972-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6008-550-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6008-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6028-519-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6044-428-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6072-422-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/6088-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads