53f3588cc64240784066d4f9a96362a1cf115266c91c093cf8175b7b731f9087

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

311c6ae47fec2807477f28d55bc645f0N.exe
Size

128KB
MD5

311c6ae47fec2807477f28d55bc645f0
SHA1

c7bedc56dfa4e3b046cac4e5549b65af03f4e482
SHA256

53f3588cc64240784066d4f9a96362a1cf115266c91c093cf8175b7b731f9087
SHA512

c94c98310570b7402db4b9d7588923492aa79e590bb0191e32fb9093790476944f4ffdf358e9e16d7d10e07082d298c0ceaed9b47d056f5ad09002fa3878e300
SSDEEP

1536:xe+vNLMRGshOkd9u3Z2vvUFz1u9xSvnfiKPcKakARQDtNRfRa9HprmRfRJCLIXG:xe+1ARGshOkdBvt9xRHeD/5wkpHxG

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qjoankoi.exe

Executes dropped EXE 64 IoCs

pid	Process
1884	Odapnf32.exe
2388	Ofcmfodb.exe
3100	Oqhacgdh.exe
712	Ocgmpccl.exe
2452	Ofeilobp.exe
3764	Pdfjifjo.exe
4196	Pfhfan32.exe
3032	Pmannhhj.exe
1816	Pggbkagp.exe
2676	Pjeoglgc.exe
1744	Pmdkch32.exe
452	Pqpgdfnp.exe
2484	Pncgmkmj.exe
3640	Pcppfaka.exe
5052	Pfolbmje.exe
3844	Pjjhbl32.exe
4840	Pcbmka32.exe
4900	Pjmehkqk.exe
2000	Qdbiedpa.exe
2948	Qgqeappe.exe
4712	Qjoankoi.exe
4804	Qddfkd32.exe
1900	Anmjcieo.exe
2648	Aqkgpedc.exe
368	Afhohlbj.exe
2516	Anogiicl.exe
2796	Aclpap32.exe
2364	Ajfhnjhq.exe
1288	Amddjegd.exe
2496	Aeklkchg.exe
4164	Afmhck32.exe
4616	Ajhddjfn.exe
3672	Acqimo32.exe
2260	Ajkaii32.exe
468	Aminee32.exe
1492	Accfbokl.exe
4456	Bfabnjjp.exe
1912	Bnhjohkb.exe
4004	Bebblb32.exe
3264	Bganhm32.exe
1452	Bnkgeg32.exe
224	Beeoaapl.exe
448	Bffkij32.exe
4816	Bnmcjg32.exe
4548	Bcjlcn32.exe
2356	Bfhhoi32.exe
2980	Bmbplc32.exe
1572	Bclhhnca.exe
1488	Bfkedibe.exe
4812	Bmemac32.exe
5000	Belebq32.exe
1516	Cfmajipb.exe
1064	Cmgjgcgo.exe
1864	Cenahpha.exe
3444	Cfpnph32.exe
3168	Cnffqf32.exe
5036	Ceqnmpfo.exe
1424	Cnicfe32.exe
4504	Cagobalc.exe
4108	Chagok32.exe
2692	Cnkplejl.exe
1148	Ceehho32.exe
3420	Cjbpaf32.exe
1320	Calhnpgn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Pfhfan32.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	311c6ae47fec2807477f28d55bc645f0N.exe
File opened for modification	C:\Windows\SysWOW64\Ofeilobp.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Mmcdaagm.dll	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Qjoankoi.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Oqhacgdh.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Bnmcjg32.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Pggbkagp.exe	Pmannhhj.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qjoankoi.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pncgmkmj.exe
File created	C:\Windows\SysWOW64\Blfiei32.dll	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Odapnf32.exe	311c6ae47fec2807477f28d55bc645f0N.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Pjeoglgc.exe	Pggbkagp.exe
File opened for modification	C:\Windows\SysWOW64\Pmdkch32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Pncgmkmj.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Ocgmpccl.exe	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Qdbiedpa.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Aminee32.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Pncgmkmj.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Bfddbh32.dll	Ajkaii32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Ceqnmpfo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	1312	WerFault.exe	165

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfolbmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdfjifjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anogiicl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311c6ae47fec2807477f28d55bc645f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgldjcmk.dll"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfilim32.dll"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chempj32.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckmllpik.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	311c6ae47fec2807477f28d55bc645f0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1884	1244	311c6ae47fec2807477f28d55bc645f0N.exe	83
PID 1244 wrote to memory of 1884	1244	311c6ae47fec2807477f28d55bc645f0N.exe	83
PID 1244 wrote to memory of 1884	1244	311c6ae47fec2807477f28d55bc645f0N.exe	83
PID 1884 wrote to memory of 2388	1884	Odapnf32.exe	84
PID 1884 wrote to memory of 2388	1884	Odapnf32.exe	84
PID 1884 wrote to memory of 2388	1884	Odapnf32.exe	84
PID 2388 wrote to memory of 3100	2388	Ofcmfodb.exe	85
PID 2388 wrote to memory of 3100	2388	Ofcmfodb.exe	85
PID 2388 wrote to memory of 3100	2388	Ofcmfodb.exe	85
PID 3100 wrote to memory of 712	3100	Oqhacgdh.exe	86
PID 3100 wrote to memory of 712	3100	Oqhacgdh.exe	86
PID 3100 wrote to memory of 712	3100	Oqhacgdh.exe	86
PID 712 wrote to memory of 2452	712	Ocgmpccl.exe	87
PID 712 wrote to memory of 2452	712	Ocgmpccl.exe	87
PID 712 wrote to memory of 2452	712	Ocgmpccl.exe	87
PID 2452 wrote to memory of 3764	2452	Ofeilobp.exe	89
PID 2452 wrote to memory of 3764	2452	Ofeilobp.exe	89
PID 2452 wrote to memory of 3764	2452	Ofeilobp.exe	89
PID 3764 wrote to memory of 4196	3764	Pdfjifjo.exe	90
PID 3764 wrote to memory of 4196	3764	Pdfjifjo.exe	90
PID 3764 wrote to memory of 4196	3764	Pdfjifjo.exe	90
PID 4196 wrote to memory of 3032	4196	Pfhfan32.exe	91
PID 4196 wrote to memory of 3032	4196	Pfhfan32.exe	91
PID 4196 wrote to memory of 3032	4196	Pfhfan32.exe	91
PID 3032 wrote to memory of 1816	3032	Pmannhhj.exe	92
PID 3032 wrote to memory of 1816	3032	Pmannhhj.exe	92
PID 3032 wrote to memory of 1816	3032	Pmannhhj.exe	92
PID 1816 wrote to memory of 2676	1816	Pggbkagp.exe	93
PID 1816 wrote to memory of 2676	1816	Pggbkagp.exe	93
PID 1816 wrote to memory of 2676	1816	Pggbkagp.exe	93
PID 2676 wrote to memory of 1744	2676	Pjeoglgc.exe	94
PID 2676 wrote to memory of 1744	2676	Pjeoglgc.exe	94
PID 2676 wrote to memory of 1744	2676	Pjeoglgc.exe	94
PID 1744 wrote to memory of 452	1744	Pmdkch32.exe	95
PID 1744 wrote to memory of 452	1744	Pmdkch32.exe	95
PID 1744 wrote to memory of 452	1744	Pmdkch32.exe	95
PID 452 wrote to memory of 2484	452	Pqpgdfnp.exe	97
PID 452 wrote to memory of 2484	452	Pqpgdfnp.exe	97
PID 452 wrote to memory of 2484	452	Pqpgdfnp.exe	97
PID 2484 wrote to memory of 3640	2484	Pncgmkmj.exe	98
PID 2484 wrote to memory of 3640	2484	Pncgmkmj.exe	98
PID 2484 wrote to memory of 3640	2484	Pncgmkmj.exe	98
PID 3640 wrote to memory of 5052	3640	Pcppfaka.exe	99
PID 3640 wrote to memory of 5052	3640	Pcppfaka.exe	99
PID 3640 wrote to memory of 5052	3640	Pcppfaka.exe	99
PID 5052 wrote to memory of 3844	5052	Pfolbmje.exe	100
PID 5052 wrote to memory of 3844	5052	Pfolbmje.exe	100
PID 5052 wrote to memory of 3844	5052	Pfolbmje.exe	100
PID 3844 wrote to memory of 4840	3844	Pjjhbl32.exe	101
PID 3844 wrote to memory of 4840	3844	Pjjhbl32.exe	101
PID 3844 wrote to memory of 4840	3844	Pjjhbl32.exe	101
PID 4840 wrote to memory of 4900	4840	Pcbmka32.exe	102
PID 4840 wrote to memory of 4900	4840	Pcbmka32.exe	102
PID 4840 wrote to memory of 4900	4840	Pcbmka32.exe	102
PID 4900 wrote to memory of 2000	4900	Pjmehkqk.exe	103
PID 4900 wrote to memory of 2000	4900	Pjmehkqk.exe	103
PID 4900 wrote to memory of 2000	4900	Pjmehkqk.exe	103
PID 2000 wrote to memory of 2948	2000	Qdbiedpa.exe	104
PID 2000 wrote to memory of 2948	2000	Qdbiedpa.exe	104
PID 2000 wrote to memory of 2948	2000	Qdbiedpa.exe	104
PID 2948 wrote to memory of 4712	2948	Qgqeappe.exe	105
PID 2948 wrote to memory of 4712	2948	Qgqeappe.exe	105
PID 2948 wrote to memory of 4712	2948	Qgqeappe.exe	105
PID 4712 wrote to memory of 4804	4712	Qjoankoi.exe	106

C:\Users\Admin\AppData\Local\Temp\311c6ae47fec2807477f28d55bc645f0N.exe
"C:\Users\Admin\AppData\Local\Temp\311c6ae47fec2807477f28d55bc645f0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\Odapnf32.exe
  C:\Windows\system32\Odapnf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\Ofcmfodb.exe
    C:\Windows\system32\Ofcmfodb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\Oqhacgdh.exe
      C:\Windows\system32\Oqhacgdh.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4804
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1900
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:368
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2496
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2260
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:468
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4456
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4548
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1064
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1148
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3420
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3392
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4444
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 216
        80⤵
        Program crash
        
        PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1312 -ip 1312
1⤵
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aclpap32.exe

Filesize
128KB

MD5
6ce2257d705f9757ed08fab92e1d70b3

SHA1
88e552907c766c77958b38b9af1d27dfe02890d2

SHA256
2ad8f9352bccf557ca5aca449e973bc87c94436542fa7881cba8790f8b42b754

SHA512
6550429fd647b5c6275ce483a7f9fe4f6729ecc69f5d2f1b57277a2acf3f83b30fc0dbce59cb1f91e848983ca1c393b580b2a275a155e5dc37b88f4e43cf1735

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
128KB

MD5
96580f67e0669731fbc371ae1734cbd2

SHA1
c24bcf89a429104ff0dcff59c4eba69abb592bcd

SHA256
aa53afe9ba61a7202af062ea58200a4a0ac5a10198ef50674d857c5a3f6b6e1e

SHA512
7b43e031299ab8baae98bfa6dcc0b0830ba9b5eea4e8be2b39e9e3f8b1a2df385c3a60cce1e2379afcbefd4be6ff6e4f9569897245320790b3a491e9b562de97

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
128KB

MD5
d871ecdd6b22628553ae3df16626c274

SHA1
25e4a0619f0bf1229cc9b3cca41495abdb912906

SHA256
1b8eb45ece39026ee269955641a67779f32123759c6e7f6722e8c16c14f6bb2a

SHA512
c40ee59aaf33d5e1af14700a84efb6a277c9d9b8ab9a60f7252990af62b7aca253a4d383d965ab8528c7f9fed200eec4c4c184efe0629203f068e35256989468

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
128KB

MD5
8566575624307f882f8bd2203272fa58

SHA1
1b5e0b96fefdbac313721b0fbe8edb69a34318ee

SHA256
4b4916d4a605de5bfb09255b9a7dacec60671bbf5137bedfbd2b1fcf0ff49d54

SHA512
d249c0ab0fb010c98aebe95af7fe3147e6997c1026da0e8385529d4399309c63da00304eb767344abfcdd093c17577c958ea0d232ef382fd576bd72d05416147

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
128KB

MD5
c9f918f191ce484845418ead88b75b45

SHA1
a9a18c1a8897c563db9c74e4c7f08ca501145883

SHA256
ed1ec4e3144efb696bcd5bb510762871cf7a5419bd8fa3553af7050aec7f1cf2

SHA512
e0a497478e2bb32f94bfeca7f58a94b095a6fa9fb2628bc62ef4e0205055190a9992e9ed2e2c61793aae6873f2ce8434808dfcdb10ce9bdba4dfbd7cb70561e0

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
128KB

MD5
2e3395f7f87b861bccefac7adedec05d

SHA1
5ae3421936298210326cf75ee81f60fcc4069371

SHA256
c94c7b8df93c95f26cbe7a239e76c4cd652839877cf9df7a3e02ded1e76b719c

SHA512
e0f81da4bdcf3ea0f5eca97d8f64bee2f0bde19d153e9ebf68f3159cb2c358df5546c74f28b762de1fea2fd9b4aa08c04d3391ff4b9d75e89060747fa2ad6fe7

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
128KB

MD5
a18437859d30c8f6c665db98c57d0297

SHA1
99af6c330a0c54a78d71c7e476b1048b9b28d993

SHA256
9ce5f38435eceb49c5193838c7eb61f4c2b47e5d63303bc13123f798e6e61a12

SHA512
e1dd5a53200654f44f14da4369c9b4297da1cedc89acd1e5c590f241ff8eed85429307420bb98186ad5ef6c1c4edc6f9c075e63703ed17e0b785b8d6bc31563b

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
128KB

MD5
9bb2a702f20fb663d84e2792e15bdc58

SHA1
6b0e0253884820a2b7af3b21ec3851ebe863ad1b

SHA256
5b1d83f7d8282470990160aadf014d295902cf2b0452d1baad684805c374eeb9

SHA512
0b2f0c820e3fd8ce9dff4940abad2c3ee2579c5ce6f90cf1e7a5cac36fa7e10c13929799f7c703e8610c8975dcfed2acd4a9c33d452318beaf3609278b361954

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
128KB

MD5
1ede164f1b52a11564b9aba09bb5c652

SHA1
930a8ab598dac3bb6f1b3707a8ba221d84f91c05

SHA256
0ead8643b88b88bc9f3147937b21497bb57f2e0137ef4f6844892130fc8c6f96

SHA512
cf2c0dbd6933fd698d21635310e3799fc886c512b94bade14d3d879627950091e1291fed1d80229564d0bf84f2787455dd6d62e2c532f78b67a032aaa0f7beb5

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
128KB

MD5
992e5c5241a5331fd4cd1a83b0a52f28

SHA1
4f12cac67b490cabb9a05dcb4f8d9fc000fcc69d

SHA256
a81b8ed7780db4a95ccdd1de10b73eb79cf8293a2ee4198799cbbf133ecf3259

SHA512
eba4f2168ee55550c7f16d2b332f2e76751deda1aab3ad08f544b5e7d3a70fab82583f29466d6f180f64d57a8a6c43537648972eff21d60af1370365478e1079

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
128KB

MD5
588bbe83b5430252f8cc6e656a3936a2

SHA1
ff7b501ae56829c6ec656a0488e0c4f3d577f869

SHA256
cf50d94a6e7f80bf5ccaaf8807b4354beef106424ce47cb97dfab50af7badfb1

SHA512
5b9180816482fc6e21d5dc7e1b65e64e0d0a0760d23d919c11c98515c1127124023e2a7e62f63a80df8305370ccf515e158742b5ec6417336356c5d1bcb9da92

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
64KB

MD5
5b71b44b0c5eaa0089cd51e91a06d083

SHA1
816dadbb1acea7de44961ebb38fc16db22b10283

SHA256
6795899e9f8c8d603fe6cf238fa96654b043ea7aa8ad86d5a3181ecc75ded868

SHA512
40da9578816dfebf425db579b3377da92c3380b109b2c69675ad65cdc170aebea3110ee42ca3e569362ec3d202cbaf310dd4e60a00b5140c3103927dbd0dc0a3

Download Submit
C:\Windows\SysWOW64\Mmcdaagm.dll

Filesize
7KB

MD5
06950ab517499732be93c6a5f3b14027

SHA1
5f6c975f797d886594fc6b34d33e5dc75dce4239

SHA256
e41e8cb47a45fba600055408e9961862611cbb92a97002fee66e7ee906cd6a6f

SHA512
e73da133b7d8a154819651ed36e687fd7d85ad9821b140b35259ea18ebcabd6282c3d6c8fa167f5bfc4278d22f1a70682e7971a7c835c56c56f427364f2a0f5e

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
128KB

MD5
18ef47a22639c9d6f4f6e464f8e59c54

SHA1
88a5e30696c7d44c87285b3a5b6b80eb2c344bf5

SHA256
3aeafbe347a0050c55d325176ca4da1cc8c75539c6b4f6e08b0bdf5742bc89c3

SHA512
7973bc7e0d73b596020ed3842466096b4a4a5cb43f02c50ff54453ced583070912b3a1d5fc7b26c1f6df29cd5b8e9ceaeefc8c289d9b958585e5daed4890950e

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
128KB

MD5
e0bafa7048555bcc9abd48f8782e7d8c

SHA1
4b1c44b7e3ecbc6b34bb98e0486b2ee46c1f6c63

SHA256
5fcd08b213105022f6c6d98425ae95ce07c48e1517a6b925cd466d5680fe6282

SHA512
cf3dfdd24789f9ed800a12ebd37c86eba677cad0960e68e4c736366cd8bd7cae5184828d56b32ce7ab521de2c772124bd2f405e1defc9e9304cf1d7528d80dbe

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
128KB

MD5
5fd3abaa46e0f81df2e64b7db6cb6a29

SHA1
aeb866d9cd96b212eeff0b54d3ce965e9d2fbed9

SHA256
92e390ac5dccb18e6bb8d925c8e17ceca73c91fc357f19efd6e05d697d0d81b9

SHA512
ee2ccb5135023aa7cccd9ce1ed45c44297ae8eec015df22272e0f239aef063fa5124817d7925d24b2bd31d0b13b08845833cd35d18b3dac01f9fc0983e32d38c

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
128KB

MD5
80ce2598543b85874101e6bcd7df7136

SHA1
150d2ba38e12a10fa9ac1df1a3549d9208d94340

SHA256
a566368aed01dfd2ba4205f537c79edc3457028ea2d998883fd5d1df8c3935d0

SHA512
b8eea8830e51079897261e67fc9d168c1a858e99fb21913517dd1f168e05259cce25ba4a4d4cc2998e7c93b8c23b5f292c627fccb5f947445a2f6450d5136741

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
128KB

MD5
705d101918df24a60ebb9df50821b5bc

SHA1
8f1ed159cc6367919e54d3e005ba2669b4a92b85

SHA256
d2a1b4bf769a02369d7d35a7bd298f7c8b8a38e2c512230b69ac790a7e012535

SHA512
372bdaaffd81c0ae585fc2229fd034617ccc0153ff32cb201b3800f8d368488e01420c9510966804a483086927fc932491375a56285c45a8219f6b31e04aa9c0

Download Submit
C:\Windows\SysWOW64\Pcbmka32.exe

Filesize
128KB

MD5
c309882efbc325f5459fc2ead0ea50f7

SHA1
d58b3b9159012d5b7cd1db587e1dbf5a65ef4e5f

SHA256
459771cdcee3944a7be43e935999a37452a5acfcd6b2fa13cb774831c554f37c

SHA512
8eafc694b606a722d5826c03dd5048628adf7143d71a9f6b80d2a21ae788c3fb305ee52cffcd977d90c62c1f053e791304433b4e7ecac2f814b6683f5bac3777

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
128KB

MD5
7d203dcb5b3cffa4c58724f79b8e3ea8

SHA1
10829165cf4086dedafd752bc75506c679a442c6

SHA256
94da0c25b883f8c69dfdaaa3037a76b4069a9157e9b6bed51bd500816aa7083f

SHA512
bbabe0bc8c939ef8986c3ea5c110bf836d3a1e91b289839e0add3e2154ce3626663cc42552d2e3b8eb84f408009f7a0d6d2ef26f21f1341914fc37a04e784322

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
128KB

MD5
342917758f3d5dd47669490c8f7e2fc1

SHA1
4be55675cd993867815707b2f445450065a96ad6

SHA256
44c517b55804f542563c8dfbe979071e1c7dba1e84b9c2a759924cc5be818e8c

SHA512
835436776cc7da8771fd6490cdaab9e680f61bb2117f458c3d76cd8d8fd571c97b9ae4a0cd27f30faec2bd5ba2b3441aedebb55bfffc1b4447bfc45d73a73dd7

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
128KB

MD5
c04e6363012dade1f7b53054e4a8a22b

SHA1
f814b7272a1c6166550e56e96ca6418effec90bf

SHA256
81b51c3a589c4bd5b7670dcd0eb7f6bd58df6546b6c9e752d8195de8b28d4aaf

SHA512
0d4fa87e8d3a37fa07f0813164fdb05788c3490283f5c3b7f82cc410cc7fa995a5637fa386302d3fe5bd72f9918f558628dba38fc63e75c9f22ecc1847dfedba

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
128KB

MD5
5ab411118f365ac704b993958e420a3f

SHA1
949d60ba41ac35267fb9267bac45badb3d82d6a8

SHA256
6bfd4ed735a4899d3d9468b96e83574c24dbf0fe814eb14364e44d4ea15c5d8c

SHA512
3c11a900c23253860efc39dbe29b6a83e610f8bcc42734c652e695a40845cbc33ddb5b691916d354da017680b2b6accff186c4d6e41094079ab075398bd44b43

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
128KB

MD5
8f0324ed7426a0f9a819c1721c53c887

SHA1
682a4860227409f85efeb40aff42f1436649651a

SHA256
d9ceed413726153c40d7114be46cac1b75b97c04d05a7506027a4ac09849c44a

SHA512
07525714aaa7edebc8387f86b06df7b4dd9c2e60601aad401b5c69e00053a272540aa783d7b4accd113ae15ca6f497c031bf11056828cfbc254c48bdccf105a2

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
128KB

MD5
c84d9240f60b925f28543150999df3c5

SHA1
64665f651d40f49b6ec1622350ca8efd4f5115c3

SHA256
262c308aa66dec30fb4bcea89ebe07cb1916dad04c6a62a51545231d1e23d890

SHA512
5ca11f9a9cc1f17829ca8d1e98e28504c7512e9d598e38e4981402f1506e92cdc96ad60b8fb5b4a2bf4c3a65258f579294a1c4d096bb9067ef0ed47ec139e074

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
128KB

MD5
cb03c8fa1b9a5b56cfa7035ead53bd46

SHA1
e5495b604578d6bb6e26ecf87d7d403d10d60650

SHA256
10b1cf03f91d3e18f50348766ec2e5b365256ad2249c3838dec112d39b709c1f

SHA512
c37979c206239d38174a079681d4987ae6bd7aa7c517074082619f5728252a79659a9d69bcb86bfd2d4f1f00a7e879f31eea41662a81ee1ebdd5a629ece07c91

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
128KB

MD5
fa08c4c84533f3b2a5cdf4f85f5a1a19

SHA1
49d19fb2d4f4df0740b99ff30ca8901d14719042

SHA256
03deb551b71b9572fc7ef97f7def71cb869cd791acdc202c66c7002111134419

SHA512
d081e87ba66c5ca095a4e10510f3f8f0774fe3e3740ba3890c1e3583c6cedd5c9209e606eb5adae18804d2c25952688aafd12350715ddce5c1985331fd2899d0

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
128KB

MD5
08deee876c6bea3d6292e7e3ba3850b5

SHA1
73513af2b816ceafc79419b2b9abd368e35c78e4

SHA256
284e28de20da553677b8477ea379ad5f4ae797cd2bff1ab1375efd7b3dc0d280

SHA512
6a8851549c23d7dc2852955c13f8986f5e7a294831061344c550bf4a02eb21245994d8d624dbc91c31ba0feee5f50af8e7c16beb1a30cb2ee0d8ef6d265041e7

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
128KB

MD5
9ca6c31917403bb30a420b253116425c

SHA1
9bbcfc969667c7af9e2a6f03dba3436cee76e877

SHA256
47bc02299696aba80adb938dd24c6120bd72a5c17db95ab4b986eae330e7c979

SHA512
9becb9338e66af76541b5365846288c03038d35ad7863e2490a63f22a204f636ba86390f1561c148d13b311842df1ca27857a22352c8a9664bf59db19f685d63

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
128KB

MD5
8461f53f27ac408790c1b80fb059e902

SHA1
bd9632526f49ec702259dd6fa28948a2d6f8a71c

SHA256
25ca600b5e8e931d3b495c175bf31bf74ef4353034ddaab7b21647b64449fca9

SHA512
506f35a8734c40b51ffc7a8e7802b8f778d99629acc16abd2b4090457c54ad77be1ae4cbf395c2b4ee62eee7bbd8fc460e7c81dac4d09d14f5a5049f71cea29e

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
128KB

MD5
32fa16ac06e585c46aa145267cc53123

SHA1
6f7a056eb9ec61b81de98d84de1f3a5a6276a283

SHA256
1a4deb41b3267d54bce560b6e59592d6da6495f367fda902fb29f1cfdf0698e5

SHA512
20252027b94fbdbf5b8fcdf15ae17fbf4aa4eebc481bc721f1aa6c8608f27f4485c1b28915cf0d9b58f11750739ad4b18c837eb8c3f076ef37abab918b36ca48

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
128KB

MD5
e5c595509c2ab3acf0508361b4d6be66

SHA1
c5c9d937934ea1caed562582f141c49b33bd6a00

SHA256
246cf40846de6b0a38b3fc514e1781918d981a5dde7bd1494b3ed4e65431b5cb

SHA512
8d154a3eca7db2af1c9effd17020f0d32dfec0c0c25023f156bb17b2f6ec055fe820ca9d5dbda3f8761e75a313dea291537c73a31d38237c467482b4013900c7

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
128KB

MD5
abbc5c1e17be6d3e78f328ca45584c44

SHA1
bba74f351bdbd6fc682f887a934e950e2666974f

SHA256
d9758dbf9cd3c403e20eac6371697cd398c48028ba7efbfbc71718461e4fddf6

SHA512
09520e60945404c38e014b7308092158c709e5d54be39d391cdd38d4cf8a17eb1a97b3a564366f91d6a1724e7c861f1c210cf17b8423146451aea907067ab418

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
128KB

MD5
881477ae3138c6a178642e53aacf5a36

SHA1
83863ab540a3aebe2b59b13c96404b989ad4e472

SHA256
50e5a0e077a3c6a538782a2afe94e1bd69ab882174ebc8bf348a7a4f73c41665

SHA512
0ab5680410e1b41d919f87d301eea266e912a419fa9dc4d97f5ebe30cd63dcb06e9a2e80bf270effcd1784c1d8e074c097fd118abec9edd3bfd49c5544ff6f98

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
128KB

MD5
da0568da70124a0a43c58d630f52c98e

SHA1
3411c76de6b7a9a59190cf14032790549d53f2b5

SHA256
c138ad05b22e16f2ce34ec8407cbcd732f0af9dd6499d8394cda8bbf08b63d0a

SHA512
fdd3f677a979d7d55dc44fc2685f2c01b288b648b0fea3b97b5b5e9bc341be8d872526ab82b5285a08addb582d14cc6f802158a57a00f6092f98fe0156ad9830

Download Submit
memory/224-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/368-204-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/448-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/452-95-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/468-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/712-31-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1064-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1148-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1148-548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1244-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1288-237-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1312-533-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1312-532-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-546-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1320-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1424-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1452-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1488-358-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1492-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1516-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1572-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1744-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-76-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1864-393-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1884-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1900-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1912-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2000-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2204-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2204-545-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2356-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2364-223-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2368-526-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2368-534-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2388-15-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2452-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2484-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2496-239-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2516-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2524-538-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2524-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-191-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-84-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2692-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2692-549-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2724-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2724-543-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2796-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2820-539-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2820-502-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2912-541-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2912-484-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2948-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2980-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3032-63-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3264-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3392-542-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3392-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3420-547-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3420-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3444-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3640-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-262-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3764-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3844-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4004-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4108-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4112-535-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4112-520-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4164-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4196-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4368-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4400-537-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4400-508-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-490-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4444-540-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4456-288-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4460-514-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4460-536-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4548-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4616-255-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4712-173-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4804-175-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4812-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4816-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4840-136-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4900-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5000-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5036-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5052-120-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads