b43bd85751b8e8eed6569ac7ef2c0ebf511fcf0332847d5941c6f0721b0b5cbd

Analysis

max time kernel
103s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f29f14654da75587bdcf036e93328120N.exe
Size

250KB
MD5

f29f14654da75587bdcf036e93328120
SHA1

b464b4262d5857ae4568c01a19ef7bbbdc46df30
SHA256

b43bd85751b8e8eed6569ac7ef2c0ebf511fcf0332847d5941c6f0721b0b5cbd
SHA512

dc1bddc6960752d1caa03611c9bd6d533adcad6ceb39b780d3aa9b106a472a5ba5c755c1b69ce2e874aa3c80fc0e819eb3658c554697fc26fa97a023999f463d
SSDEEP

6144:EFuhEb4+OvCvfmZ7KRRRGBCvfmZ7KFpNlJTBCvfmZ7d:Edb4q

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfifmnij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmmjgejj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlpoqpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iehfdi32.exe

Executes dropped EXE 64 IoCs

pid	Process
4820	Gdjjckag.exe
4924	Hmabdibj.exe
4632	Hfifmnij.exe
2988	Hihbijhn.exe
1152	Hobkfd32.exe
2760	Hflcbngh.exe
4732	Hkikkeeo.exe
968	Hcpclbfa.exe
4228	Himldi32.exe
4540	Hkkhqd32.exe
3004	Hfqlnm32.exe
3724	Hioiji32.exe
4892	Hcdmga32.exe
1760	Iiaephpc.exe
1848	Icgjmapi.exe
2400	Iehfdi32.exe
404	Ikbnacmd.exe
4112	Ifgbnlmj.exe
2924	Imakkfdg.exe
4884	Ibnccmbo.exe
1364	Ilghlc32.exe
2032	Ieolehop.exe
4944	Ilidbbgl.exe
3816	Icplcpgo.exe
3476	Jeaikh32.exe
4064	Jcbihpel.exe
4176	Jioaqfcc.exe
3760	Jcefno32.exe
4332	Jfcbjk32.exe
4644	Jmmjgejj.exe
4964	Jcgbco32.exe
1200	Jbjcolha.exe
2248	Jehokgge.exe
3092	Jmpgldhg.exe
3324	Jcioiood.exe
3000	Jfhlejnh.exe
3392	Jifhaenk.exe
3332	Jcllonma.exe
4428	Kfjhkjle.exe
1456	Klgqcqkl.exe
2068	Kepelfam.exe
1056	Kebbafoj.exe
1988	Klljnp32.exe
2120	Kdcbom32.exe
1592	Kedoge32.exe
4968	Klngdpdd.exe
4536	Kpjcdn32.exe
512	Kefkme32.exe
2360	Klqcioba.exe
1940	Lffhfh32.exe
3140	Liddbc32.exe
1832	Llcpoo32.exe
1256	Ldjhpl32.exe
3628	Lekehdgp.exe
1168	Llemdo32.exe
2820	Ldleel32.exe
2244	Lfkaag32.exe
4520	Lmdina32.exe
2012	Lgmngglp.exe
1852	Lepncd32.exe
1804	Lmgfda32.exe
4532	Lingibiq.exe
3160	Lmiciaaj.exe
3484	Lphoelqn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Njciko32.exe	Npjebj32.exe
File opened for modification	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Gpaekf32.dll	Onhhamgg.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Icgjmapi.exe	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Himldi32.exe	Hcpclbfa.exe
File opened for modification	C:\Windows\SysWOW64\Npmagine.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Odmgcgbi.exe	Opakbi32.exe
File opened for modification	C:\Windows\SysWOW64\Qmkadgpo.exe	Pjmehkqk.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Hkkhqd32.exe	Himldi32.exe
File opened for modification	C:\Windows\SysWOW64\Jcefno32.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Ndokbi32.exe	Mnebeogl.exe
File opened for modification	C:\Windows\SysWOW64\Ndcdmikd.exe	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Opakbi32.exe
File created	C:\Windows\SysWOW64\Ambgef32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Ifgbnlmj.exe	Ikbnacmd.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Kepelfam.exe	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Gbdhjm32.dll	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Kefkme32.exe	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Eiecmmbf.dll	Ldjhpl32.exe
File opened for modification	C:\Windows\SysWOW64\Mmlpoqpg.exe	Mipcob32.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Ibnccmbo.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Onjegled.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Hgaoidec.dll	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Gdjjckag.exe	f29f14654da75587bdcf036e93328120N.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hmabdibj.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Imakkfdg.exe	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Opdghh32.exe
File opened for modification	C:\Windows\SysWOW64\Pjeoglgc.exe	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Hihbijhn.exe	Hfifmnij.exe
File created	C:\Windows\SysWOW64\Jjhijoaa.dll	Lepncd32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Ibnccmbo.exe
File created	C:\Windows\SysWOW64\Lffhfh32.exe	Klqcioba.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Qegnoi32.dll	Hcdmga32.exe
File opened for modification	C:\Windows\SysWOW64\Klljnp32.exe	Kebbafoj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	6800	WerFault.exe	288

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hflcbngh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeaikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehokgge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mipcob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfifmnij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcgbco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldjhpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icgjmapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibnccmbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedoge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcefno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfkaag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfhlejnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjcdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgmpccl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfcbjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcmabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmlpoqpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kebbafoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiaephpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqcqkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcbom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpclbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hioiji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lphoelqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jioaqfcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndokbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djoeni32.dll"	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohmoom32.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcgbco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfhkicbi.dll"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqbodd32.dll"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljodkeij.dll"	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okokppbk.dll"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldleel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingapb32.dll"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkfpo32.dll"	Klqcioba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdeld32.dll"	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkkfn32.dll"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naoncahj.dll"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfhlejnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lingibiq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcllonma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjpmk32.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4820	2920	f29f14654da75587bdcf036e93328120N.exe	84
PID 2920 wrote to memory of 4820	2920	f29f14654da75587bdcf036e93328120N.exe	84
PID 2920 wrote to memory of 4820	2920	f29f14654da75587bdcf036e93328120N.exe	84
PID 4820 wrote to memory of 4924	4820	Gdjjckag.exe	85
PID 4820 wrote to memory of 4924	4820	Gdjjckag.exe	85
PID 4820 wrote to memory of 4924	4820	Gdjjckag.exe	85
PID 4924 wrote to memory of 4632	4924	Hmabdibj.exe	86
PID 4924 wrote to memory of 4632	4924	Hmabdibj.exe	86
PID 4924 wrote to memory of 4632	4924	Hmabdibj.exe	86
PID 4632 wrote to memory of 2988	4632	Hfifmnij.exe	87
PID 4632 wrote to memory of 2988	4632	Hfifmnij.exe	87
PID 4632 wrote to memory of 2988	4632	Hfifmnij.exe	87
PID 2988 wrote to memory of 1152	2988	Hihbijhn.exe	88
PID 2988 wrote to memory of 1152	2988	Hihbijhn.exe	88
PID 2988 wrote to memory of 1152	2988	Hihbijhn.exe	88
PID 1152 wrote to memory of 2760	1152	Hobkfd32.exe	89
PID 1152 wrote to memory of 2760	1152	Hobkfd32.exe	89
PID 1152 wrote to memory of 2760	1152	Hobkfd32.exe	89
PID 2760 wrote to memory of 4732	2760	Hflcbngh.exe	90
PID 2760 wrote to memory of 4732	2760	Hflcbngh.exe	90
PID 2760 wrote to memory of 4732	2760	Hflcbngh.exe	90
PID 4732 wrote to memory of 968	4732	Hkikkeeo.exe	91
PID 4732 wrote to memory of 968	4732	Hkikkeeo.exe	91
PID 4732 wrote to memory of 968	4732	Hkikkeeo.exe	91
PID 968 wrote to memory of 4228	968	Hcpclbfa.exe	93
PID 968 wrote to memory of 4228	968	Hcpclbfa.exe	93
PID 968 wrote to memory of 4228	968	Hcpclbfa.exe	93
PID 4228 wrote to memory of 4540	4228	Himldi32.exe	94
PID 4228 wrote to memory of 4540	4228	Himldi32.exe	94
PID 4228 wrote to memory of 4540	4228	Himldi32.exe	94
PID 4540 wrote to memory of 3004	4540	Hkkhqd32.exe	95
PID 4540 wrote to memory of 3004	4540	Hkkhqd32.exe	95
PID 4540 wrote to memory of 3004	4540	Hkkhqd32.exe	95
PID 3004 wrote to memory of 3724	3004	Hfqlnm32.exe	96
PID 3004 wrote to memory of 3724	3004	Hfqlnm32.exe	96
PID 3004 wrote to memory of 3724	3004	Hfqlnm32.exe	96
PID 3724 wrote to memory of 4892	3724	Hioiji32.exe	97
PID 3724 wrote to memory of 4892	3724	Hioiji32.exe	97
PID 3724 wrote to memory of 4892	3724	Hioiji32.exe	97
PID 4892 wrote to memory of 1760	4892	Hcdmga32.exe	99
PID 4892 wrote to memory of 1760	4892	Hcdmga32.exe	99
PID 4892 wrote to memory of 1760	4892	Hcdmga32.exe	99
PID 1760 wrote to memory of 1848	1760	Iiaephpc.exe	101
PID 1760 wrote to memory of 1848	1760	Iiaephpc.exe	101
PID 1760 wrote to memory of 1848	1760	Iiaephpc.exe	101
PID 1848 wrote to memory of 2400	1848	Icgjmapi.exe	102
PID 1848 wrote to memory of 2400	1848	Icgjmapi.exe	102
PID 1848 wrote to memory of 2400	1848	Icgjmapi.exe	102
PID 2400 wrote to memory of 404	2400	Iehfdi32.exe	103
PID 2400 wrote to memory of 404	2400	Iehfdi32.exe	103
PID 2400 wrote to memory of 404	2400	Iehfdi32.exe	103
PID 404 wrote to memory of 4112	404	Ikbnacmd.exe	104
PID 404 wrote to memory of 4112	404	Ikbnacmd.exe	104
PID 404 wrote to memory of 4112	404	Ikbnacmd.exe	104
PID 4112 wrote to memory of 2924	4112	Ifgbnlmj.exe	105
PID 4112 wrote to memory of 2924	4112	Ifgbnlmj.exe	105
PID 4112 wrote to memory of 2924	4112	Ifgbnlmj.exe	105
PID 2924 wrote to memory of 4884	2924	Imakkfdg.exe	106
PID 2924 wrote to memory of 4884	2924	Imakkfdg.exe	106
PID 2924 wrote to memory of 4884	2924	Imakkfdg.exe	106
PID 4884 wrote to memory of 1364	4884	Ibnccmbo.exe	107
PID 4884 wrote to memory of 1364	4884	Ibnccmbo.exe	107
PID 4884 wrote to memory of 1364	4884	Ibnccmbo.exe	107
PID 1364 wrote to memory of 2032	1364	Ilghlc32.exe	108

C:\Users\Admin\AppData\Local\Temp\f29f14654da75587bdcf036e93328120N.exe
"C:\Users\Admin\AppData\Local\Temp\f29f14654da75587bdcf036e93328120N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\Gdjjckag.exe
  C:\Windows\system32\Gdjjckag.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\Hmabdibj.exe
    C:\Windows\system32\Hmabdibj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\Hfifmnij.exe
      C:\Windows\system32\Hfifmnij.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
      - C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        24⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3760
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1200
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        38⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3332
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        40⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1056
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2120
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:512
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        56⤵
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2244
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        59⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        60⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3484
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2904
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        69⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3668
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        72⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        73⤵
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        74⤵
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:388
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1432
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        77⤵
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        78⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        79⤵
        Drops file in System32 directory
        
        PID:3608
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        81⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1776
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        85⤵
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4452
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4504
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        90⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        91⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        94⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        96⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        97⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        98⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5860
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        103⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        107⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        109⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        110⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        111⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        113⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        116⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        118⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        119⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        120⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        123⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        124⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        128⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        130⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        132⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        133⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        138⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        139⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        140⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        142⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        143⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        144⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        146⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        150⤵
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        152⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        153⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        155⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        160⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7020
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        162⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        164⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        169⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        171⤵
        Modifies registry class
        
        PID:2768
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        172⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        173⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        176⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        182⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        186⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        188⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        189⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        190⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        191⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        192⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        193⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        194⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        195⤵
        Drops file in System32 directory
        
        PID:6360
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        196⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        198⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 408
        199⤵
        Program crash
        
        PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6800 -ip 6800
1⤵
PID:7068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
250KB

MD5
149b761061b95514f0ac0796802c8bb2

SHA1
d41c16c91c15bd9965c94703a64738d579bfbc50

SHA256
6e25fdae987f6ad95e550868aaeda62811e8e233fa38b673370d9dff63be0db4

SHA512
2fa2459db092e2223d2d09b6f17d3affd2137876b4db6cbafb24f1a76e0365222814e3022d198383191be33b7c05295aef7ed8f9a5e13d916e1f687b0a024f9e

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
250KB

MD5
8fe7cbc34103d271d027a416b6e2394c

SHA1
18e74b5acb432932aaf2ffba8ce666056b2c1a6c

SHA256
d43f1b8e6289f15e666b53f7e7b6159f06dc9faff54355fa72d72c0fa6e72c20

SHA512
5dd4ec1348f3a07b0fed32c0dfbdfe4f89a6fda6048eef22cab66f4ae37fb955215567f7bbd228a6e7bba96097b0e815564417a465ddd504384dda8304548918

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
250KB

MD5
eea6f63d76829a91f0f034db8802224b

SHA1
c400bb8187b1b607c6a6fcdb8c2ca86ea7e41dc0

SHA256
bd7fdf4e2c081b177aa58f3f96f02d68f3d0415828786485ff4d7ceaa1c20da2

SHA512
2f3e30b54646056bba1de96091c4c1bba8c993ba9ba8c21a7c1765c66ca4db6f3bc14b9c6b2ce7f63a177aa9c899fc09f53566027193949bce0f391ffc1bf410

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
250KB

MD5
947e72ab7f8bb93bde4a1eaf452b7df3

SHA1
93c2cd1bb36014b964e83c519280203216cf8afe

SHA256
aa5640381a10aa11b39858b9f7452aa90a77e117a453c5be98ce693926ee2445

SHA512
4b2038473ea63a34dca7e9bd4323b92cc3de73acf7bf0b432cb6b976a01c7f73f2a3704fb1604ac3a3827f0d187e397a34810a64d85a4f46925dd7b0f248aac7

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
250KB

MD5
a3c76181b84245fabf779e68a8ebad48

SHA1
ca36be10c1ba056879f94b68aa109e6229b88d24

SHA256
c94312857255af9d6f59d584b6317156858de5b3f8863dc80b0ef23318f2c5e8

SHA512
54db9e0533322c10973264e08c1e66768b6f412b01333f5dd34e15b802a531354b57d6eb92bd6436afdf5fd3a6a0139579ff6ed9eefea3953340a4bb5252848e

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
250KB

MD5
0876166c6f58230ca44a19583b24b131

SHA1
a0962ddbd1a1a460d5d36697053d65d94b96aed3

SHA256
01fd1c1155e1df4df3d5c9a3820292d5164f487a51c245738f38e0e5e9bb44bc

SHA512
5de54f810410ed1c20737fc8cc9ff60eec1292379bd2ec166867bc8d4c1171be238b80c43b0594afd8b4a2b3040884df41cb615673f17964fe145789b54a0f59

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
250KB

MD5
e960aef7a12f548059fb77be14e0f43e

SHA1
976780cca6a230cfce9d4983d73d39a0a8376d0d

SHA256
d509893100ce73f4d3576f09494872f0a89051e2a6ead30602e49ed1364afb90

SHA512
32a675656603cfed2b6a553e2385297707f9780a5170caad44268c8b3f8175d77a929e2754e2a98373e03febde432a2fa1abbb4c472961dbb365c26a3a75a06f

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
250KB

MD5
11c54532aa2ad77d5814c8ec3cfafaf0

SHA1
373cb54e04c678e3725dc29c859628e787043230

SHA256
cf1a6d75fb1f8beaddc39db9e9a121158d3cc953d4caec7a7201fd5fc6769231

SHA512
f589b516356f412e5cb40cbc8ba1822562a918af3e6af3c9d52e07720fea1245d0cb1abf883968b4cfdf46db7e35b3ce9ea62d9e0bc616cd7c7f1aa28d976089

Download Submit
C:\Windows\SysWOW64\Gdjjckag.exe

Filesize
250KB

MD5
1cd213149bb7a447d4a5874cbf97920b

SHA1
4ee86854a1adecf1a7b5f3d0ace0943c4816c8a3

SHA256
4ec2ff8ee666e8527272dc63507d63c0e67bdf308ff98c62e5fd49676a37a07d

SHA512
3b9160e628bc591768115489a3ac66ba132858ce87cf213d5149e89ca11570174cfe8635dfe8a1f5e4ce2d5ed327c9d2f739255935b94fd298fbf6eb5d93a69a

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
250KB

MD5
d6eac7f8142e8c6da11fd683a25fefc6

SHA1
5deb13bd74170c0d5eec57ca3cb3afbaef25f9cc

SHA256
4809fd1e50bc4f02d9eae3f06898e65ebf2b64918677a4a2360cde5843177d2a

SHA512
8de821dc3f5b4029f0d040b39de5d8a24c357aa7163eac4d176bc2a37b01068241355777aa79f007ef56be583d5f11332a23248ce0046bf8f7f2a4065b9a56d8

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
250KB

MD5
e0c891a898b1db99487ab7167a851d73

SHA1
29abcdd3f59451f795723f01dea4b47fbad3b798

SHA256
1245fc89a79d57f9f7233faa2b12d7b999b7a7ee77d39f2348e243767148d35a

SHA512
deab040fd5ed04c3260b0007d410095e6b073df653e7557ded9985cac80ba523c7893fc53267c56135d55966b0e2c34b8f06cbe7e6bf43e6c6392ae6d9f07305

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
250KB

MD5
94832f6fcc37ed36d89a08143b1ab9f9

SHA1
45760ee00a938aa9409c7ae1c09baed70d5ad5de

SHA256
a4379aa52fb7f4d58f6136e4b6efcfb1fff8b06e52612c2747a64ffb3d8413eb

SHA512
b73d6ed7e46f2826dd10471c3eedc96a14aa0b66ec76c9fc42ff09979c865dac8301850ec1fce584195813de20dad7f1aed4d0e79c6ab9e15868e55ecdb8a65a

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
250KB

MD5
8f5eaa8443b5de849ee26a8fb80a6b7a

SHA1
60e1a074419e2f2774e6118c5f9faeba1586a918

SHA256
4736ea30187ad3e7f8bdad3b324d9f8dcc776e2376dc14e77807ade2e635357b

SHA512
a50f622b981748a75fbffae914ec9f659e0d9b9e4121829bf53e474d040ae09376658f5c48fdcf850431833ce79136c1ed4b933cc398c62dda476d5243faa119

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
250KB

MD5
3256afb33d642b95389ac6ae46a770d8

SHA1
dadf4a6a7d0f8489ebce72543b834afde09a0c29

SHA256
415d80fc9e044420e24a25ad09c7bc4855ce7dae78b3abdd538a2b6d5254a32a

SHA512
5638093fa385b388f29edf29552bc97accea84f40b96c2811822f35d73cfcbc222098147098c8d7607451a31262d8d94e9f1c6a40b0da92c5794bf70a3c31174

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
250KB

MD5
a04d5debaed7dbeef8fd90029b154b07

SHA1
34db23c9663a3903757f4a55f24b9ead9d04d3a4

SHA256
2712d56503291cf5e32a458d1b70b909ee813bc049c334fbc8b5d6c92d686282

SHA512
9383d14244f7c14af9e34a26d70d4ae9f25928f0df55d0e968ed031d9fd59d1d80420149512022de846cabdc60ea8889e04ea272eead93cd540d7a5dae82a0cb

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
250KB

MD5
f89ab99ab8283cbc79c77b058de1ebe2

SHA1
08d3408826a63dd4c0d726d16fa9814475b413d5

SHA256
c23f58d348a75ba12ddbd3a14d7aaec3dd19ecd626b36c88fa0912a7a46016a0

SHA512
47c12398d0306ac166866b9267d89fe882db48cf2e2222594c657bb455b20a0438129b17fe2e33807541cb74f33324ae5a00e84e59715cd4b4299e7457301b9c

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
250KB

MD5
039a8fffd5472533961da0984f2e04e0

SHA1
25828a2507050aef596189f027a0964dec67b34b

SHA256
b7a4e68c82cd593364bdf68f6a2c3ee62ecfb92ffd5ae031cea28a93d5e6d2b8

SHA512
21a819d3601253e918911e1712908db185689fc2ec7e190efd5fb216f3be5d5dfce3b184b06c704b5b67c4065d55259e790b18fd18223430ed0f92ec3898b771

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
250KB

MD5
51fc24a6ec25cdbd2c6ba0321eb32318

SHA1
dd33df30ad4fd002406fb1db29530f60833379e9

SHA256
75b33c81885bd736f91e8d951eb913257f9f6b0ba426568d0e90ed52c889a53a

SHA512
20187810a537858f921588606df621a696e49b67f20d16a6542194c0e7172ea79e54bfed067348d7715ee2fa2b9076a9aba9dd9d83b50c7999e1092dde1ed285

Download Submit
C:\Windows\SysWOW64\Hkkhqd32.exe

Filesize
250KB

MD5
bc673d69f6e36c8568ad35b1ee39e5dd

SHA1
6e3686631c399b6a38fa0eee322cbebe973d13aa

SHA256
9bfed37be4043178932bbebfd42096df5c6fc49f99d5b023bccac1e0daf499d9

SHA512
31f45f4af8a0103f20e452fbef160a506fe6f8e18f0b0475bda1cb3afc724c582f54f53c472653ee6adeba4d096ce3faa64a76e527eb55286145c9bba4bc4d59

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
250KB

MD5
6f1abb1e0364b079cad73dcbe215f6df

SHA1
50499c24c54739169b2a3f67e7616111d29e3fc5

SHA256
ae57acad076069e3203a9ea4c915673dd18b1435208140ba984dd26735491748

SHA512
48e8c9e136998c9fad9c94710dc0a60d5db863d386b06695566de07b6ee3d3e6392066a1e1532f8442a4db74bf0fa3166da015a7bdcdc4800cf5c89dcfae0919

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
250KB

MD5
f95c0534bd0cb528a84a1ead7739951c

SHA1
17c741354c0f778bc9ba164366f49f809cba0902

SHA256
7a37df577d4c3fa8678683fb794c2540b1834d337a5d5870b79df5d5998cc80b

SHA512
c4b6204bc4dca68852f8fa230e72eaaeb56fe5b48eb6a7f56a93321db73de04d6b10a94129baaee5ed9a926ee0613ae2cc1c46eb1a1c99eb86a13c3567389151

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
250KB

MD5
d0d3c18d4dbf74d3a35b4594c2ec8a2a

SHA1
c22a319002c9bbf977bd5957145c4d0bf6f27771

SHA256
57d191ecab3b81e62972a8f1a70b15837a1b4f074979418e4f29863962f3321d

SHA512
1a6af90ef6f1c8dc7894f97809c6d51434d159aa07dc499defd04657af8ee38b3fc0772fdc04a59caefa57e964a8ed8181467f000596878613bc9503e15f8371

Download Submit
C:\Windows\SysWOW64\Icgjmapi.exe

Filesize
250KB

MD5
e9c6bc2e7e804a64706ff24a7e45469e

SHA1
4c3ab356742f53a053dbbc3685c1d4a1785debed

SHA256
b55aaeed9fcd4f95cad65b4b5aa96221268aa0d115ba3d39a2aa5f2ab992d964

SHA512
799525738de81e9f0ea6c3e8f67046b7aafae9c24f2e07231e9c104956d52e438d2eac6c4b353465d364606725bd75ff1d9a366af7cb4833cd470e4ad62ace97

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
250KB

MD5
fc9222d5e5657b141d27f820e21f2889

SHA1
edbc0d82903f6556b52f7ef99597e7842cb5e9ab

SHA256
bfcefd5425a1603d633795fef33c5c70cdbcfc25ebd07cc2e10e2cc0b3d2da0b

SHA512
5c8a3ec6ec9df3edc00e301592417cca3c6065a006a0c654bad05721d25a46bc4f98ca829cd1a9b6473464be97cb36ed1adf7ab5d8669db76fe7ed0784b52924

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
250KB

MD5
8a855a2ce0875c01a61e03d886eb6df0

SHA1
83ce3e4a29c9a9e438740c27cefcac593ad0def6

SHA256
52fe4713326a05f7f639480e036b9e43af4b64811d7f8ca034dffcd133ae0349

SHA512
c2385367fd70c569199f7fdc87ab37e87c0f9196b4724f67bc6b2db48450ab68cd7bbd7e6dfc28915ac84c489d4c4c8252ebbcc2783e642a39792062498ffaff

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
250KB

MD5
4c8b88270da42b4a2958c5a55ae09a26

SHA1
57b0d14297c182ebfc98b562450b8125688569a6

SHA256
07861b552284fcbf17ae70aaf769c55ff6a902d1fcf5cac4b1991a52b1921d91

SHA512
7c575b59672fb42772850a3c50e1c2bf18b4f735bc6874cf331969d58cbf794140a569bc024d4c606a8e59e3bd690c988f23bd01991f9147a9449a40161f3e4e

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
250KB

MD5
745b433a40b8b5f8c89f3447e9762518

SHA1
9f8e43304fd040f06bc630bf161e33189657d2ed

SHA256
4762173b5d4bc60321a9e124661d7eaaa15657bb8c184e8d7557cf08991a0410

SHA512
642893da988e007ada797bdf731f4ad3a8b84f7451da81189cbe27a10498927d5a7edc8ece9537a31d77cc519e6db1159a5b4a1129619b0005db4e293fb78638

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
250KB

MD5
0fdad3825e803dc253530d52c2a08c16

SHA1
e7ebde4819e156201c3f85704b6d50273c0bdc76

SHA256
ba90a0922a573c585ec1233935890709263121dcbb663d9bf31ad750a79d6f86

SHA512
6a871f71ae2109678e78c3b54600ca8d94322677365f38bea69c370241a0226584b11c8a28d9bd1c9ee0affe1d9cf8ff1687da24744593c9d420c3e5b6f15ffb

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
250KB

MD5
e732b93d218b1f615d9af2ceda28f586

SHA1
1d43c8ebbea0a767cfcf8d40a00019f77324d9c8

SHA256
8d674080be525eac4888543d070787c5fc220970f14e5143fe44f63e9ea6497d

SHA512
7a9a416bff8189f17c98f4ed0f2799c9ff8e028dadbbe7389840b5d16e99bb5de5a40b1386b3f7f52851682287427200946bcef8cfa97f05eabcae2f9dbecc38

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
250KB

MD5
5370039183d4827ea145f45918c54236

SHA1
a0b909cd569da2278c69c501885904d43e92aacd

SHA256
358e367b8b161ef0a333ba689c54c5990bd6f68edce8f3197f972e8670c3dfa1

SHA512
417638c715da3625c43053bab55d33526a08cf7099149b34281985ed59cb3021704e7ed287d223d079955c86a13e0eaf6152f4e98a5d92de1d31996c38c1aed0

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
250KB

MD5
b02d33250ef7eeeb115ef2cd275fe27e

SHA1
d1511d0db0fdffdaa566e05d7bc61eaefb237b01

SHA256
61d8714410d70c6092029a8773d380389952891cb9b414c7d0d6da41c6e3e515

SHA512
529539764d486e9d4599ab057514728212e8fdf56c453c6de5518f5c30c44fc43776b0042e748008ef8ddc278db218ccbf8c98c228f1711847b05d675379f924

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
250KB

MD5
2fd9b66ecfe0fc49287aa2964b291fda

SHA1
7472a99fc9ad3f9d7dd315432b1f55c666affdd5

SHA256
5d4f6ef1380cc70805a0adfacf1f5a8befbf4c31f5a8679e3a99c5c20cc0aded

SHA512
bf9a3af98a5da6b7dd6ce3ad2c1fcee14c3b587d30fb27cffff5695ea38f8dd54d18547972842edbde96803758ac67d9d736b051efe72e91dfec7f765142828f

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
250KB

MD5
ec0abe271d901360693dab8f308ec11b

SHA1
311b6576bb2920ed5ade354142836b783e826f05

SHA256
bbea3984f4055a05b4d7de0cd22e0b184dc1cc74d58563225bac9d365af9b801

SHA512
f41c03dee978745be4adbef36a2e2a356cc9c1f2a2226aa6b59f79a64200fac3d0f8696773eba316cd3ab63dab716238249fcf9e81ccd20f99a3a9f76d0a4293

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
250KB

MD5
e843de153a0fa9bab7fdc2fc70735804

SHA1
f4b36334c2cc70a1ecc63df895952e08754f51db

SHA256
3aded47f64432f91042d247b4206e8862a02546bb9fa7244cab06f358d632f89

SHA512
d5ac71b1d2abf36ef37a7aab7c476e51b5a62376f75259a3955315045bd11716b82e2b91c6a7c51c0d9cc7d32907a1612959d1d8c48732c6d9d343d9d7c423b2

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
250KB

MD5
55ace851b04a929734557c33a7f36cf4

SHA1
3d803ab033bfc79666cf599fba47cfe82e350d8d

SHA256
816997f15233145dec4cb4d2b1f3fcc51d127cff75bb844c548cc93fbaf937f1

SHA512
4f4bc1d8f0b6f841e401adc745c33d99add462f2b46163450a06baa6385c22658e83f56e56a8a772a2e7af3550c8c9e983f61f76f821696d8437f18e3044b01f

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
250KB

MD5
63d9232916d332eb3229711d756e682a

SHA1
969efc3e8b1eef03ac776684a7e5576d1c4e64bf

SHA256
9e3251efcf860021d97ee9bd77945de5acaee84dd39665f73ca4a67b1b8b8e85

SHA512
f38040c87b1b66b5c8bbc1534d22dad9b3364fab5a93ad0a51a7c327104f046b00400ba6f9c35fc956324ad8801600719396ef8cb1380a28afd35134fcf4b396

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
250KB

MD5
fb099ff4e0ac7e0460ffb4f117445ce4

SHA1
e798ac681043b2ea5be6169ee3617a57cbc724c9

SHA256
e319384871be40d999a84f7428a8a2c3695e81900a03357863afd67023746552

SHA512
a5c23bd61d837434e3bb47da0d6b3bfef769696b10e8e48e4020631e2893ad59b9cee4f2088aa051038a7fcfa1d7927cce1ffc3f337f359f1757e6bb832feaf8

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
250KB

MD5
36e7ae6dd1b195a9283821013dbb13d6

SHA1
f099f4cd0e0f1332e4b39be8e36a3fac6d04e250

SHA256
bc493ff223f72db14032274cdc2cebbcb3f6ba770b5f0f6505aa93ec7aab94fe

SHA512
9b00b5151d4455ab374e82a97a77f0f1475e4b58e36dd293f96b742382e503bc1f3d7bbec8470b423e08b0666fa1699a7efc086b20834b6a00e8796066d606ff

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
250KB

MD5
ddbb52ba11657b67cd7e259aee38b105

SHA1
5b39abb7cf4aa5fff070e908ce9b7da2d34eb550

SHA256
9a347c7e8eb373003d548cd15e0f9baf7d1a7f6a741b3dbb13432893d1d5f442

SHA512
ec9118173e4aeb037f94cf200bc278e0c0525e90932487706c574e00599c688dde8c172fac74409f5deefccf5dc575d3fcf17a77768c8a52d8a203cd5888b64f

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
250KB

MD5
5fcca6a1966e1a999d66b631ade20c48

SHA1
5b7f9bbaa736a9df1480932427c9c39e4528c3d3

SHA256
04d5902571ec77322ce6119afd3b4f46b3ddaf9610fd12b9635a0e00514ece07

SHA512
ddf2246bf439cfb5df981cade10fd05e34140a47fdfc1b8e9a01a1c360a6562f7a69a8cae9552ab35183ce03c548aec80d569a0277623ff707c34b5f7c84fca5

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
250KB

MD5
0e4020ae404e5bd54c00fd6bb8067550

SHA1
ba9e6c65276de846b454f116656fcd09b324e494

SHA256
255da98970bc68b71c9b13de7bb7d76f542801175263f25c546f2fc7c995b330

SHA512
8930ac2968a1367d968d63fe6daee00c315d10cfc1568febb0479a25f31d3288c42d8fefe7d6f34638701ada2a56cb9c0b3535be2148bd6b3c10fa6c9e15c264

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
250KB

MD5
1d001e7c239202290f188a4ece742d46

SHA1
c65f728c065ae63b36af0b2a0fa823ee30624b75

SHA256
80404256e9d37313abb17388434a10ed8ac08584594ced4b9b2880efc156a0b0

SHA512
624489b4d9116f8f3bd02c603fd8cd0ea5668cfc07c92a024d5cb093c1750fc57c4f351a4f17e1593d086fb558dd156640c74ba42a2afd69451c902a79294745

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
250KB

MD5
a52efd9da52c0ce4a1b60138d1e3f3df

SHA1
2aa9fc6a5f9bc34f457cddb4b0d2c542074905a9

SHA256
fa9f2bf241dd6c4d694ba4acc0d0f9cd3f45683719ed3b7088ee08a23234b080

SHA512
c3bd18795c0d81d669ab32984b64d4452c121a9747dce02286031c73ad6c57925c8a9643855b38965a21a6b052b874683fc7c8d44637b8e8e858530e02d32a86

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
250KB

MD5
c6d81fed91d5cccccef77713a5d0dd3a

SHA1
1b51c7c07f8f5e5290dd9b8af65225a81e8bf263

SHA256
34090949dae323e9581c2b399f1ec7cd10aaf238a6ee2fa9b472c2245d84686b

SHA512
f4f5078d268e047dc39c1da815ec7bb9d74cae9972f668b71f090d6e09c9c3fd73cc6a913a428402761881f310e237169456abbf88fef137fe986f987072cf56

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
250KB

MD5
6d5a1f9c1d2fdd54d54744da5a7973c4

SHA1
e5d0506b8dd5106ec7c068b7ff50164bb85c9492

SHA256
dd69e970f52df3ed4558062f6e12d378e51bad6dd0d705c97b8e06308b536f2f

SHA512
d9f7f99ba93ecb912abb281d5dc571e64b1e4e9e7f6c6fe75fa149e072c6247448c9c079f85904edcff764dae9a6731c825bfbb380d7885b489d6e29dcba5f5a

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
250KB

MD5
46f722d427e8e53e949f65629a2a778a

SHA1
66ec2b78748bc03685a214bfe0c71060ae66cc7c

SHA256
0c735c1d4d96257bc4e5beef212be60f14ba4971d820ab9addbd7043a4fc305b

SHA512
9efc20afa8cb6767b6081823ebe88d1b895b1d2fb286bb31cf8882f4a68ce5ff7d9e2b15140a6078199236b45e2a3d0ff3441a7472f9855636e030bbebc36952

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
250KB

MD5
39150854d78421c60c1998f6d2995d3f

SHA1
996d8d501e871a84c5b13f72f3197ba09015ba0e

SHA256
223f824ebe8e56f473f9f16fa1b5251b3cfdbb634e153e4911eddc86d970f914

SHA512
db11bcd5b07c4aac4e7c7c5ed9702a5e52d4ed831af1512ec2a24d9cf1366bfd703432e93d638255d4183013b5404a6e5f9cdc18821f742560b11dd0ead78eaa

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
250KB

MD5
79fa46c01bde1b964d1095ea22ea6e5e

SHA1
e703172e0f03d6fd3d8bbcff632a49168a0325b4

SHA256
0a6c73d61470c84eea3d141d371a85147e7ff725d7fb0cb7e8368bd35969e08c

SHA512
94e587718ee7ab38e1a7a010162fe2774a8e4f03a90cfb0aa57c0749ba9a7a8297f916bc99d219bce8d81db7c6a19e88a9dee816e503e09e6cc17ad1888be20e

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
250KB

MD5
4a74e6e90f512603a741e21f2283420f

SHA1
1610ba409ba2b2141494d9a1a7bcfc5b6ee0e473

SHA256
93d62e7b89f9ba2d32fc5a4bbdb19d982cd6cbff55d54c63470801ed2424e949

SHA512
a91c53bd83b4148e9491b4d31094c059b7c41a88cc2965fe6091c345bc6151e6bf01a7de2e193f47b076c44ef1952cda7f210efee0f42dee56e7fc7e0b01082a

Download Submit
memory/388-500-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/404-136-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/512-348-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/968-63-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/968-593-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1152-574-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1152-40-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1168-389-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1200-260-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1208-523-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1208-1498-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1256-378-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1364-168-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1432-506-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1456-302-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1592-331-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1760-112-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1760-633-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1776-1487-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1776-550-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1804-424-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1832-376-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1848-120-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1848-643-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1852-418-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1856-530-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1940-363-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1988-319-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2032-176-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2068-308-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2120-329-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2244-401-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2248-262-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2304-458-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2332-471-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2332-1513-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2360-354-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2400-128-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2672-493-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2760-585-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2760-48-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2820-400-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2920-541-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2920-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2924-152-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2988-573-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2988-31-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3000-278-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3004-617-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3004-88-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3140-366-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3160-441-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3332-294-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3360-542-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3392-284-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3392-1577-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3476-199-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3484-442-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3596-483-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3608-524-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3668-477-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3724-619-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3724-96-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3760-226-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3816-192-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4064-208-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4112-143-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4176-215-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4228-71-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4228-600-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4332-232-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4372-459-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4428-296-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4452-575-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4520-407-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4532-430-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4536-342-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4540-80-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4540-606-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4632-562-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4632-24-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4644-244-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4732-587-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4732-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4820-8-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4820-548-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4844-465-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4884-159-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4888-560-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4892-630-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4892-104-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4924-555-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4924-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4944-188-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4964-253-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5028-512-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5192-594-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5304-607-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5416-620-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5464-632-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5720-1423-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6040-1398-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads