625e890ccf4a9b9f2f2b4a5fbe09eb916cff91f505c5ca58d70e00ec95098432

Analysis

max time kernel
104s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a026a5dfa4ac1bde665fec92a7c17220N.exe
Size

96KB
MD5

a026a5dfa4ac1bde665fec92a7c17220
SHA1

9e229eab505db32a0879f3f6e7ad4c976616b7e3
SHA256

625e890ccf4a9b9f2f2b4a5fbe09eb916cff91f505c5ca58d70e00ec95098432
SHA512

a4df0a096fc0d511276da0cb5a831221fd8331db6cbe7a8d0fae2456802104851a23fd70fe34e675c963a7a4db4cfdb54453a6a830b3ef977d4d0a350ebf7f3a
SSDEEP

1536:tRsQ0fS11+GyE6IsMwEL4TxREbc9ZpzBIe9MbinV39+ChnSdFFn7Elz45zFV3zMv:oSjxsJL9ZjIAMbqV39ThSdn7Elz45P34

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkffog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlednamo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdgdgnbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Immapg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefioj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fomhdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faihkbci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlefklpj.exe

Executes dropped EXE 64 IoCs

pid	Process
1136	Faihkbci.exe
4748	Fdgdgnbm.exe
3520	Flnlhk32.exe
1904	Fomhdg32.exe
2996	Ffgqqaip.exe
1820	Flqimk32.exe
2796	Fkciihgg.exe
1588	Fbnafb32.exe
1956	Fdlnbm32.exe
4804	Fkffog32.exe
4976	Fbpnkama.exe
2548	Ffkjlp32.exe
2768	Glebhjlg.exe
4396	Gcojed32.exe
2276	Gkkojgao.exe
1632	Gcagkdba.exe
1040	Gdcdbl32.exe
4448	Gmjlcj32.exe
4388	Gcddpdpo.exe
3460	Gdeqhl32.exe
1004	Gmlhii32.exe
4332	Gokdeeec.exe
3536	Gfembo32.exe
4692	Gcimkc32.exe
2020	Gfgjgo32.exe
4712	Hmabdibj.exe
2716	Hckjacjg.exe
4340	Helfik32.exe
4288	Hmcojh32.exe
3212	Hkfoeega.exe
4044	Hcmgfbhd.exe
3376	Hflcbngh.exe
2168	Hmfkoh32.exe
4948	Hcpclbfa.exe
4008	Hbbdholl.exe
2892	Himldi32.exe
4708	Hmhhehlb.exe
1768	Hofdacke.exe
1744	Hbeqmoji.exe
5016	Hecmijim.exe
4196	Hmjdjgjo.exe
5060	Hkmefd32.exe
3500	Hcdmga32.exe
4032	Hbgmcnhf.exe
728	Iefioj32.exe
3056	Immapg32.exe
5080	Ipknlb32.exe
3732	Ibjjhn32.exe
2388	Ifefimom.exe
4368	Iicbehnq.exe
4416	Ikbnacmd.exe
4772	Icifbang.exe
4580	Iblfnn32.exe
424	Iejcji32.exe
1608	Ildkgc32.exe
976	Ickchq32.exe
1372	Ifjodl32.exe
4144	Iihkpg32.exe
964	Ilghlc32.exe
1880	Ibqpimpl.exe
1592	Ieolehop.exe
4584	Imfdff32.exe
4644	Jfoiokfb.exe
3492	Jimekgff.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ldleel32.exe	Lpqiemge.exe
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Mgagbf32.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Nfgmjqop.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Ochpdn32.dll	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Jfaedkdp.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Lmppcbjd.exe
File opened for modification	C:\Windows\SysWOW64\Lebkhc32.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Iledokkp.dll	Ildkgc32.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Odapnf32.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Glbandkm.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Jimekgff.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Olkhmi32.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Dekclg32.dll	Gcddpdpo.exe
File created	C:\Windows\SysWOW64\Jlpkba32.exe	Jianff32.exe
File opened for modification	C:\Windows\SysWOW64\Kfankifm.exe	Kbfbkj32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Phkjck32.dll	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nebdoa32.exe
File created	C:\Windows\SysWOW64\Ocnjidkf.exe	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Ophfae32.dll	Fkciihgg.exe
File created	C:\Windows\SysWOW64\Himldi32.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Adopjh32.dll	Ifjodl32.exe
File opened for modification	C:\Windows\SysWOW64\Jpnchp32.exe	Jmpgldhg.exe
File opened for modification	C:\Windows\SysWOW64\Ldleel32.exe	Lpqiemge.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Fomhdg32.exe	Flnlhk32.exe
File opened for modification	C:\Windows\SysWOW64\Hmcojh32.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Mjbbkg32.dll	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Ofnckp32.exe
File opened for modification	C:\Windows\SysWOW64\Pfhfan32.exe	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Qciaajej.dll	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Fdgdgnbm.exe
File opened for modification	C:\Windows\SysWOW64\Ffkjlp32.exe	Fbpnkama.exe
File created	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Kdnidn32.exe	Kmdqgd32.exe
File created	C:\Windows\SysWOW64\Mlcifmbl.exe	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Hmjfkopm.dll	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Lenamdem.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Lepncd32.exe	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lebkhc32.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Gfgjgo32.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Ifefimom.exe	Ibjjhn32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Hhkephlb.dll	Fdgdgnbm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7300	8188	WerFault.exe	317

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbbdholl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iihkpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkkojgao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebdoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecmijim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilghlc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkciihgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icifbang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifjodl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fomhdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfgjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kepelfam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjagjco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqfmde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcagkdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpijnqkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefioj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klljnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leihbeib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imfdff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgmha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpqiemge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckndeni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikbnacmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgldhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblpek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miemjaci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iejcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcefno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmfmmcbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ickchq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpeiioac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likjcbkc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lebkhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbnapki.dll"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okokppbk.dll"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbbhclmi.dll"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laapnj32.dll"	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgdjapoo.dll"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qncbfk32.dll"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgfjhqm.dll"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fomhdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbgmcnhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldleel32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqplhmkl.dll"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hddeok32.dll"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neeqea32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1136	436	a026a5dfa4ac1bde665fec92a7c17220N.exe	84
PID 436 wrote to memory of 1136	436	a026a5dfa4ac1bde665fec92a7c17220N.exe	84
PID 436 wrote to memory of 1136	436	a026a5dfa4ac1bde665fec92a7c17220N.exe	84
PID 1136 wrote to memory of 4748	1136	Faihkbci.exe	85
PID 1136 wrote to memory of 4748	1136	Faihkbci.exe	85
PID 1136 wrote to memory of 4748	1136	Faihkbci.exe	85
PID 4748 wrote to memory of 3520	4748	Fdgdgnbm.exe	86
PID 4748 wrote to memory of 3520	4748	Fdgdgnbm.exe	86
PID 4748 wrote to memory of 3520	4748	Fdgdgnbm.exe	86
PID 3520 wrote to memory of 1904	3520	Flnlhk32.exe	87
PID 3520 wrote to memory of 1904	3520	Flnlhk32.exe	87
PID 3520 wrote to memory of 1904	3520	Flnlhk32.exe	87
PID 1904 wrote to memory of 2996	1904	Fomhdg32.exe	88
PID 1904 wrote to memory of 2996	1904	Fomhdg32.exe	88
PID 1904 wrote to memory of 2996	1904	Fomhdg32.exe	88
PID 2996 wrote to memory of 1820	2996	Ffgqqaip.exe	89
PID 2996 wrote to memory of 1820	2996	Ffgqqaip.exe	89
PID 2996 wrote to memory of 1820	2996	Ffgqqaip.exe	89
PID 1820 wrote to memory of 2796	1820	Flqimk32.exe	90
PID 1820 wrote to memory of 2796	1820	Flqimk32.exe	90
PID 1820 wrote to memory of 2796	1820	Flqimk32.exe	90
PID 2796 wrote to memory of 1588	2796	Fkciihgg.exe	91
PID 2796 wrote to memory of 1588	2796	Fkciihgg.exe	91
PID 2796 wrote to memory of 1588	2796	Fkciihgg.exe	91
PID 1588 wrote to memory of 1956	1588	Fbnafb32.exe	92
PID 1588 wrote to memory of 1956	1588	Fbnafb32.exe	92
PID 1588 wrote to memory of 1956	1588	Fbnafb32.exe	92
PID 1956 wrote to memory of 4804	1956	Fdlnbm32.exe	93
PID 1956 wrote to memory of 4804	1956	Fdlnbm32.exe	93
PID 1956 wrote to memory of 4804	1956	Fdlnbm32.exe	93
PID 4804 wrote to memory of 4976	4804	Fkffog32.exe	94
PID 4804 wrote to memory of 4976	4804	Fkffog32.exe	94
PID 4804 wrote to memory of 4976	4804	Fkffog32.exe	94
PID 4976 wrote to memory of 2548	4976	Fbpnkama.exe	95
PID 4976 wrote to memory of 2548	4976	Fbpnkama.exe	95
PID 4976 wrote to memory of 2548	4976	Fbpnkama.exe	95
PID 2548 wrote to memory of 2768	2548	Ffkjlp32.exe	96
PID 2548 wrote to memory of 2768	2548	Ffkjlp32.exe	96
PID 2548 wrote to memory of 2768	2548	Ffkjlp32.exe	96
PID 2768 wrote to memory of 4396	2768	Glebhjlg.exe	98
PID 2768 wrote to memory of 4396	2768	Glebhjlg.exe	98
PID 2768 wrote to memory of 4396	2768	Glebhjlg.exe	98
PID 4396 wrote to memory of 2276	4396	Gcojed32.exe	99
PID 4396 wrote to memory of 2276	4396	Gcojed32.exe	99
PID 4396 wrote to memory of 2276	4396	Gcojed32.exe	99
PID 2276 wrote to memory of 1632	2276	Gkkojgao.exe	101
PID 2276 wrote to memory of 1632	2276	Gkkojgao.exe	101
PID 2276 wrote to memory of 1632	2276	Gkkojgao.exe	101
PID 1632 wrote to memory of 1040	1632	Gcagkdba.exe	102
PID 1632 wrote to memory of 1040	1632	Gcagkdba.exe	102
PID 1632 wrote to memory of 1040	1632	Gcagkdba.exe	102
PID 1040 wrote to memory of 4448	1040	Gdcdbl32.exe	103
PID 1040 wrote to memory of 4448	1040	Gdcdbl32.exe	103
PID 1040 wrote to memory of 4448	1040	Gdcdbl32.exe	103
PID 4448 wrote to memory of 4388	4448	Gmjlcj32.exe	104
PID 4448 wrote to memory of 4388	4448	Gmjlcj32.exe	104
PID 4448 wrote to memory of 4388	4448	Gmjlcj32.exe	104
PID 4388 wrote to memory of 3460	4388	Gcddpdpo.exe	105
PID 4388 wrote to memory of 3460	4388	Gcddpdpo.exe	105
PID 4388 wrote to memory of 3460	4388	Gcddpdpo.exe	105
PID 3460 wrote to memory of 1004	3460	Gdeqhl32.exe	107
PID 3460 wrote to memory of 1004	3460	Gdeqhl32.exe	107
PID 3460 wrote to memory of 1004	3460	Gdeqhl32.exe	107
PID 1004 wrote to memory of 4332	1004	Gmlhii32.exe	108

C:\Users\Admin\AppData\Local\Temp\a026a5dfa4ac1bde665fec92a7c17220N.exe
"C:\Users\Admin\AppData\Local\Temp\a026a5dfa4ac1bde665fec92a7c17220N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\Faihkbci.exe
  C:\Windows\system32\Faihkbci.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\Fdgdgnbm.exe
    C:\Windows\system32\Fdgdgnbm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\SysWOW64\Flnlhk32.exe
      C:\Windows\system32\Flnlhk32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        23⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4692
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4712
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        28⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        30⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        31⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        32⤵
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        34⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        37⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        38⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        39⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        42⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        43⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        44⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4032
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3732
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        50⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4772
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        54⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:424
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:976
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4144
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        61⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        62⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        65⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        66⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        68⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        69⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        70⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        71⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4084
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2188
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        73⤵
        Drops file in System32 directory
        
        PID:1336
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3368
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5064
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:852
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        78⤵
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1640
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        80⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1676
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        86⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        89⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        90⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        100⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        103⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        106⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        111⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        114⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        115⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        117⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        118⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        119⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        121⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        124⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        125⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        126⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        127⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        129⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        131⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        132⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        134⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        141⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        142⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        146⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        147⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        148⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        149⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        151⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        154⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        156⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        160⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        162⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        164⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        165⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        166⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        167⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        169⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        170⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        171⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        172⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        173⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        174⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        178⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        179⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        180⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        185⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        189⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        190⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        193⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        196⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        198⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        201⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        203⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7180
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7268
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        207⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7356
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        210⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        211⤵
        Modifies registry class
        
        PID:7492
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        212⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7536
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        213⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        214⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        215⤵
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        216⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        217⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        218⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        219⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        220⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7932
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        222⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        223⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        224⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        225⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        226⤵
        System Location Discovery: System Language Discovery
        
        PID:8152
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        227⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8188 -s 404
        228⤵
        Program crash
        
        PID:7300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8188 -ip 8188
1⤵
PID:7264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
96KB

MD5
1b999220e3726ca05de074970dcbc196

SHA1
77ddb2803b0b513cfc699f09ce1d3e459a76b4bf

SHA256
a58835f94fa0426145c65cd11911e0e1e52fe71d1cd9c0e2e6c767f2df8b5262

SHA512
721c2b9b9107f5ce20e4709996b55443c4280e7352b82c3e7087084fcfc3465da1842f70c467f3ef2c63e201bc05456d680e8dd5712400d4d40d9ba927a3f9ea

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
96KB

MD5
e9940c6eb0ab48c0d7477f3e3decc208

SHA1
86516d2c2d37ceafd469a25fdedad9b8ab8cdc9a

SHA256
ffbd76c4c786c5d405f881dc0451a0812ebe3ac9298ecacfd1efb278e5126d8e

SHA512
293ea1203a6a7e0f6edac7cb59b5aa38cb73ce7859624bc0d162b59341cb85a49556eb325434122fb15ccfcf151b5a0651baf4dbf288c43d3d08b3c573cb7178

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
96KB

MD5
0dec8b5fcf2efebfa054ad9f5de07803

SHA1
99ccc5b6bbd5140d66e612c9bc3dd8e06cef4098

SHA256
05cdeb6f29cfa79d3011952320afd588ddaff75d98e45d32c4c61c730bb51a3e

SHA512
a070fb511a58b38d477aa001dff8a3feb921d11e5fcdd077c0df1f7705f01b334fc08cbe981a12c9780121155ed6ebe624f0db002f200be460858231bd58fc04

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
96KB

MD5
18bda2bd759faa089e0f3b8de358c335

SHA1
3994cf4283c5ed336003e421c964fb4e807369e7

SHA256
e9cde2b3b9a60f3249828d8729962d47bc8b5d3ac0445251c9d9cc4e08496328

SHA512
e2847dbcf210f85ce25810da3ec6fcdca7184d69861ea185f2cdf7af328ad1b6f58a60b8c87c8a1fb12834ad3912adf5b0e90bb49e862678b3d13c3dddf8e0fb

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
96KB

MD5
abc71b02e9d3bfaca874173ceb4396f3

SHA1
2cbe269f67f84bcf84f9706ae8ea5d1e6564ca7e

SHA256
ca70db092450022b8e56806ae3e9953940adf3ff8de21546b19491948b5d60aa

SHA512
3cd48fcd4c95c7235af904eb9c6f3d9813c732940483cae2091fc279b5ad8b153ca71d28d175dd7ece4ffca99bf69ea68c30695d0d684442de5588f346b116d3

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
96KB

MD5
0a6f85147957a454cac939643252d6b7

SHA1
43c7a7ed6516b3c2d3359abda417dac4d0f22d39

SHA256
6c780e08c80e6ed24722002eff629bdfa31bd8204d4b9fd41be8860a189ae9fa

SHA512
5e28db19a82b8e70b0667a735f656b4dd2416af101317381a1948b31e623b0e0e623f6808a508d3f55c864a5b43f7572b5e0b820504e5478c34f6b2ecf457b10

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
96KB

MD5
3a5b6be1b39f61e5d1003d1492572eaf

SHA1
4aaba54d9aa0615c40287f205697f99bac68ab2f

SHA256
b7de00106d243d05b3330a181333e4663ffb39dc7eb9eb121ca92a228d4e6cf5

SHA512
d8dfaf6d2b15502a3eef7b15b098ee0c6a19acc8671573fe73820267e4ae927f3a61a9de8ce27bc954b4bad20707179a50fac475dd66e2e44c1753a70dfba11b

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
96KB

MD5
627a8182ca796424a5a676a48fabc458

SHA1
e7f13c0b99520188259dea05ee7ea15bb1cc931d

SHA256
3322c5712e3ca2a6ddb5807d00eaca87fae655894eb69252f74a78e5cf27653c

SHA512
d5622235529d16e0a06cec3d46bec1dedf426f24e96d07cb447e3dedbac208140833f4b5c13c5e0f6f6cc7b451fcc15593685abe8029093ad68348f9cb961f76

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
96KB

MD5
6e603b7c86c20870f361a77ceb6c7070

SHA1
1b4b00107017a7e31ee5cba27c29c7f0e89efb63

SHA256
361aa6d69d5d1c61de97eb1d43639d5acfaf1c42b189c0aff8ed7f6135ea8187

SHA512
8b4deaf1bbb77acfed3d6a751cc0c7d066f3153240edd43f79f74b2dc8b06bc2ae73be759b878516e21b18d55c4c613e5cbbf581ab9a57f0c063e6cbaad06405

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
96KB

MD5
2653d515a15d8967cfdfe52707484788

SHA1
543babccb95db06ad17e830d55d82e24d104c092

SHA256
5f45e748554580b130de50bf55a0b2b43b43a97444e405fd28099278bbe127c7

SHA512
05b2af19b266f8110e7304e7c29a85011717f1b445f0534f732d6a9c97d53327622f4bac197754f780bd07f0632de0a627a7f3c810036a2a1fc6ff569d0959b3

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
96KB

MD5
e51e743f7ad82c56284ab8aa5f439a2a

SHA1
37bdbd096f02a92125ca0de0e38f75a480b90332

SHA256
9cebb72fe1a9a0897c3c0315d884ce48f575ee04267374d164017645bcc6fa94

SHA512
999a5c535b99a2db374ad5bd0120a7f246a95aee0ed23ea49b2ede2a78516a1c69d30adc142cac39cffd834bdf9fe96e309a4aaa608d26a8c13c8cbc11470b25

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
96KB

MD5
7fdadd93e45321e8b051871266d15e3e

SHA1
2be1f8004077a1818490b776fc611559c22798af

SHA256
bd2d516e71ea166af7caa032ed77a3aedf26e1327c1373a73e1a8e31f15faedb

SHA512
e8b227577d2ba078b2d5786c5269c99b22a2e91f7655a77fc87799feaa29f0800eedce5e01e480a771edf28010f41da1bd0393cd0e9f071dd36a7106d73a46c3

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
96KB

MD5
3378d0480d968e409c82835497809bb6

SHA1
f471844036eb05f22d3fcfd0db0de9b7632b217e

SHA256
3964d8dc2e49e935d0c7a805c8a81a6e66f8e37b611954071ccd3f6e268f5a52

SHA512
dcf3a67407b28b4390881009390fe87098ea2f5d7f2da79d597fe21b91da7d56204c6faeee9c4bbf7b829db1c54a4176c1869116ff32751f9776bde59d00f864

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
96KB

MD5
32a7c7ab5272a1cc93730ad484f8ea5b

SHA1
e900cd353fd05124a17675e085f0ee3974f9baaa

SHA256
2967968f3c17ab5346085383a8325f386f6eaf6640220a7db61d997df0ad72d5

SHA512
cf4dc32dbaeda3513c5adb37fbfa6019f84bd0cfc24bb499e86634eddc448c5a35b113c9d34c6af8ce8afae320fa15dfc9aaf5193b99d12ebaa1e85aeebc82d2

Download Submit
C:\Windows\SysWOW64\Fbpnkama.exe

Filesize
96KB

MD5
d7f77345324e0a4baea22175b04eb971

SHA1
30877ab9c839be1e158029ce13fb66f3e74556a0

SHA256
7bed2aef4aacafa09aa2fc9eff2b052abf654668cddf38eb87192573387dc957

SHA512
f194c0e57383887bf35409917f1d6a9ae60f82b91e485ce44eba41a2aa88b7ffe6fa1f444ca97e4134a176c2528f9d09e003b1b8cbc48d9402d886a1c2167a8c

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
96KB

MD5
5bd44b6ea7223f853ff7e4e386c6d0eb

SHA1
613d854f40812db08e0fa7175603ee9869e39b40

SHA256
105aa7980e9f141d8aac2068ee8c26b3def2fcdb9b655e1534018b15a6a819ec

SHA512
e66ad6a1faa3225a6cfee9f948a0d822916b8cf7936454b6d934963fa00b8721b6c3461ff8e07a32b487c9edc4aa7aeae31eccabee3ddb4e857691591a8c041a

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
96KB

MD5
b93cab9932262fe5f53d607ceaf0d360

SHA1
85ba013886d3095c2f6c4f5099a1e75a36f36426

SHA256
10ef5f0696e784ecedf746fa54c891b9bc4ebaf8e57202a2987821292ad9da92

SHA512
1cd2eddbcf9e4967317bd6ff0c6d4e662ba4d4b3829d5fb8cb637a1c0c0a75770c1deaa319f1e4c01fb4c4d5a0e790af5aaf8002df1b7b95e4f85b32f3526183

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
96KB

MD5
d8c2ef726cbeabdbe11a8f6e049de9a3

SHA1
afe0fa4b27d949bff21998e4d3d1696431552995

SHA256
c162c2b707bdfd4e7637ba45f6fb5f49bab88feffda28960c8f3082706a19d55

SHA512
b0411464146228418ebe922906c6f7178b3508308ce644ffb9cfba0445dab790afe6755339292db4d4429fc1b9283a7e664cd5a21bc146170d50ac7dc6f78bf3

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
96KB

MD5
7f1440d223f988a3e26b48ed0cfaeac8

SHA1
5051b470e85ce0d114119f647d2eebb4f484b7ba

SHA256
24258968253259e7f2fb98c683dc5f52c86ecb24293eb3f996d43d12516c4a2e

SHA512
9a665a104e5454f4c3382e8aad12eeac3293fa9ea3b6b9893dc8a15b8c128f6468984a050614b4d3861300389277414202aa4c75358ba3912719c353e676e9b7

Download Submit
C:\Windows\SysWOW64\Fkciihgg.exe

Filesize
96KB

MD5
18ad6792362081701cf10f117286e15b

SHA1
dd1934e1ba3f5cce6da9c4e438cdcf167ce71841

SHA256
7bf4b72ded97528a029c1d60f8e23dc47b3b41a4d3df498b11c9a469b2bbd709

SHA512
f597942e702dbb873a71218c04900e787330f32c9ca3b14ea77d25c1593f9058c7d0524581d2edbc62543b2844f43bc02c21022bec21edd604c3643e429503d9

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
96KB

MD5
41859955024865580853e5a2d1f5be46

SHA1
8989605f4c8c50b1bbbfe3860a270f8bfeae7c7f

SHA256
ebd3d2f41cde0fe786916eb4d8e331b5116161c806d995f3928893ae849a9ace

SHA512
1e9bccd6a21fb98b4c74cf67658bb3a6a85ef30f69f4ef210d4e9348985ad2ef74b275e42812ecdc8e40eddc1061b9d18d96cfea1d6d56fba11a55a06b77ae59

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
96KB

MD5
ef3c8ad59c76d2bc03709075ad4ba021

SHA1
cb3ea35b610ad1a20b5ce467cf4ec661d5023ae2

SHA256
b01119096510efe5f1088186c35a415234e5e1f810a8af0b3884093c1d2758ea

SHA512
33b4cbeaeefa168d112405b4e5adfa0761d31c41cab0ca33ec82fcdd376c49e30d7368abcb89c8e00764d3d185c978fb0b9e10255446486c4f99fe4344e54767

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
96KB

MD5
537cc527f3e114786ff70f8087029a32

SHA1
e469d5efb22b2ab06f8365ab2b706c70a1416fae

SHA256
161a73d914c4a1c40fdf442723a6ba8992cf412807c08b149cde20639873a44d

SHA512
d97ce04c78324a35b4a5a46c722d023e55cf57df55948b7bf081e3becad5e8f9693771005b2e2cd8ce71bee5099699df35478b9572a272f82b9648951d151022

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
96KB

MD5
4279b9fd0b27026530335f3105d2ef70

SHA1
faa9bed2abe2a96c98938f4ba6dad85aaa431504

SHA256
e757c80a77b7487dd1ea1cab5194160ee5b25e184081be513dab705837ba7082

SHA512
da2d795abc5786191b0879b629d45b76b896aa5e4da2a98bd1c8f7636d07a5d6d9627ece8cc89a235e2d9aa3c390b7d649e3af39591270f0757abfa83215670d

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
96KB

MD5
61da11215ba50413d8d16351387e63f4

SHA1
bbbeb707509810cdf07774e4cb92600959648003

SHA256
cb4bad5d44a2ce52fc8f5ffe08f9029d9ec228e126982333aa858f01975e70ec

SHA512
a98ca40c545740258db7ef61a144c9766c82ea3f088fba507cd0e4868259a2d1a9e2e9e84b97fb044c3552d7e5b665ac6868ef4f49a4259bf6af1fc11d5d433a

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
96KB

MD5
7cd659206b385d8db9ffd840740295bf

SHA1
1d64e3cfad59f7dc7da3fb39032c13b52e2c6415

SHA256
fd3ef65fc73be7d61b1d2996cc458c034a769fa1bc453cb1f49c6ea35f34ea15

SHA512
21425b8c852353a17c6c0823991c17da4f3b22e9d801d89b301e570df6b292570419ec1b37d3c0fccc84f7a073e35c964d0d57b5cccce50bf488bc99d514a411

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
96KB

MD5
a3721e0724c7bb669ed9d7845fd9a1a0

SHA1
69f11651d15fb6e31e97dbde9bd4140c45b49068

SHA256
bcf4c5898e6d51174ecc22ecb8a74ec5d5eaf54157daf8ef109510869728fe18

SHA512
a208dfb0b7feb2f259bdc83559ac0525c4c5fd6f54c474c6815fcaa3dc796671fbb61674eb73926ac8bf6971b929b4aad88a6449f720487b95ea0db39718ae38

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
96KB

MD5
d945b69ed8fecb7d45a940e9e9dda93f

SHA1
d9df853ed8b25b7958f646a95430b43a9375c3e0

SHA256
014f37a9b9a33c50fb0262360c7e59e1585ae21349df67ec631c8048bf0d0153

SHA512
52e60b2d5498a7b69de54d81f1fa8c8f41c2f4918f4a6bc61ddf0e3cf284f4cf6db0147f50ee63717fca430cc25a585f8af976a35c48fb9716eeda0164c69a47

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
96KB

MD5
5baabe4374719e35411524ac83226707

SHA1
2fdd57a55240c3d6a9a88eca33daa8502f396dae

SHA256
e2f339b96746f283dfb8b8ff315afb128ba087c150228f2002d1f05ee5546d91

SHA512
529161903a73b64b51504601b949d22919400db3703a0c71bd2166b8e654593ded6ec03f09aaab7424744b4471058bdf045010e6dbb77cce7dab2e09437afa9f

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
96KB

MD5
a8c2d3348e5850c274669e6fafe9c315

SHA1
932f7856dee1c323ea6a947d2bb97ef1ad7212eb

SHA256
06f5a283cebe29bcbc888a73f3055e1e16ad408bfb0c617124ea1b38774d8b83

SHA512
2bf9f7b439f14bf4ce7a18f7b6b74a526a3cf3dd6d90c89611a4285c9ff11fb033b4b03af9f311b0cadf090d448d3c36b1549799c8de27e3adeabd6afb99f900

Download Submit
C:\Windows\SysWOW64\Gfembo32.exe

Filesize
96KB

MD5
f447e31697c98fbbda7119a989e56e7d

SHA1
a1c47e29df0889415ffa09a10d2a5ed6a2b919ac

SHA256
512a8d755d1c890048883b167f2cb052c09a89777a2f0382e678c7106547e0d0

SHA512
6a8e08e7ed98a7e1654a66cc1cad1183f7467d1a1b1f007f949d716b89b889a023cbb6eb8119e7cd2e9f1263f4789cb9724623f63ba277129dddb5d834980814

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
96KB

MD5
7a1021113547770f826fe7238dc47b51

SHA1
d5564c63b75ca55f52aa39e46162e1adce7a8428

SHA256
1db5118e342c297e4f5ecdcc838add5e0cddd892420ca8e25ae7b89731200374

SHA512
03688978a10442969619d3b13136764bbefa4282f7eb33308ba50cfe3fb2d70e7c5ca4517a42f27474f24704de318da1fbef3c39e688c4549153e5a7e73261ab

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
96KB

MD5
225d3df9a8a0b4e406a9f7572894f963

SHA1
469d06103ecb5f70853fe6d0c48141bddfbc53b6

SHA256
b2ea03b7f321c342d2ecfbda639e3cd66ff982b80fb38e01aa72a41d7fb4a85f

SHA512
55d2763114db519a8a92bd44d5614737ef1a91ae7a81e50d1747abc93eb3c0ca548cab9dbbd1005e28af3132c7098ef3688cb52af2a536ad3554022ac8f996fb

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
96KB

MD5
cd79c274bdb3407e5546deadb6fffca8

SHA1
a701fa6991db59af3448cb4787abfb0f2f136a1e

SHA256
5d577ff15288ed5ae9a448b6d658783a65b8031c49fab97ce0e4728bac57c25f

SHA512
7eb719da776f3acc64ea5a043915279fa0dd7128823b21d4e46efd5437f3b02d314ca2387270fee1a932236cb79252e7d47e67b1802d2713f196441168303de1

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
96KB

MD5
85e1797a9629701b4276f79a42ce2443

SHA1
f51cf8462416d4e718f9481ef6d50e9bcf6b509c

SHA256
d327a253d7e4ae3ee46f98c4f9d89babf60122bbc254c13c54d5bdb29108f209

SHA512
2cabb74705ebd0ec51462f327eba66c7ecdddaac771f622368eb08fa08e384ece8e20ac9f0d55d9977e2ffa7fd7c155db301651ba8545bf8b31454de02a2080e

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
96KB

MD5
e3e8cb8445b9820a34e9f909399c8f4f

SHA1
8e9293941e7ac142c5b3585e05462d1359ff4057

SHA256
f0eadccb30328e00a02b117ea2464da941cf106ce7eac5d1ef8b3f8fd4ae19d5

SHA512
2cbbe7339e04c663208c04713943c87f13682e8c4fb59f24316929f35604162a30eafb1c2a271266cb272aa1ea09ff02a18138a52102b7dad5ee7d5a551a18d2

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
96KB

MD5
41a8786cd2ccf07a4d1757ff34d7e51d

SHA1
d4b6b1a919c11a1fe34e98a939ff0f6dc473514d

SHA256
85bc9215fac4b1a7225216d10af6f756d45fdc42a76ebf49a786d0d3fc0f574b

SHA512
bf7b47f63db38748c24c242342930eff457f574b44036e044146c3d006ecdfbe74272c5e369a3d74b4cde771cd3907520bade24b646a31d80374c2342528cf3a

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
96KB

MD5
6d9a676bb0865321e740ef825fdc5046

SHA1
0b89ade6d848890f53f61469625bffbe325f9c72

SHA256
d732874b0247ee8718cf571c7bc74406d8b33688b81ff08e0ac6ab6863dd52bc

SHA512
d1ddb037a991b58a0e9684e6fc36edf6aec9181b5ab0a1cde131513fc693a230b6fe1097ed266658c78f895f8609991f0c12e805681e63889bd33845af76a7ea

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
96KB

MD5
664ffc4c5af022380524fb67e18b0ff0

SHA1
3956dc2593b71cd9c2f5fc4ceb1573c04b40157e

SHA256
0391668912bf542fa0b828749c7bc8408fcfcdc0356690ac6a009d784ebed486

SHA512
8309624b3c2d85b64c4465bcb10b5c5b723ce080b434605495faaaad0a583abd9dfad1ef19135cfc1a2e377513cc7f0af9a1305e4cdf38fc77e3f3e69f28d1ec

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
96KB

MD5
63c85b44593290666440a56bc53cff6c

SHA1
8ac59b30a224af0054e639ea14fc625b0616e04d

SHA256
d61e5d9ea1b9cfbd0ac1bfc11f1153e90c3dd06d5538bb2bafdeda182e0bc754

SHA512
9a65e3ac5f83aebe49f38e0456dface29ef7edb364ee5f53c46fc37b19eb44b756df18c2864115e39905cd776cd3361033f8e0bd8023c6879aa827ce9bdb8675

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
96KB

MD5
16991869339d730cdf81816a8dd891f7

SHA1
a9151c0441bc33c90c248829a851f00d773c32a3

SHA256
fbc9a6447355194fc6c0fa2a3ffd9883a8e77a6dc10ca5c4264255ad6732606b

SHA512
715ebb8b009d8b63ee38fe1569d6a9db5e0e01e558c285fee988c07cc21d328d79640fa6d88db1196389b3f01c001ade88b66729d9aec545cc045c361f687174

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
96KB

MD5
b2f4d4f4f7abf723325b5598d115e16f

SHA1
6300c04ef7d5f4fe018ed8c40828b2fd9f04f4c0

SHA256
83fd0329481d1a0a3260ed62d886e3826ebb7dfe431a38bf2bdd5af4ccc2b64e

SHA512
4d684909363ff2193c3d45c6eec2a5df44a5e89bdebcadc2a1fa510de7b7589088b3479facec850c3a222a36957d4ef289da4616da140e634289e11b2ab4f080

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
96KB

MD5
cee7f290d40ac87fbfb0d11c747b23a6

SHA1
9b65d76de1d4436354d09ca15357350358714c8d

SHA256
22a92a1f14b3749f8ffee87fc0835d515b85a662354503fcbec585c154febf9c

SHA512
b8cb2772f3fc37c71b852ef90c46a367820cb59b928ff4e39bf245055090ca71b90576c393f34cc09119ee3b2825cb259ef4fd06e93840f096b427dca3aedab7

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
96KB

MD5
b3fd1f81f7ba7ef73feb55080f41dc8d

SHA1
70761ac8956cf5083a21d0b667f1c70575aba3c9

SHA256
479d01651c0ed525884c2ac1b5e904f25ef4965fdb2c02bf3556397375c1ed24

SHA512
27372e954675fca14ab25ff138311e746381a9c1ba9b94aeb9da3333064fbbb6b6de4f15559b60d01933fa44fe1f0d91b5aabaa73547694961c690a85f4127c0

Download Submit
C:\Windows\SysWOW64\Imfdff32.exe

Filesize
96KB

MD5
0dba3519159d452baf34e700c7573b3c

SHA1
8b840db23cb5990a070090f344b9359fe92d5ebe

SHA256
cee9ed595e127bb3a9c69e230575405e8faefe4474e21494d801e4239ca5b9a0

SHA512
899e1e3c3fb5254d169816cbd6153d25de8974b7c9f732e2af28a13f989b225831d04e3db8d0ecaf963d378d2a9121b1eecddd7c2255150e60e22c664df63f63

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
96KB

MD5
1d4a70ad2462bda64add4da0000844d2

SHA1
32e12bcd97de3498dbeabe28e0c1df584e201d76

SHA256
9330278711ba81badde72164b9d59c49a0297536df17b7e8b9556b47faf18fa1

SHA512
226ac77073fe7030deee16f59689ac003b738704917ab3af3d745d751e1f2a667eed29f6c42cbddabf2636e6ff6bb0f6fe3fc9a67ca8e6e329078a43710287d8

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
96KB

MD5
0a2de87ffb2011e4b4359a290a157354

SHA1
9f466250c7af2340ae84cc6e6382edc7ea699d96

SHA256
8ab57ea9531ae4e02fc45cccb8fb142b3fe646d2b3d4c6c5c91feb97ffcd3272

SHA512
8a9ca25081b2dc9f1637ea0407a30f860a6f16f604dd23b86bf1bc3a9206c77d4de9f509216ca2109dcc9dc45b4a3a6491f2fbe8fbada5162e60ce46dced8e28

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
96KB

MD5
77b905f43501c7a9eb56dd3ed3f0c850

SHA1
f0fbcc81b5234b065456081cfa2fab5cd5737577

SHA256
0dc120af608d5a17479049707c53c1ee69ca375c8d481942ca59465493e7c192

SHA512
76ce025a9b027375241d56f887fb22fe1289dc6c876cf7baa5f227cc4e95cb531e332868848f13d9a56879d88334c910c5061a7b52d00cba7a04b9bbc054065f

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
96KB

MD5
87b48174322fd9321752ed733fb57ec9

SHA1
6c600a5c7bfcca6b619dd88cf52af8243354dab6

SHA256
a5d62b898e55bf12c6262caa0bab553ff83dc75630cc9b7425e5e78e937d5f4b

SHA512
bb833139d2da50309106a1c6afdaef7e8e648c3dd5ad13c5a76e4149eb35f1798ae9b8f61a12f92ea5b9d8063afd88961028a504b9645b7e4df321e2e33afb75

Download Submit
C:\Windows\SysWOW64\Ligqhc32.exe

Filesize
96KB

MD5
41372039736d128ef5508f402be3a5e3

SHA1
f4e233b792f07e2b49baaf1c530180cf64c410d1

SHA256
3be9254888cfd933f383ed72c7fdb4b8639d6a9dc483540d5407f0c67690e787

SHA512
2caaada406c6ec37e9c6ab04811c0261655ca1587039159e8d4417b4d7373a69981cae308930ee23559a796f605383628f2dad5423a52a37b3dad6825fb0d221

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
96KB

MD5
2422e3f84b38332fd645b3ae12a341c3

SHA1
8f6a4c19f1c7670d0576606b1127601fcf115c5d

SHA256
53d26512f9b3f81a9fe25eea04e8b74d346934c5246fab45e5c49d54a2ce0bbc

SHA512
b85171e329c12bd2ca32c0de3a3e66bf377962bcc280df5e4ae361c80f8c2dd148b3d4a3f13a5c04d734b278f9180c9e8dc5d2a1d3efb31d410ec18503aa317b

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
96KB

MD5
34768d49977693867939674078d338ff

SHA1
8658c3d5e4a2cb8f564171b9c25aac76ecec6e83

SHA256
ea3e671730978dad87eb4df6416141ecab2103fa25cbcc467e6315275d34813c

SHA512
1fecb8d52a94f054ffc44c077ba87908c2b30e0183e195f3cc9db799e96039479476485b983aa72e5f3dce8d65dfe070c249032af80c2a14a2e19f7c9e5d083b

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
96KB

MD5
cbe34e9f274530cc463a7e5a80430555

SHA1
3594d9aae358c59acec841535e131dd9d2e14e39

SHA256
4d073823f9e499c908874d244f52f0f47fbdecb18f97b2a71d7bff26a1c704a4

SHA512
7306e1a8a1fc4a37393fd3e7ce851857e14a1c44312a8915d0dfbdcd98359d697826d0b74d18720a3b4d79f023f776a4fdc93100b764ae73ea7655cf76721a79

Download Submit
C:\Windows\SysWOW64\Ocgmpccl.exe

Filesize
96KB

MD5
51fa82aaf94e774bdb3ca966c6a6b503

SHA1
ab2f37ed44637e2ab324969547bd6488c474a1b4

SHA256
8f2d69359366c799bbfd6ce6f637a74cd888709d964498db3232dc66b5c53a89

SHA512
acb77dc24ced1cad222bbe64e999524f9896c410073d0627c6f6e5ebb18ce5797ba365052a1db31938d619819ab71d0db214b07d503fb0621882dbedf2477004

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
96KB

MD5
407d7573dc9ea536e5eb3114cce528a1

SHA1
ff30b49c87e3bfa0b2bf259228cdac075b9d4b71

SHA256
2ab7b7107d942f7f3ed9590c920b2ed723e44097f41d0ba661f5c843652f990b

SHA512
da1823c1c5650dbee2edd34bdc0ef4ffbbe9e4d5315ba5004aa156b1a2a8c46b662273d55042802a313dc6abff29214463200d633fd2bedba47a76449f5d5f66

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
96KB

MD5
a253a799e90f281280e8f66d4d1c17c7

SHA1
8327e64a493d26b027b4a7c99a6f8d50aac1e270

SHA256
204e073d447a122e1635c3bb5ca231ce50f7a7e37a02a2f48eaca7105fb727ff

SHA512
d54d60110a2ce59e67d0da6fa7c2e4c93cd6012acf18c33d1c7cba4de32b0f55d35614126709a4c302e18f50f0b722598ffc028a4bfa5d24222119344ab9bf2f

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
96KB

MD5
816fb2edfebd901ca534a7c958a386f8

SHA1
246efa9f008bd84c093827c387594497b355e2c9

SHA256
b9a344a7014a45db4840bbcf439adaa2d2e2f21adaf7b2efa94f5de51c2dfcc2

SHA512
3be834a407f7dee27bf925655813a30785a45aef04270362c0acf9ab28901cd255bb4efb3a704c1a750bd27050d25e5ba17f62dffc98bbf24ad72ad4c59da725

Download Submit
memory/424-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/436-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/436-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/852-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/976-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1004-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1040-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1136-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1136-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-500-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1372-410-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1588-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1608-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1632-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1640-532-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1768-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1820-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1820-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1880-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1956-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1992-531-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2168-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2252-570-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2396-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2716-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2760-460-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2768-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2892-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2996-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3056-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3212-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3368-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3376-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3460-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3492-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3520-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3520-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3620-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3732-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4008-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4032-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4044-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4084-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4144-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4196-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4340-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4416-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4580-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4692-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4708-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4712-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4748-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4748-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4772-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4804-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4836-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4948-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4964-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5016-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5108-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5128-573-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5184-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5232-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5280-594-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads