e8fd6ceb3722aaa9feb9fd0bbfbd4de087a517793e7564e747f1dbd870e79af1

Analysis

max time kernel
115s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee8317af5beb91a96a8d89059c084470N.exe
Size

125KB
MD5

ee8317af5beb91a96a8d89059c084470
SHA1

4519111e5a9de654b91302d624fdc83873cc8a63
SHA256

e8fd6ceb3722aaa9feb9fd0bbfbd4de087a517793e7564e747f1dbd870e79af1
SHA512

0be3bdf405f5f400ed6b89ffbd453fd86f66165cecde193a6e625a7fa63a519c5c7ffc3b75f10802a23239322f08bfcc31d75b76bd6ce8d9ca2b04795795a8b9
SSDEEP

3072:kgEH+s4OUKk26cR1WdTCn93OGey/ZhJakrPF:JEHQO3kvc6TCndOGeKTaG

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpcdfll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlidpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbgfhnhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcbeqaia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oooaah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bikeni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilhkigcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bblcfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cemeoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hegmlnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iaedanal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jogqlpde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clijablo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpgjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leoejh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Khkdad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfiagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aiabhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbgfhnhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llngbabj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggjjlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hnpaec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iloajfml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkcmjlio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nhlfoodc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okmpqjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmagch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffkhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhoeef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amoknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bppcpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkgmoncl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnjecfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbdgec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddqbbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Heepfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjaioe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amoknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhlfoodc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcncodki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmddihfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdqcenmg.exe

Executes dropped EXE 64 IoCs

pid	Process
1084	Ggjjlk32.exe
1748	Gjhfif32.exe
1712	Gcqjal32.exe
516	Gbbkocid.exe
2460	Hepgkohh.exe
3676	Hgocgjgk.exe
3972	Hkjohi32.exe
3264	Hbdgec32.exe
2452	Hebcao32.exe
2424	Heepfn32.exe
2104	Hjaioe32.exe
3144	Hegmlnbp.exe
812	Hcjmhk32.exe
3636	Hnpaec32.exe
1308	Hkcbnh32.exe
4824	Ielfgmnj.exe
2612	Ilfodgeg.exe
1828	Ibpgqa32.exe
4872	Iabglnco.exe
1880	Ilhkigcd.exe
4336	Iaedanal.exe
680	Iholohii.exe
4188	Ijmhkchl.exe
1556	Iecmhlhb.exe
3936	Ilmedf32.exe
232	Ibgmaqfl.exe
5024	Iloajfml.exe
1900	Jaljbmkd.exe
5008	Jehfcl32.exe
3772	Jlanpfkj.exe
3216	Jjdokb32.exe
4288	Jhhodg32.exe
632	Jldkeeig.exe
2040	Jnbgaa32.exe
4592	Jhkljfok.exe
4340	Jjihfbno.exe
4868	Jacpcl32.exe
4312	Jeolckne.exe
1104	Jlidpe32.exe
1348	Jogqlpde.exe
692	Jeaiij32.exe
3804	Jhoeef32.exe
3060	Koimbpbc.exe
3536	Keceoj32.exe
2232	Klmnkdal.exe
4796	Koljgppp.exe
3220	Kbgfhnhi.exe
3196	Klpjad32.exe
3532	Kongmo32.exe
3140	Kehojiej.exe
400	Kkegbpca.exe
1264	Kaopoj32.exe
3416	Khihld32.exe
4328	Klddlckd.exe
1516	Kbnlim32.exe
3300	Khkdad32.exe
4828	Loemnnhe.exe
2692	Leoejh32.exe
3100	Llimgb32.exe
4436	Lbcedmnl.exe
3232	Lhpnlclc.exe
3004	Llkjmb32.exe
5140	Lbebilli.exe
5172	Ledoegkm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dbkhnk32.exe	Defheg32.exe
File created	C:\Windows\SysWOW64\Jacpcl32.exe	Jjihfbno.exe
File created	C:\Windows\SysWOW64\Ehilac32.dll	Kaopoj32.exe
File opened for modification	C:\Windows\SysWOW64\Lhdggb32.exe	Lefkkg32.exe
File opened for modification	C:\Windows\SysWOW64\Mahklf32.exe	Mojopk32.exe
File created	C:\Windows\SysWOW64\Ammnhilb.exe	Aiabhj32.exe
File created	C:\Windows\SysWOW64\Koljgppp.exe	Klmnkdal.exe
File created	C:\Windows\SysWOW64\Bcbeqaia.exe	Bpgjpb32.exe
File created	C:\Windows\SysWOW64\Cdjlap32.exe	Cpnpqakp.exe
File created	C:\Windows\SysWOW64\Cpcila32.exe	Clgmkbna.exe
File created	C:\Windows\SysWOW64\Gpngef32.dll	Ddqbbo32.exe
File opened for modification	C:\Windows\SysWOW64\Pofhbgmn.exe	Pkklbh32.exe
File created	C:\Windows\SysWOW64\Qejfkmem.exe	Pbljoafi.exe
File opened for modification	C:\Windows\SysWOW64\Aealll32.exe	Afnlpohj.exe
File created	C:\Windows\SysWOW64\Hlnecf32.dll	Ilhkigcd.exe
File opened for modification	C:\Windows\SysWOW64\Lhpnlclc.exe	Lbcedmnl.exe
File created	C:\Windows\SysWOW64\Ngkpgkbd.dll	Nkeipk32.exe
File created	C:\Windows\SysWOW64\Mejcig32.dll	Ndpjnq32.exe
File created	C:\Windows\SysWOW64\Oooaah32.exe	Omaeem32.exe
File opened for modification	C:\Windows\SysWOW64\Apimodmh.exe	Aioebj32.exe
File opened for modification	C:\Windows\SysWOW64\Bblcfo32.exe	Apngjd32.exe
File created	C:\Windows\SysWOW64\Cefoni32.exe	Cfcoblfb.exe
File created	C:\Windows\SysWOW64\Mjfkgg32.dll	Jaljbmkd.exe
File created	C:\Windows\SysWOW64\Loemnnhe.exe	Khkdad32.exe
File created	C:\Windows\SysWOW64\Ichnpf32.dll	Loemnnhe.exe
File opened for modification	C:\Windows\SysWOW64\Aioebj32.exe	Aecialmb.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Eilbckfb.dll	Khkdad32.exe
File created	C:\Windows\SysWOW64\Okcfidmn.dll	Nfknmd32.exe
File created	C:\Windows\SysWOW64\Omcbkl32.exe	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Hepgkohh.exe	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Odehaccj.dll	Klddlckd.exe
File created	C:\Windows\SysWOW64\Ohbikenl.dll	Obpkcc32.exe
File created	C:\Windows\SysWOW64\Qbngeadf.exe	Qckfid32.exe
File created	C:\Windows\SysWOW64\Ibnoch32.dll	Blnjecfl.exe
File created	C:\Windows\SysWOW64\Pkjdhm32.dll	Aecialmb.exe
File created	C:\Windows\SysWOW64\Cbaehl32.exe	Cpcila32.exe
File opened for modification	C:\Windows\SysWOW64\Nkhfek32.exe	Nhjjip32.exe
File created	C:\Windows\SysWOW64\Okmpqjad.exe	Ohncdobq.exe
File opened for modification	C:\Windows\SysWOW64\Oloipmfd.exe	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Pfppoa32.exe	Pofhbgmn.exe
File created	C:\Windows\SysWOW64\Alkeifga.exe	Aealll32.exe
File created	C:\Windows\SysWOW64\Ggghajap.dll	Gbbkocid.exe
File opened for modification	C:\Windows\SysWOW64\Jogqlpde.exe	Jlidpe32.exe
File created	C:\Windows\SysWOW64\Mkepineo.exe	Lehhqg32.exe
File created	C:\Windows\SysWOW64\Codncb32.dll	Nofoki32.exe
File created	C:\Windows\SysWOW64\Pgoikbje.dll	Oloipmfd.exe
File created	C:\Windows\SysWOW64\Obidcdfo.exe	Ookhfigk.exe
File created	C:\Windows\SysWOW64\Ofijnbkb.exe	Oooaah32.exe
File opened for modification	C:\Windows\SysWOW64\Gjhfif32.exe	Ggjjlk32.exe
File created	C:\Windows\SysWOW64\Hebcao32.exe	Hbdgec32.exe
File created	C:\Windows\SysWOW64\Dmehgibj.dll	Ilmedf32.exe
File opened for modification	C:\Windows\SysWOW64\Jhkljfok.exe	Jnbgaa32.exe
File opened for modification	C:\Windows\SysWOW64\Nhjjip32.exe	Nfknmd32.exe
File opened for modification	C:\Windows\SysWOW64\Mclhjkfa.exe	Mkepineo.exe
File created	C:\Windows\SysWOW64\Bcpika32.exe	Bpemkcck.exe
File created	C:\Windows\SysWOW64\Ggjjlk32.exe	ee8317af5beb91a96a8d89059c084470N.exe
File created	C:\Windows\SysWOW64\Clhgbgki.dll	ee8317af5beb91a96a8d89059c084470N.exe
File created	C:\Windows\SysWOW64\Kjekja32.dll	Hepgkohh.exe
File created	C:\Windows\SysWOW64\Klmnkdal.exe	Keceoj32.exe
File opened for modification	C:\Windows\SysWOW64\Khihld32.exe	Kaopoj32.exe
File created	C:\Windows\SysWOW64\Ndidna32.exe	Nchhfild.exe
File created	C:\Windows\SysWOW64\Cfcoblfb.exe	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Ncjdki32.exe	Nkcmjlio.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7932	7788	WerFault.exe	301

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aehbmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nconfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohncdobq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflfdbip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhoeef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obpkcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbljoafi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpgjpb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iaedanal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ijmhkchl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlidpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jacpcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kaopoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llngbabj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncjdki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdqcenmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cekhihig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iecmhlhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mccokj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfppoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookhfigk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gjhfif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhdggb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bifkcioc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjlap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmagch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cemeoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bimach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbbgicnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amoknh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcpika32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oooaah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akihcfid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hjaioe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbbnbemf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndpjnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nchhfild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khkdad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ledoegkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mahklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhhodg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcabej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omaeem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qbngeadf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apngjd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooangh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbimjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qejfkmem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ohhfknjf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbbkocid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jehfcl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clpgkcdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iabglnco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedbhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcila32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkogqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcjmhk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhpnlclc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkcccn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpiidi32.dll"	Bifkcioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqfaoo32.dll"	Cmpcdfll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpmmbfem.dll"	Ibgmaqfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klmnkdal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfooh32.dll"	Llkjmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbgabh32.dll"	Mebkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfdgep32.dll"	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldhopqko.dll"	Bikeni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jacpcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Koimbpbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idjcam32.dll"	Lhpnlclc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpngef32.dll"	Ddqbbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nhlfoodc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hepgkohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iloajfml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcabej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mekdffee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibinlbli.dll"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbhbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ompbfo32.dll"	Hnpaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klddlckd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoggpbpn.dll"	Mekdffee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codncb32.dll"	Nofoki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daliqjnc.dll"	Pbimjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqkbjk32.dll"	Amfhgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gjhfif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaohckm.dll"	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlbngnmk.dll"	Jnbgaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kehojiej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfcoblfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcqjal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iecmhlhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jldkeeig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amkejmgc.dll"	Cekhihig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hebcao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ohqpjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbljoafi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nbbnbemf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qkfkng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfabmmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bedbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbpfi32.dll"	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhejfl32.dll"	Mkocol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nconfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiagoigj.dll"	Cpnpqakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aknmjgje.dll"	Akihcfid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idhdlmdd.dll"	Lbcedmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eknanh32.dll"	Nhjjip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pgoikbje.dll"	Oloipmfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clijablo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odjmdocp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbljoafi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clpgkcdj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1084	4956	ee8317af5beb91a96a8d89059c084470N.exe	91
PID 4956 wrote to memory of 1084	4956	ee8317af5beb91a96a8d89059c084470N.exe	91
PID 4956 wrote to memory of 1084	4956	ee8317af5beb91a96a8d89059c084470N.exe	91
PID 1084 wrote to memory of 1748	1084	Ggjjlk32.exe	92
PID 1084 wrote to memory of 1748	1084	Ggjjlk32.exe	92
PID 1084 wrote to memory of 1748	1084	Ggjjlk32.exe	92
PID 1748 wrote to memory of 1712	1748	Gjhfif32.exe	93
PID 1748 wrote to memory of 1712	1748	Gjhfif32.exe	93
PID 1748 wrote to memory of 1712	1748	Gjhfif32.exe	93
PID 1712 wrote to memory of 516	1712	Gcqjal32.exe	94
PID 1712 wrote to memory of 516	1712	Gcqjal32.exe	94
PID 1712 wrote to memory of 516	1712	Gcqjal32.exe	94
PID 516 wrote to memory of 2460	516	Gbbkocid.exe	95
PID 516 wrote to memory of 2460	516	Gbbkocid.exe	95
PID 516 wrote to memory of 2460	516	Gbbkocid.exe	95
PID 2460 wrote to memory of 3676	2460	Hepgkohh.exe	96
PID 2460 wrote to memory of 3676	2460	Hepgkohh.exe	96
PID 2460 wrote to memory of 3676	2460	Hepgkohh.exe	96
PID 3676 wrote to memory of 3972	3676	Hgocgjgk.exe	97
PID 3676 wrote to memory of 3972	3676	Hgocgjgk.exe	97
PID 3676 wrote to memory of 3972	3676	Hgocgjgk.exe	97
PID 3972 wrote to memory of 3264	3972	Hkjohi32.exe	98
PID 3972 wrote to memory of 3264	3972	Hkjohi32.exe	98
PID 3972 wrote to memory of 3264	3972	Hkjohi32.exe	98
PID 3264 wrote to memory of 2452	3264	Hbdgec32.exe	99
PID 3264 wrote to memory of 2452	3264	Hbdgec32.exe	99
PID 3264 wrote to memory of 2452	3264	Hbdgec32.exe	99
PID 2452 wrote to memory of 2424	2452	Hebcao32.exe	101
PID 2452 wrote to memory of 2424	2452	Hebcao32.exe	101
PID 2452 wrote to memory of 2424	2452	Hebcao32.exe	101
PID 2424 wrote to memory of 2104	2424	Heepfn32.exe	102
PID 2424 wrote to memory of 2104	2424	Heepfn32.exe	102
PID 2424 wrote to memory of 2104	2424	Heepfn32.exe	102
PID 2104 wrote to memory of 3144	2104	Hjaioe32.exe	103
PID 2104 wrote to memory of 3144	2104	Hjaioe32.exe	103
PID 2104 wrote to memory of 3144	2104	Hjaioe32.exe	103
PID 3144 wrote to memory of 812	3144	Hegmlnbp.exe	104
PID 3144 wrote to memory of 812	3144	Hegmlnbp.exe	104
PID 3144 wrote to memory of 812	3144	Hegmlnbp.exe	104
PID 812 wrote to memory of 3636	812	Hcjmhk32.exe	105
PID 812 wrote to memory of 3636	812	Hcjmhk32.exe	105
PID 812 wrote to memory of 3636	812	Hcjmhk32.exe	105
PID 3636 wrote to memory of 1308	3636	Hnpaec32.exe	107
PID 3636 wrote to memory of 1308	3636	Hnpaec32.exe	107
PID 3636 wrote to memory of 1308	3636	Hnpaec32.exe	107
PID 1308 wrote to memory of 4824	1308	Hkcbnh32.exe	108
PID 1308 wrote to memory of 4824	1308	Hkcbnh32.exe	108
PID 1308 wrote to memory of 4824	1308	Hkcbnh32.exe	108
PID 4824 wrote to memory of 2612	4824	Ielfgmnj.exe	109
PID 4824 wrote to memory of 2612	4824	Ielfgmnj.exe	109
PID 4824 wrote to memory of 2612	4824	Ielfgmnj.exe	109
PID 2612 wrote to memory of 1828	2612	Ilfodgeg.exe	110
PID 2612 wrote to memory of 1828	2612	Ilfodgeg.exe	110
PID 2612 wrote to memory of 1828	2612	Ilfodgeg.exe	110
PID 1828 wrote to memory of 4872	1828	Ibpgqa32.exe	111
PID 1828 wrote to memory of 4872	1828	Ibpgqa32.exe	111
PID 1828 wrote to memory of 4872	1828	Ibpgqa32.exe	111
PID 4872 wrote to memory of 1880	4872	Iabglnco.exe	112
PID 4872 wrote to memory of 1880	4872	Iabglnco.exe	112
PID 4872 wrote to memory of 1880	4872	Iabglnco.exe	112
PID 1880 wrote to memory of 4336	1880	Ilhkigcd.exe	113
PID 1880 wrote to memory of 4336	1880	Ilhkigcd.exe	113
PID 1880 wrote to memory of 4336	1880	Ilhkigcd.exe	113
PID 4336 wrote to memory of 680	4336	Iaedanal.exe	114

C:\Users\Admin\AppData\Local\Temp\ee8317af5beb91a96a8d89059c084470N.exe
"C:\Users\Admin\AppData\Local\Temp\ee8317af5beb91a96a8d89059c084470N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\Ggjjlk32.exe
  C:\Windows\system32\Ggjjlk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\Gjhfif32.exe
    C:\Windows\system32\Gjhfif32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\SysWOW64\Gcqjal32.exe
      C:\Windows\system32\Gcqjal32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:516
      - C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Hkjohi32.exe
        
        C:\Windows\system32\Hkjohi32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3636
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        23⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3936
        
        C:\Windows\SysWOW64\Ibgmaqfl.exe
        
        C:\Windows\system32\Ibgmaqfl.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Iloajfml.exe
        
        C:\Windows\system32\Iloajfml.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Jehfcl32.exe
        
        C:\Windows\system32\Jehfcl32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        31⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        32⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4288
        
        C:\Windows\SysWOW64\Jldkeeig.exe
        
        C:\Windows\system32\Jldkeeig.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:632
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        36⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        39⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        42⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\SysWOW64\Koimbpbc.exe
        
        C:\Windows\system32\Koimbpbc.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3536
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        47⤵
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        49⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        50⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Kkegbpca.exe
        
        C:\Windows\system32\Kkegbpca.exe
        52⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1264
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        54⤵
        Executes dropped EXE
        
        PID:3416
        
        C:\Windows\SysWOW64\Klddlckd.exe
        
        C:\Windows\system32\Klddlckd.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4328
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        56⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4828
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        60⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Lbcedmnl.exe
        
        C:\Windows\system32\Lbcedmnl.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3232
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5140
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        67⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        68⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        70⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        72⤵
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        73⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        74⤵
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        76⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        77⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        79⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        81⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        82⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        83⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        86⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        90⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        92⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        95⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        98⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        100⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        102⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        103⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        104⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        106⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        107⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        108⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        109⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        112⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        113⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        116⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        117⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        118⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Pofhbgmn.exe
        
        C:\Windows\system32\Pofhbgmn.exe
        126⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Pfppoa32.exe
        
        C:\Windows\system32\Pfppoa32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        128⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        130⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        131⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        133⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        135⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        136⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        138⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        140⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        141⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        143⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        144⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        145⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        146⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        147⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        148⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        149⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Afceko32.exe
        
        C:\Windows\system32\Afceko32.exe
        150⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        153⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Bifkcioc.exe
        
        C:\Windows\system32\Bifkcioc.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        163⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        164⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        166⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        172⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Blnjecfl.exe
        
        C:\Windows\system32\Blnjecfl.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        176⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Cfcoblfb.exe
        
        C:\Windows\system32\Cfcoblfb.exe
        177⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        178⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        179⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        180⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        183⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        187⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        188⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7960
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        191⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        192⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        193⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8176
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7196
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        197⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        199⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        200⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        202⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7716
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 412
        204⤵
        Program crash
        
        PID:7932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3852,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7788 -ip 7788
1⤵
PID:7892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bblcfo32.exe

Filesize
125KB

MD5
2da63a2a710ecef3a6df986d2f74c567

SHA1
294db46270a1dd270a8c23ef1324997bc328f5af

SHA256
9078e70362519340dcc5d3093cf92aee41898d41eb8e8849138ef76cd638c385

SHA512
f40750749bc7f54fbd3df17ef2e3097821e54515783fbcc2fe57affd47030cdd7c4ef99f793ce1ddc1e912781b9a2721e8f209c06ee5ae65cbf8c289b5c4b992

Download Submit
C:\Windows\SysWOW64\Bmddihfj.exe

Filesize
125KB

MD5
b46aa59967ae8f1472ba64fa6f27fb30

SHA1
8ea3d3e5b724c1b6ae2971194c5e10e31dcb3d4a

SHA256
fa12f31a03bda2bc807842776f37a160f6264c9622fd16166c889281aa5288e7

SHA512
2f58e4379058712d4c063ff7498e51ce7bf8b3be5d781f69ca85ad2d3848ce8eff9e29ad989045ba1f466a93e0e528a39e591dc66cfaef4075c00324f38651e0

Download Submit
C:\Windows\SysWOW64\Cmgjee32.exe

Filesize
125KB

MD5
7d9b0babe9809cebcda890299b22f4d7

SHA1
6fb306e052483db068e9c24fd2a2de63a80b4d42

SHA256
691ad84c42bfb731eac8868e81a24ed6f037c87ff2978fd52c93a9bdc56decff

SHA512
d5ba19c4c13a721f9bc04570b80c415b50c96ad92828b3b49e00d14b5ed01a98f48578b8c347e66f350cdf877b16babce7b5eb0c0d48713f5e2e0261695c8ddb

Download Submit
C:\Windows\SysWOW64\Debnjgcp.exe

Filesize
125KB

MD5
00a9dccbcde5a6385c6c9cbdaa535016

SHA1
a2e4e88d0f24ab30b8092a52e4f229470879c049

SHA256
627e6fff70b9de11163a9c879be28634baa19947a0153383a7c2dd76de117531

SHA512
f1541b05d40dc90f4aec30fde793d84f751fd5ef813d95c8a1399b429182dbf330255ac45e34d36a4661da14b35add1fc59e3b37e890b18a1e86e208ea0c850f

Download Submit
C:\Windows\SysWOW64\Dmkcpdao.exe

Filesize
125KB

MD5
710ff4191ba2d4b1dcb5a8ed0b7969fe

SHA1
274897aa6d4df92733e1533658c8e7b608531fce

SHA256
26ed15d71272e49fee8b4ec0c3270e3fd1569c30a9ddec0d73ed25816c0b2476

SHA512
a03f1882994caa18277b203cce38b27bf52ece1c9a495746665394fea534930a5bfed616c364da7ab02567b8e90adfce1bb769ec54b47f38aa90b6c9890bdaf5

Download Submit
C:\Windows\SysWOW64\Gbbkocid.exe

Filesize
125KB

MD5
20197d7e777b986294017c2a650d36be

SHA1
2ad9cd7088d8935fe75d2d6c5a10a909d8595fe4

SHA256
1b826e8e5f6fbe12d39efbd8b197b077fa296e7f61f32143d882e4c3028579a4

SHA512
599964fdba0e713e0344516df256dded092f426a97ab3d7a49817f9de38ea5422178b27392424062f3d4d7804c46c7119c839900fa288e726431e3564624aa58

Download Submit
C:\Windows\SysWOW64\Gcqjal32.exe

Filesize
125KB

MD5
a5f82e3ab42f2ebbf82c762e384af436

SHA1
811ede8c217ec1715ec5383fbefecd2e13ffd149

SHA256
df57ba256100bf524d7971828c7aae21bae8c5b9f3b7ba5aa86c8751d3f700a1

SHA512
b9393164b2926e04eafc828d0a4cfd08fe1a01ec68c2c7f001c13fc3d597f336f5ec03c109b7eb8e4638b615e02546e12e19a73155ab59737024ee64380ef2cd

Download Submit
C:\Windows\SysWOW64\Ggghajap.dll

Filesize
7KB

MD5
66d9f0c08e42a8822ac1779f58b80b33

SHA1
6e44ffe72e940302a75dd4afb8c41f3b54a94ab8

SHA256
3a276d3d2ad4e39aa6189e3fc4334fbdd421c05529eab8a92081cb6a97f10644

SHA512
499db653ce641b77ba1b3438ec810b3efd2cb7075c57665007bfed3ce8abcbfcc2202f2bd62d4d11f65d1d9f49853841b5c30a711af00a95aece07b6ad5c9fde

Download Submit
C:\Windows\SysWOW64\Ggjjlk32.exe

Filesize
125KB

MD5
2ccdfa29a9d3c5c4eb1c725637459402

SHA1
63c65f05e639de97df5b84a363d630d7c4eb349b

SHA256
661e4b836d343b7dc1f62585092bfeec18f5d08a1558d917997b49b92c9e3829

SHA512
cc2b0a6f0dae719e442b6f119d8764f6d212f8f3a65e049350583674c055ccdff90c045228cc6d35f3d5091adb935ec6a81e6f1fc68dc426469eb1dbb74e3757

Download Submit
C:\Windows\SysWOW64\Gjhfif32.exe

Filesize
125KB

MD5
6d2fde3c163820686b0850681620b283

SHA1
43ed5f2499a7a55d1419aceab78b9c9d0562cab8

SHA256
3173733b249fbeb6ac8179c48c65daa730c2c04693f74cc78952d2038758d1e5

SHA512
56b8941b6db0226aaaa83c2ca2fb7892f3d181402c2dc63e335da36014c2c3899ef854ceacfc1f080ee624a47a02fac0b2af32c3a1a9ab890abacb73e9d0e058

Download Submit
C:\Windows\SysWOW64\Hbdgec32.exe

Filesize
125KB

MD5
4b2a7135b01ef3b3de8a9db15dc41267

SHA1
a042ae2f58161dc0a80aa0951acbfa67953f4cc2

SHA256
1875626a90218a17a27ae6a9c5d687fdb07990187f62501982bf43076e5bf411

SHA512
091185a685e7dafe2f3a4ffb46bc2d14b1959d46f4f2d28e47db94fd338e92b6ad7b595f7065a02bac37436c8d629e20a52df4a617310964db49fa9621c7d09a

Download Submit
C:\Windows\SysWOW64\Hcjmhk32.exe

Filesize
125KB

MD5
76a27093febdb3fcfd70a2602a472521

SHA1
d124e71d1e288c0e769719d3e08d635439ce3895

SHA256
052700ac500627ec643c861555b687d15d4eaef3d0979e6c68f204772abe3b7f

SHA512
ae3d87251256fa45767d1e004fe8ebd0b395f986f435cdd6ba766498c86a31fbfd1cea396fb76816ee26c58f5a9d2ffda17ba22807eded88c46918c3246abf6e

Download Submit
C:\Windows\SysWOW64\Hebcao32.exe

Filesize
125KB

MD5
5845831fa2b0171580bd2d84eb5a8d0b

SHA1
945d9254ffe8abde131c7a4a9f961dca654739d3

SHA256
d5ba8aa2965943b8fa01204fe636f17b508f51718f549149b41721ea70589c5a

SHA512
fa2eca2163adb9284af96f303c6d3c9001850bbc32da20c23b6ec2bc07d3a4e5b02a55cb4f7f905c46c435e8d196a52294d70d0a3a511eb4c6d9e6a449d8d562

Download Submit
C:\Windows\SysWOW64\Heepfn32.exe

Filesize
125KB

MD5
4534c9ce90de8091f13f3c0a168300ca

SHA1
0595981c9041a0806f1fae7bb8b4d3bdb5387e89

SHA256
99b73897f02ee062b9117d23b17e8548e95f3069150202d5622c5f9abb2d03af

SHA512
238d3ce50b924172f8ea99eee6d387d7606128aebabbfa512318f17a331764f644a0d03e3e2738880e1cbefb6a98b081a2a400173e5154dc6704685a0af38837

Download Submit
C:\Windows\SysWOW64\Hegmlnbp.exe

Filesize
125KB

MD5
9fda938e54de9a4449a72d6733ca2429

SHA1
b00b264d014957d97270d66fb3c38a5d44b6bc4f

SHA256
3d277d15234517f2d4fc6fb01b63755b11ac3860122115c729f676a63312c386

SHA512
4df1ecdee33972c0025c7d8ba49f8ba25aad5179e510e3c4333335e1394d290c34868b6057474a68c8f4938bdc74560b93ab1bb31e27221c83d3ad9bc2010bfe

Download Submit
C:\Windows\SysWOW64\Hepgkohh.exe

Filesize
125KB

MD5
78216aa0a19f1ff0ee94ca061362537b

SHA1
e930ed13d97f12c02e4ca8a2bb93132a40eaae9a

SHA256
763edd3b74cdfaf538751e4a4d7ef19cb7ed95d237b1921a43b4b314e0fb4738

SHA512
fe9ca6e386d0e41b5ca3c3ca39fd34ceb76a96bcd9531145bd86ef8012f9bb02247c731c600f4861ddd00437efb6afc1ca23c81639552748f42fe4348d0a2899

Download Submit
C:\Windows\SysWOW64\Hgocgjgk.exe

Filesize
125KB

MD5
5ef3793b15ea65104f2bbcb9238638b2

SHA1
5942850605ae07462d9efe1e506001e77b8b7bd3

SHA256
6910c9be31707b30c1c6f1d60b4d19dbbab145a985a5fff87e9d5610e03d6480

SHA512
ffea4098c80f33724fc06d6e31047fd69474157577a13287223b6bbd9c3151ab7ad175dd9330dded20141752b156792b48d68380a215c99962ef59b79a79df75

Download Submit
C:\Windows\SysWOW64\Hjaioe32.exe

Filesize
125KB

MD5
0892c809002d1cc87fd5d88a7d2a8249

SHA1
c6f7d41a2d3f1aa4745004fb9654f44dbac57a41

SHA256
4d9a410ce921e80dd7fb0c5b303d61dffe3147932359a3c04c45480710007c8a

SHA512
657785a3c797b8eedecb35597cd13f454f081c3f6d2aaa43bca9a612d5dd1695a05ff28a228e50453710b18fbf57ff7abc0d08325224c8dd381e512ca9430858

Download Submit
C:\Windows\SysWOW64\Hkcbnh32.exe

Filesize
125KB

MD5
f1220658bbc2476596941916f67e58c7

SHA1
68cf3d37be0e1e8f7d57dab115a538adf7e13fb3

SHA256
91964399c597bdb12d37284c0efa886b3b9d5e7f930ddcb78a82e465f16ddec6

SHA512
793a80a552490c37f2f45e9abf77c6b9293b23fdba2bd8fae884e579cb258e01fba962fe8d258d0dcb66af05416b8950b8af9ceea95d25d058bef0d485e38358

Download Submit
C:\Windows\SysWOW64\Hkjohi32.exe

Filesize
125KB

MD5
df9a27d8cf4d99da31563f01e32c2d99

SHA1
e410531790337e1ad191c83b9c006e06b1f99f01

SHA256
8debed76e8dbef1db4cce8ef280767038da64b405980fbf9437d42ebb39edae3

SHA512
08f8b61b6520a8e15ad9bdf5ff1ef67c95652a331fcc1fc244657a0e3f3d979bc77051697803e16e2359d0c7800c8e885b0437bc29ae9923542efaf925fd7ec9

Download Submit
C:\Windows\SysWOW64\Hnpaec32.exe

Filesize
125KB

MD5
846d8a0743e41fa40f21bfcbaca04b87

SHA1
e5a378d6eb4d2346dd6958685ead3001dbdb97b0

SHA256
29b15203aa0eb9d1b622141282eddc40d525bf5b72255c4419d0c2b4492bb039

SHA512
699266b26e70614901dc6b2c8a8472a5f6c3c804f5d7cbd50f4dee4cd0605346fb591ac73299d6e8ce2a2c19d06785981a9e5bc0f6da10a3bc913924abfc40b5

Download Submit
C:\Windows\SysWOW64\Iabglnco.exe

Filesize
125KB

MD5
b505bd1d695724b853e17a9aaca27963

SHA1
946def59a92a3f818c8a666026720fc878c8c09d

SHA256
3967d94f57f1e75fef9bf809a395fbe9ea9514e7a3d37a4c0286747bd733df8f

SHA512
6049d4342c5f21969ed0386cda3a12af3d11b9a983946e50da1e8622b88fc83d0f0cd981b263376e659393f489da24099b1b1fc5419f2666c418bf659695010a

Download Submit
C:\Windows\SysWOW64\Iaedanal.exe

Filesize
125KB

MD5
9494143b3643e811a53459388297af3a

SHA1
2bfbadf9098217f91e2547342c66f1be636de155

SHA256
3b3c8670c496fe8435f941dfc218aa18331d474e095a45185bbe4555ee6e9dc2

SHA512
907f4a5564855c76ba6b4a4d5e246b261edcc03f00783c44e924395f33b3eab54b3b5eb626925044dbe6cb2f313f549b3073daecfb3b22e23b2e6c49513da282

Download Submit
C:\Windows\SysWOW64\Ibgmaqfl.exe

Filesize
125KB

MD5
897213ebaf4ffd26098d088414a3436a

SHA1
7f693582adc6d7e54ec619c857c4bdd63214fe92

SHA256
3a1b510624fb83032241862faa7d07b78f907c3f5cc87fd922368557688f74c4

SHA512
d09ba533658262b3ba7817bed25993f78272714cd76a26c0260b1507db6045894641a0b1f7832daf49de9a8f5bba547e454c61b35f2c72ef399d4b58c955e93e

Download Submit
C:\Windows\SysWOW64\Ibpgqa32.exe

Filesize
125KB

MD5
af547991d6a113b08490caccadaf3046

SHA1
8eb242ac05dab309f8317780ede5aa511b97b802

SHA256
710c64c2bbdb1a8564181cacb32f3270bfae2cece00f616d453c026e11ec3d64

SHA512
6f46466bcdfb81412cb640479eddfa2347cea2de370df7ed00d2d5129db584f84a8c87f5603829fcc16036ef4d3f3fd59dd0f7f7e4b1dbab6ee078756f88eb7f

Download Submit
C:\Windows\SysWOW64\Iecmhlhb.exe

Filesize
125KB

MD5
c3d0075e3cd2953b6eb4d047204bdf2a

SHA1
758f8a4910fe9f74f9f43ad3fbe968f5cae39194

SHA256
02385e9d66efd16c87d3fad4f601e8dadf695b8cc4096fa7ae9ee13487d8812d

SHA512
a13feab8a2fa19b6619d9ab9493626d57cfb1ee5c2b89db00545cfe377223bdb6a34cf7c821d3036a5a1d361658e4785de5e1601b6c614eec5c781128c7c89b9

Download Submit
C:\Windows\SysWOW64\Ielfgmnj.exe

Filesize
125KB

MD5
81fb85bde54b86829167506c9552e0ef

SHA1
1b57c3a349c585e61c9ff859e93982e8526a0525

SHA256
6630460a80ebaa954d82a022ac58c6b0131cc93dc10d48c6a66a0fe797879791

SHA512
79be2432baf9f4039cd19608e55c788ef10003f6736f6e7dff4a09fce30d4b8898219020f792c710ec55a7b972120d16ec70321c74bac28fb7054925626188bb

Download Submit
C:\Windows\SysWOW64\Iholohii.exe

Filesize
125KB

MD5
84b0b9ff6a3b57aee5384446729296bf

SHA1
8408f6e43af8c1ecafe7d4d2b9455df9992f41ad

SHA256
8be380a9a4e4e73803bd8fe55c8713d033d8ae9ecf501f36f79d97a9168e2c8f

SHA512
3f9ddfb2a7845447c895630bf4f28a3af0fede2ebd7f7ca4b3f4ac256292d9294a706ebaf5607653ebef521ae03c4fa535cbb20c7f748ba414bc7fbc3a934aa3

Download Submit
C:\Windows\SysWOW64\Ijmhkchl.exe

Filesize
125KB

MD5
35a6b8e9a6b410ab7caf5d59996953db

SHA1
3653ffe5259f567c38a39457d91c859c3e67cd4b

SHA256
a0a69ccdf68f8e325bc457a51cd43fa5851952f3cc15f47004a9d1ff88d0f08d

SHA512
e516c2ae0be086e5d9c9d79feb91c3decb4b81a2300e07585e29e11c2c652924d31fa0efc86155ab0768193d40c7401e0ea94f7a70cfcd5b86d7818fd68a0822

Download Submit
C:\Windows\SysWOW64\Ilfodgeg.exe

Filesize
125KB

MD5
d7581cffbf37cbdd727753617aff0e6f

SHA1
82568fa4b33d4d85aea18aa0cb52806107b3f84d

SHA256
d460a8d8733191538d05f1716ba17e402faeaf5f0ffc6cf4ac9d282c5216d166

SHA512
e0d88e233b5e741d4672ed5b05ace989ced588b307416b6c1e907683a6fb8377d41c61a7e1f5afe41193518af93d60b38a0b55a52f69a2dfa79a66858bb3b4c4

Download Submit
C:\Windows\SysWOW64\Ilhkigcd.exe

Filesize
125KB

MD5
202ac922889c38e4dba3d6bb652e2dcf

SHA1
d6b57e3aff6e63ddb00e976682aa8184d3630e6b

SHA256
b0dad3a11d414c3f9cc76cdaf1114d4ba66c2178d59996f615958ca76f2a2d30

SHA512
b2670138c87a1ac5caf27eb01f4e386f89e17c75d53aff21f370d44ebbd963d9ccc90bbfbc945ac69281e8c24e17b8509daa85a18c49d28d30c34f3b9cddcaeb

Download Submit
C:\Windows\SysWOW64\Ilmedf32.exe

Filesize
125KB

MD5
8483a8da302fa68f2a6fc0246105809d

SHA1
d936462a7a4a57bae61e243790cb103bb73b0b2e

SHA256
142118b50ccb432f3728a5459ca2e141d15aae46eac6adc6c3add6d01ddd7e6d

SHA512
dcbec098ca6542432af921ae3247b2c399710e78900d7a3d08bb811d9769cff6318fd3854c37bf5af462d7a67de741760d9ebd569e2a99959e3bf4a306a5b3bc

Download Submit
C:\Windows\SysWOW64\Iloajfml.exe

Filesize
125KB

MD5
190409b2bd1a6b5584d1d120bf46f04f

SHA1
304efd64771020b5acd8288950973426a5b9a4b8

SHA256
dde43353f5d59d8d5d701fccc0298fc8365b3c0dfe2fd004d4ffffa511231d90

SHA512
09d04701a643b8ad832d5d5648dd0da54a2c57b9b7110c45df3935d1365093c560a5e5b178a3c520988acdb0a0bff3992432c670b0bd25e1013a857c9c656578

Download Submit
C:\Windows\SysWOW64\Jaljbmkd.exe

Filesize
125KB

MD5
e6c69de67ace8ff222e584541e129bf5

SHA1
e08a1aaa260121fc2478ea192952ca987a0db2f9

SHA256
1c7b95263845717a0669b7fff980011aa0b3115c708d7a70ccc2a13d4b2a89e9

SHA512
0ce9bfcccc32723f54f854066ee782a3a6f5911720e190344111711bab98f268eb9694513b8ef831816790dd8d89467914a7fc51ba31308ac170f92c36bfa16b

Download Submit
C:\Windows\SysWOW64\Jehfcl32.exe

Filesize
125KB

MD5
8fbf33df0eb1a46787edb57717f8e4bd

SHA1
7aa18321bc4dd0b7227c2a253b0627fc95139b14

SHA256
473f55b4968a31468612c376b7948e5df19828adca1ab35c7e48186e4c24c82e

SHA512
c804a9999d50e805de436d2dd0b700ca09a702f2d85e4d04abac4120ae7fb77f750c753434150c9e58e3d1a36d3053943a5d03e77293b4f224baabae7c6e8201

Download Submit
C:\Windows\SysWOW64\Jhhodg32.exe

Filesize
125KB

MD5
61a7443e9d5cdb0445af40fe1a3f1ce8

SHA1
1cce191bef86c95a456e64590f3da7e9cfa329fa

SHA256
d071272d7a5dc8d553821a0f8b0c649a4735ba87d51b7dcb07df99eb52d0df35

SHA512
763a51985403a18c082e29544f87dae8d86c4b90f738ccc01769b1b1f704a84257b1edb514e779229b08e5952a57ea0ed072c922102774d9070df85c07f02b09

Download Submit
C:\Windows\SysWOW64\Jjdokb32.exe

Filesize
125KB

MD5
96a4bc145fbc635e1ba8e86de61d086d

SHA1
9c8294ee6c080bbe3db9ebf435ea8a8606aa087d

SHA256
a0fd6bbb6081be210464c2f759af443df845a1dcceadb83afc1af8f9fe7a6a82

SHA512
3057713a72ecbae9361b50d0dfec0cb404a6f28caebc37443e0267f3a3872302e990b2aaf638755532aa639cd57061d2b7e7431579a1b9ddf47b9dbbc657e04c

Download Submit
C:\Windows\SysWOW64\Jlanpfkj.exe

Filesize
125KB

MD5
384c30f005f7f78fa29b56145525268a

SHA1
7128dd9dc07aed324925781337e1dbc4f9f6a2ee

SHA256
1421e953872ae092d50b0f3f6186ddf2b10c06f0e9ac308731178fdefebaa8e0

SHA512
dcdf938915d56b10d72155700074180c315c4837fac0d5fcf7f24300bac2a6ac2dffb0af9313033658ba734b8186d082a146fa9430fa5d0e5e8bd17217d7e373

Download Submit
C:\Windows\SysWOW64\Oflfdbip.exe

Filesize
125KB

MD5
5aa83497c3fcd9cab2cc17a1e04a9a23

SHA1
e6f9663ccca704a27967b1a9bafb62c35735c620

SHA256
7b515dc28a559ff784887068c0c0321f3e99a08bbcdd8c5cebc7f5bf876394dc

SHA512
17fb04a6b8f90fe7c74cad7c6172b18daba6c2a5080406309c4b08a62c4ec39de5cd046612f1fe8986a7eb2f2e684e553abfff6773c357c36506aa1bf2e07579

Download Submit
C:\Windows\SysWOW64\Okmpqjad.exe

Filesize
125KB

MD5
530842b0c7fa80d2778fe5a759c3a53e

SHA1
226ffd95aec7b131432bec998e0706bb0898f617

SHA256
c20f131aa928968fc24a8c1d248f522a799913a8d59539d8de4990eb6e7de70b

SHA512
d380dd70efec374a2ca393081232e60a17344789aafebf83ca065b1c3fda60d4f3395110b8ba29452f483c8d84b20c0540700ce3272f3258d4a03586277d5577

Download Submit
C:\Windows\SysWOW64\Qejfkmem.exe

Filesize
125KB

MD5
06098ac1e00eca817c90ecd2e89bd907

SHA1
3a9ebb28461ca7d1ee75df98aa1c77d7b78a1c39

SHA256
29c84b5928fa4e2201df5b2f45c4232e2c82baa360e7e19ee6fcf753f02f6812

SHA512
62b429460cd8481d938fe22b3ee997ab6c226af926236cdc5be05be7cfe98024450dd48781191133c2f51208a8d32469494790fd93c2c22743c7b1108f3b23c3

Download Submit
memory/232-207-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/400-370-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/516-31-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/516-572-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/632-262-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/680-175-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/692-310-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/812-104-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1084-551-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1084-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1104-298-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1264-376-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1308-120-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1348-304-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1516-394-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1556-191-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1712-565-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1712-23-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1748-558-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1748-15-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1828-144-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1880-160-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1900-229-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2040-268-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2104-87-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2232-334-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2424-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2452-71-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2460-579-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2460-40-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2612-136-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2692-412-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3004-436-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3060-322-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3100-422-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3140-364-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3144-96-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3196-352-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3216-247-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3220-346-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3232-430-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3264-599-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3264-64-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3300-400-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3416-386-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3532-358-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3536-328-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3636-111-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3676-52-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3772-244-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3804-316-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3936-204-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3972-56-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3972-592-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4188-184-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4288-260-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4312-292-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4328-388-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4336-168-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4340-280-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4436-424-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4592-277-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4796-344-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4824-128-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4828-406-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4868-286-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4872-151-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4956-544-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4956-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5008-232-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5024-216-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5128-580-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5140-446-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5172-448-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5180-586-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5256-454-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5308-597-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5312-460-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5352-466-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5400-472-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5440-478-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5480-484-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5524-490-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5568-496-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5612-502-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5652-508-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5692-519-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5724-520-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5772-526-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5812-532-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5852-538-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5892-545-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5936-552-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5980-559-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/6024-566-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/6088-573-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads