86d1323adda6c30d8ed3abcb5d4bd1760504333a5f3ed50b50779075c02a846d

Analysis

max time kernel
31s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 22:51

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

f119a5e8b067d089988fd5fd929890e0N.exe
Size

374KB
MD5

f119a5e8b067d089988fd5fd929890e0
SHA1

9243f5e063a17307365473a3641fb116d0f555e0
SHA256

86d1323adda6c30d8ed3abcb5d4bd1760504333a5f3ed50b50779075c02a846d
SHA512

42593fd610a9c6ce7dc7004787bdbaa2edf8635ec812394647ba26c626c9690c5f5184bc33830f0eac895c1c3bd194875db904ea2a7f66aff58067fab27b5a75
SSDEEP

6144:PokN1tJKrL+Eu6QnFw5+0pU8oStTf3runG/qoxfIkeI1SHkF63lngMBdkw8ZF+Y:Po+nsvE6uidyzwr6AxfLeI1Su63lgMBG

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	f119a5e8b067d089988fd5fd929890e0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	f119a5e8b067d089988fd5fd929890e0N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe

Executes dropped EXE 32 IoCs

pid	Process
816	Agoabn32.exe
1900	Bjmnoi32.exe
1316	Bmkjkd32.exe
4380	Bmngqdpj.exe
2516	Beeoaapl.exe
4792	Bffkij32.exe
1504	Bmpcfdmg.exe
1768	Bfhhoi32.exe
2440	Beihma32.exe
2004	Bfkedibe.exe
760	Belebq32.exe
1916	Cjinkg32.exe
4700	Cdabcm32.exe
4460	Cjkjpgfi.exe
532	Caebma32.exe
3608	Chokikeb.exe
1332	Cmlcbbcj.exe
1924	Cfdhkhjj.exe
5076	Cmnpgb32.exe
336	Chcddk32.exe
3156	Cffdpghg.exe
2216	Dfiafg32.exe
640	Dejacond.exe
560	Djgjlelk.exe
4292	Dmefhako.exe
2304	Ddonekbl.exe
1272	Dodbbdbb.exe
3236	Ddakjkqi.exe
928	Dhmgki32.exe
1296	Dddhpjof.exe
2072	Dgbdlf32.exe
1672	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	f119a5e8b067d089988fd5fd929890e0N.exe
File created	C:\Windows\SysWOW64\Leqcid32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Ddonekbl.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Olfdahne.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Dfiafg32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	f119a5e8b067d089988fd5fd929890e0N.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Bilonkon.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Belebq32.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Caebma32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	f119a5e8b067d089988fd5fd929890e0N.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Beeoaapl.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dejacond.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Cdabcm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	1672	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f119a5e8b067d089988fd5fd929890e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpnkaj32.dll"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	f119a5e8b067d089988fd5fd929890e0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f119a5e8b067d089988fd5fd929890e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	f119a5e8b067d089988fd5fd929890e0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmngqdpj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 816	5008	f119a5e8b067d089988fd5fd929890e0N.exe	86
PID 5008 wrote to memory of 816	5008	f119a5e8b067d089988fd5fd929890e0N.exe	86
PID 5008 wrote to memory of 816	5008	f119a5e8b067d089988fd5fd929890e0N.exe	86
PID 816 wrote to memory of 1900	816	Agoabn32.exe	87
PID 816 wrote to memory of 1900	816	Agoabn32.exe	87
PID 816 wrote to memory of 1900	816	Agoabn32.exe	87
PID 1900 wrote to memory of 1316	1900	Bjmnoi32.exe	88
PID 1900 wrote to memory of 1316	1900	Bjmnoi32.exe	88
PID 1900 wrote to memory of 1316	1900	Bjmnoi32.exe	88
PID 1316 wrote to memory of 4380	1316	Bmkjkd32.exe	89
PID 1316 wrote to memory of 4380	1316	Bmkjkd32.exe	89
PID 1316 wrote to memory of 4380	1316	Bmkjkd32.exe	89
PID 4380 wrote to memory of 2516	4380	Bmngqdpj.exe	90
PID 4380 wrote to memory of 2516	4380	Bmngqdpj.exe	90
PID 4380 wrote to memory of 2516	4380	Bmngqdpj.exe	90
PID 2516 wrote to memory of 4792	2516	Beeoaapl.exe	91
PID 2516 wrote to memory of 4792	2516	Beeoaapl.exe	91
PID 2516 wrote to memory of 4792	2516	Beeoaapl.exe	91
PID 4792 wrote to memory of 1504	4792	Bffkij32.exe	92
PID 4792 wrote to memory of 1504	4792	Bffkij32.exe	92
PID 4792 wrote to memory of 1504	4792	Bffkij32.exe	92
PID 1504 wrote to memory of 1768	1504	Bmpcfdmg.exe	93
PID 1504 wrote to memory of 1768	1504	Bmpcfdmg.exe	93
PID 1504 wrote to memory of 1768	1504	Bmpcfdmg.exe	93
PID 1768 wrote to memory of 2440	1768	Bfhhoi32.exe	94
PID 1768 wrote to memory of 2440	1768	Bfhhoi32.exe	94
PID 1768 wrote to memory of 2440	1768	Bfhhoi32.exe	94
PID 2440 wrote to memory of 2004	2440	Beihma32.exe	95
PID 2440 wrote to memory of 2004	2440	Beihma32.exe	95
PID 2440 wrote to memory of 2004	2440	Beihma32.exe	95
PID 2004 wrote to memory of 760	2004	Bfkedibe.exe	96
PID 2004 wrote to memory of 760	2004	Bfkedibe.exe	96
PID 2004 wrote to memory of 760	2004	Bfkedibe.exe	96
PID 760 wrote to memory of 1916	760	Belebq32.exe	97
PID 760 wrote to memory of 1916	760	Belebq32.exe	97
PID 760 wrote to memory of 1916	760	Belebq32.exe	97
PID 1916 wrote to memory of 4700	1916	Cjinkg32.exe	98
PID 1916 wrote to memory of 4700	1916	Cjinkg32.exe	98
PID 1916 wrote to memory of 4700	1916	Cjinkg32.exe	98
PID 4700 wrote to memory of 4460	4700	Cdabcm32.exe	99
PID 4700 wrote to memory of 4460	4700	Cdabcm32.exe	99
PID 4700 wrote to memory of 4460	4700	Cdabcm32.exe	99
PID 4460 wrote to memory of 532	4460	Cjkjpgfi.exe	100
PID 4460 wrote to memory of 532	4460	Cjkjpgfi.exe	100
PID 4460 wrote to memory of 532	4460	Cjkjpgfi.exe	100
PID 532 wrote to memory of 3608	532	Caebma32.exe	101
PID 532 wrote to memory of 3608	532	Caebma32.exe	101
PID 532 wrote to memory of 3608	532	Caebma32.exe	101
PID 3608 wrote to memory of 1332	3608	Chokikeb.exe	102
PID 3608 wrote to memory of 1332	3608	Chokikeb.exe	102
PID 3608 wrote to memory of 1332	3608	Chokikeb.exe	102
PID 1332 wrote to memory of 1924	1332	Cmlcbbcj.exe	103
PID 1332 wrote to memory of 1924	1332	Cmlcbbcj.exe	103
PID 1332 wrote to memory of 1924	1332	Cmlcbbcj.exe	103
PID 1924 wrote to memory of 5076	1924	Cfdhkhjj.exe	104
PID 1924 wrote to memory of 5076	1924	Cfdhkhjj.exe	104
PID 1924 wrote to memory of 5076	1924	Cfdhkhjj.exe	104
PID 5076 wrote to memory of 336	5076	Cmnpgb32.exe	106
PID 5076 wrote to memory of 336	5076	Cmnpgb32.exe	106
PID 5076 wrote to memory of 336	5076	Cmnpgb32.exe	106
PID 336 wrote to memory of 3156	336	Chcddk32.exe	107
PID 336 wrote to memory of 3156	336	Chcddk32.exe	107
PID 336 wrote to memory of 3156	336	Chcddk32.exe	107
PID 3156 wrote to memory of 2216	3156	Cffdpghg.exe	109

C:\Users\Admin\AppData\Local\Temp\f119a5e8b067d089988fd5fd929890e0N.exe
"C:\Users\Admin\AppData\Local\Temp\f119a5e8b067d089988fd5fd929890e0N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\Agoabn32.exe
  C:\Windows\system32\Agoabn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\Bjmnoi32.exe
    C:\Windows\system32\Bjmnoi32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\SysWOW64\Bmkjkd32.exe
      C:\Windows\system32\Bmkjkd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4380
      - C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3608
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:560
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3236
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 408
        34⤵
        Program crash
        
        PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1672 -ip 1672
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agoabn32.exe

Filesize
374KB

MD5
6e346067bc6b5219cf653400cba9099d

SHA1
8dc063a0a232bf9d25ec4991dbcb78a85237a51f

SHA256
a368317d2d0e79ed2eff7491a97110d6447c6f53acaef91d49d5dc25f89c44b4

SHA512
bf50ecd922703e0d2f5a3cd9a16f35a789849ad364cc6115e975b92f19ad115040aef248549654caa2fba5f0cbe4192b07eaf149d78a4d69ef0cd5c0764ba16c

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
374KB

MD5
6b8fca2ec084cdb5b39497423d693650

SHA1
42f3eb8c9c5f5816bb5dd57bf23ec43c99886b76

SHA256
97d01719ddb18dc43854181f3825c2eb7506f673bccaf797de8422e6994dab75

SHA512
33df00eeb6f36a0e73aaa469d8bd004a333d7cfe47942e2bfe0167cfe9b8a8cd26512a2cbc063589b9029109ee8717f5902f558ca2a1b1f78f79810d30131a5a

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
374KB

MD5
cf4c90010287161c8a99e36a6c1cf409

SHA1
0d859e3c75f3f97912aa6ea5e4cf5b661621cdbf

SHA256
abb9ce7cb1593effdf094dc5dc3d064aaac4aa4843a99994dfbff1541225d645

SHA512
f6e747431a011706c5707508793993f55d54442a65550815e7071b74c30acfd7aea879cdfa5d7b36967e7f186859128a834cbb5370d51b48414f347cb2b453a2

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
374KB

MD5
ff3c2cbe62741e01940dc49d4d60faf6

SHA1
fd5343c1b080c93a1eb3ce70aa274c1fc72995d4

SHA256
164c0eaf086192325e4be3930bdbcbe19429a5da71bf6fbbd526bf0061e735c3

SHA512
ca486000f4fb54be266c5c84d4a78f3dfa59e05ceb534580f3d3d54aa9121d2158ce458be7621b8e4d4492fabd5ce4b4df154ba0d0c8bf8112d86cf854d20fb3

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
374KB

MD5
3272bfbc750d7aa5fc7bfb034830ca5f

SHA1
67d2880652ee9350ae24f56f8da85882e068bfa6

SHA256
640e943326fbce314a4a958ceedd5b29ff7d7dd3adec27b826890699a9433466

SHA512
4bba9a176895522f19a3a86e30a33638e2b0cff5b3275b1e852dab2848ce2471912fe503cdc291a970bd8a938c2bd822481ff6b10171cf02e9c842677b978e2b

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
374KB

MD5
83e119411a3fc66892264a962afd8793

SHA1
46830830453b012d40b3fbf171d367362743615f

SHA256
303716d956ad76287ee681cd0a060892dda01070df1b7a200c5b708ab609e649

SHA512
278756c5e8fd3af62a1b6265a78757a473eaf60869d900f2036d48e2e8e7b5cc6498e07ec36d1e37115d63bdde9d3a1f6133339a3eeb780b513b83e6163bc99c

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
374KB

MD5
26f18a6fd6bbffde4401f29df6f44e22

SHA1
01817d82f530775034ce00be9ad41232ebe95e6e

SHA256
627ecad659828177c5d532df4745a4d3480abd9683111393dea1ccf1b82db685

SHA512
48b3d9f34b400f1d0b743797a3551e04c49625fd1f6e769cd9c203a18a87c0e9613091a82994f6435d3c58fc6a40ae60ac63e4406d8a6fbeddbd4dd776e535b6

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
374KB

MD5
bded56c0f227eac03957a6b2ddc4b823

SHA1
23d397da0a43c3bbcde65a371afb424d8e99e229

SHA256
7876ab6b85d84d650d725d368af02a1ce61d70a629fdcd8eb9343188f52a62da

SHA512
32d94280263a375dcb2cad5d93cda2338a49816ddb9f3bfe966c59f30abfa11c9fd85c7fcccfc27f2adbb82f1c49227949fcff5813f86d0a8b2827203dd1c76d

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
374KB

MD5
95be6fe2c29855e0824afc969b3e63c4

SHA1
b32bbb80873f02b6fc474885318b1955ff32ec87

SHA256
af248a620b4772dbfcc1af67659167135fb3f46b2ab21a1e2aa3f954880a6f73

SHA512
0cc3cb7b07012428d894a441aee6475a2d549e3de5998b22a2cdf466c5a782270f4a70ba24fa17daeada0f3f41f16eb6892acaa2942d5225483aa6ea621e545c

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
374KB

MD5
65e520d92c0e4063f1bd236c5f37ccaf

SHA1
9eae40d7ab60a3b4910cc66f7271a424c0e6ff6b

SHA256
e8f487f95ea6d055c0ecf46145a0b5e5257525cf8c3bc798ac6e4eafd2a0560a

SHA512
60cc2c092553b3dabeabb3be2130fd80e573447e8de3c7ba7b2fb08741b4da85e453c0bc62cea35a6bedc57be0e2be306e67733f76a29cf74162ef00622cc2a1

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
374KB

MD5
5306b994208911c5c105c6ecff58f612

SHA1
a024b30a38e7177c1061381f0dab0f02934966cb

SHA256
17d72898d4bfdf9f64da6e5ec4b025efaf7bf27e03fdecf32d85ab4b6ae58734

SHA512
ff97e39592c9c1aff5507a99dc03b60b568e02bf66266bddb820a1ad52fae422dd61db72b487ceec765a9263ba9c862e13941716b2fb9c662458c852262513e2

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
374KB

MD5
88087d55bab32da7c96bf2c1558d5020

SHA1
fa9e17c535eeaae343d1e50aef9d74a9facbf77b

SHA256
aafe64abe4b06ed7c5ccf5c6b1e321ec11eedc841b56a0bdf8f5534311333ecc

SHA512
1837e99750389cfc10b171f5e03ce471c577488b601048b2c2a43225a60d0b8f5abe03c2069d0afcd30508dff01b0c543138190698d95036f634d6844f60510b

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
374KB

MD5
0cee67e41c570a6f69ed9a3446d09eaa

SHA1
b68ab7a9d51f51473c7a9e2f9487a0561262340d

SHA256
f4f01d2b193ac13c4160e12183cf0f6917a7915056d8ba5754c709aac0402d7b

SHA512
6643d7cde39567bd0c20e8596de1a54cde44dad8ae58dd6f2d6a48ddb409a57af17b076c375c79a297ab9789aabf1bc9de3e34fe84d3c052f585c9c00424820f

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
374KB

MD5
60c4e9500e2c17e097ce03e474127369

SHA1
2a26850dd304f36dbc611aaec3859ae82d6876fc

SHA256
b84c9c8d372b21f573bf947918725ad12a4f002facba6754aa297eac9bfe5e0f

SHA512
2022632592c2a4e5257885c2ffe1776a7e9e7bc804c162fd0b7153c2d1f249d04728e4bd2ddf77d57cafd0657574082b8ba78f8220abf58d379de9fb831142cd

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
374KB

MD5
125d7baed35c1b1cfa0fc2fb6ce172d3

SHA1
3f2bc15d8a945fd445c26f4ec24e2aaee477a8cb

SHA256
0e6f6d083c1000b07c5f2467b9c4dcf6998f9954b585b4b6422b5c55558608ee

SHA512
e3da5cc111e4aad388fdf40d2a5ddb12e01d27201f0b20c2c5cecf12443ae2241ae576e8ccfd7e05c23aa987b232edddf509a4328d4ed2939c885cfb946a02b5

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
374KB

MD5
dad489e773c76a19e45c25d6b0cc7640

SHA1
15b01223bfae07e45575403cbb1c6f81f5cb22d6

SHA256
07a2a008a3462988f5ea294de52d126b539824d06bcc45c8e3426a1b92b6b285

SHA512
0c1c80e5ef2bbd1b01b1b19f7db896c70af2ca6cbb5589e818367e333f71dd908c90c794373fcda90333e2765d5d5bfde6121d38ba06a5a7dc15ed511d6cea86

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
374KB

MD5
20bba5b4c950b0756a514eb61daba5b8

SHA1
3f758adf33d4051b94dcde8faf05162422b39133

SHA256
adee11d6f9bb782c6fc68e63dc278ad4ea5a91b04f04acc87da3dce0247b95e4

SHA512
e809e7432f19c13764267f0596dd98a2222968ac1645ec641660695ed8ecd3bc5916509bc291a8327a8b089a5acc5fc6aa2ea3b240c419989a78a1141ee6ddae

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
374KB

MD5
34d41a4141ed633848f0e658a2b4fdba

SHA1
e0aebc9ccc01908f69598ac3a988c781620f8a42

SHA256
ffe7430c806e791e95927d4311b2596e06ca4e7349e2975b4376f9ca9fb2eadc

SHA512
d10c47dac1b0bbe72c8b39257c9b165c3d5ca8213363448caf7e5d608d91f69838ac828e87b8e8875446aaae715dbd98a6d742a5b7c6e380890ee2d972aac892

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
374KB

MD5
14063289b7519984a7c3524ab4732e95

SHA1
228c8eb1a02b3b6018063619fd7e955ee83dc2f4

SHA256
6e81f3390e440db16e429883ad405bcd8441a3f0a25e529f45c0b15fcb602058

SHA512
f4ee857299b7d89c6a5dfe1a1eab3506bebd177142d77081616bf4e7a06b028efdc9de7370bfa7d4936f83257425e1f8b51d41e72ed341c49f4bc1f8d665d798

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
374KB

MD5
a6ae0c7f5bce6f94165615548cfea20b

SHA1
7deb5164a873063c3929e1dea8697fcdf7ab9453

SHA256
568be9868bf05a486d9bbf3b100d5dea00c16dc6bc7da4125731b91a030e18e7

SHA512
43d2785c9276adf30e6a1c48f47281e9bc52e231cc4f77023e6b02b275c9479800358594c63e590e974ab205412908d6b5e43cc4abe1f1bff2d4ac93b009143e

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
374KB

MD5
4918095fddda84d71c51dcb28a7132cd

SHA1
42e44041f5aa47435d2bb9be1ba56fc6722e4995

SHA256
b79467265016e089d39bb1f809dd6cf108f63943b0618f7c2ec2367672440c56

SHA512
f109ecdd1d201a3c7bc0ae56168bbce97cf94afc1fe9ee1aec0e06b2af2b808929ac712979dba339b163719a1625f3e217bbe86cd54aada571c5d73c619d40af

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
374KB

MD5
4f823cb527d523d31e44bbe0dea3e180

SHA1
f6c52bab76d02f73133fcd8fdcb36efb539b32e5

SHA256
2f3fae8b7ec188ebfe8452d97d96cd141bb947139743cbf462e22b3a4c8b5a9c

SHA512
5812c31f186ad77d6170d3208a48749d21a89d60f98213a1398b032f7dc6e076719f044eb2bea414366018a379c36dc8a98a6f615150dd1934b4e60519a4eb99

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
374KB

MD5
62362cc72cb4c0b167745cf290a70282

SHA1
69ba07237edee2e91942535c8797a5bd3898ee5f

SHA256
3af32bc46d60e8e3584ec6a6e4c0780657fb7aa9fce638a54fd836663ec0feda

SHA512
22da96babad2df527dbd0f1b97cba09bbf26ca49d7a6a2da5e954ebdb9d338187f690f188eab69f654a3e950c95a633d78fa969888bda5f8ef79f46ce6d7eb26

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
374KB

MD5
57aa689f219538613247d10f2921e465

SHA1
2dd12d026cc1f1b260f13c71153abb5257220abe

SHA256
1c56fc1697bb2b6713847b345343f798f4a23c1cf86bed87b140cfe02fd3e2d0

SHA512
2e3ec6bb3e7bf38134cf6c4a355fcb1fbc07bcbcaea9ad370b5da5ef89d447fb782b0a32410d7e3f73a53a56b41ef57516b0676eaced7a49a60ac7e16e377dfe

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
374KB

MD5
900665d8ba83cd9918ef85e129477bc0

SHA1
ba490391497509c2ba265e9ebd3a0387d0b5d026

SHA256
a1fc1b483ad01cbac746907bc7d859a78cb3d507767417368aebdbe6d6567713

SHA512
51dae77ad75d3b50a0e6f5d52b10fa343f86dbe8c134006d957f2cf6f95050d25be1e0c514030dd13fc1e1fe71bbc6df15d7c0e6c9c0f8a5c765c5c57fe02180

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
374KB

MD5
3fa467ab8c2df13c200255f3ca68d6f4

SHA1
0363658ed3c71d31484ac71cb74976ed339d72e7

SHA256
205cda8b8a13ff9e52a5ead4c9d6a5e81da0c1c573a7382bc83ceeecb73e4661

SHA512
c6f5fbc3302ba2334389cf2d9634e149c33473f0ce9d9d435b41a477b67d68e1a6ae62a49d139daf31adc2ab0f8f2236a499e5383c8a12052bd7ca703e82a9aa

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
374KB

MD5
6311183856f49bed3e99ec3f2521e36e

SHA1
1f0b25b1668e46d6e4ffa8b12c51a43a34b46842

SHA256
6e4eb3db62edd283e9092589e39bcb0b156037f20eca0739b325670aa14630b0

SHA512
167ec63054742de2661e8de6ef520bb43825ecc6c7159c90a688e0cdbcaad9af5db8fb99af953fe0e3cdafc05f4bb4328184497b582a3a7e66895fd411084e53

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
374KB

MD5
4d6bd6f941efb6ffbadeea43294f2a44

SHA1
f659e85dc1bdd9a02cd62cb3db19d923a38df7b4

SHA256
10b9137e0e95a43d4e67b533079a34f2c15faf877e0dd613a694d221bf278d61

SHA512
59ca415e4315b6a0aeace87f07e2007f995c10a45a7ce80fb7e4389648fb3c198dd23d00c155956ce682e20ac53fc3ee0a5855bf2725cb5170ff8f02a752c71c

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
374KB

MD5
545c8e81730f56396c50e77f3aba7a8a

SHA1
03e8f0c0ddc7bf67958ef7decd30488187190a1f

SHA256
9d13077305c0d5751ba47148cf6323fdba4d3d43b58bb5657dd99cd3096073fe

SHA512
2bebee170fbd7154f23304464c7e98be03bd8ab57f9e51b3542695c9751b8b216907d7c39809da8f10aebe016dda82728766fd1845ae88becfbc0b92c96aae89

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
374KB

MD5
4bbe42fa49d62d4433e00d150a803f99

SHA1
19d6258acd3467e4112d1939d23e4990df1c2d5d

SHA256
d302c61d0c1751a5938f3c4b77bdb16dbff82487595ef383bb4975bc101df47a

SHA512
d6a8c6a7c09ef30a42a5bfe177c78a8d54cd52ff46745de65020c6eda5b951c90c05486a320231899476ca1be739e28d1f0919c8feb86816826f7a65cd713188

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
374KB

MD5
1e7d76360986ef1af991630d73fb1a14

SHA1
bc08e1c3a96ae4decbc444f74ea3483022899225

SHA256
94c775718ae653f3a90ebdd974cdb9c40b6c8db937391da0a8cddec5fd88c05e

SHA512
62d8802ac6e17d675c7abb8f029e3ca85eb9444523386bd29f5dff4e25c3e5aae76a1789735900c11fcb6824162085bb0adf61ec343f8bb05a1f12ff5bd51c0e

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
374KB

MD5
29e3fe0172ed85441a14f80ba5588060

SHA1
c04fe2ef1855e365ed0b7fc6a6961274a75359d8

SHA256
aba4a224eeb5721b7af2ac08520242a251b1bf6b548db18a782ad36b7ca91d59

SHA512
f4ea33ddbf69b259714971f4d03b4c19d9867b902f66b155d93f342a014ebc845f496f0a54b12b6f12a455ba0d59382b77b0a2258057bd49d7e35eb287e86ae3

Download Submit
C:\Windows\SysWOW64\Ihidlk32.dll

Filesize
7KB

MD5
dadf42b66a8aa739169d77542de716a2

SHA1
196e89ced63124185db37f97232bc977766c45a3

SHA256
d5369b26ea1ffbec3de1c128725e573e937bfe33153a73baef427dfdf707269d

SHA512
fcf8c5e2e28dcc338635dd1733296baccaa8afb75bfc1546af4b1fc7c13343c50d1937fc562837f830709e0656c071fe36bfd5acf72d03fd1b0c64c375c164a1

Download Submit
memory/336-269-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/336-159-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/532-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/532-273-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/560-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/560-265-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/640-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/640-266-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/760-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/760-277-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-12-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-287-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/928-260-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/928-232-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1272-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1272-215-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1296-239-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1296-259-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1316-285-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1316-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1332-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1332-272-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1504-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1504-281-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1672-255-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1672-257-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1900-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1900-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1916-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1916-276-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1924-271-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1924-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2004-278-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2004-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2072-258-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2072-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2216-267-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2216-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2304-207-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2304-263-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2440-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2440-279-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2516-283-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2516-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3156-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3156-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3236-224-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3236-261-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3608-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4292-264-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4292-199-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4380-284-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4380-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4700-103-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4700-275-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4792-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4792-282-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5008-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5008-288-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5076-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5076-270-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads