c6b22c98f4cabfed62f482aca9a837dd9be8e0bb1bd8c9412ab356f093df64bd

Analysis

max time kernel
114s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7addc0f78fcc36ff9114bfe8a3aad950N.exe
Size

1024KB
MD5

7addc0f78fcc36ff9114bfe8a3aad950
SHA1

06d600d9bcad5befb1df9fe39ff170a46b4bd74f
SHA256

c6b22c98f4cabfed62f482aca9a837dd9be8e0bb1bd8c9412ab356f093df64bd
SHA512

a2ee754668e154b6664b68924258359eb42514fa0cde3b9297978facfc9f199ce8f89792047f63777b7aa10836a8a86a28e20c08e48a37bddb424748db035323
SSDEEP

12288:5a5wJ29kY660fIaDZkY660f8jTK/XhdAwlt01PBExKN4P6IfKTLR+6CwUkEoH:5a5T9gsaDZgQjGkwlks/6HnEO

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbngeadf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	7addc0f78fcc36ff9114bfe8a3aad950N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	7addc0f78fcc36ff9114bfe8a3aad950N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhpgca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bejobk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfakcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pomncfge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apddce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Alkeifga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aealll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfeijqqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmagch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndnnianm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbgqdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obidcdfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bflham32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bikeni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ollljmhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oloipmfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocknbglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amkabind.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblcfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbdpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgdgijhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lamlphoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blknpdho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmmgof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbdcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afceko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmagch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcbeqaia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amkabind.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aidomjaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bimach32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odbgdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Poidhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bblcfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfoegm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qihoak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afeban32.exe

Executes dropped EXE 64 IoCs

pid	Process
1316	Lamlphoo.exe
512	Maoifh32.exe
4224	Mhpgca32.exe
3600	Mkocol32.exe
1216	Nlnpio32.exe
2972	Nhgmcp32.exe
2208	Nkeipk32.exe
2764	Ndnnianm.exe
1132	Nocbfjmc.exe
440	Nbbnbemf.exe
3656	Ndpjnq32.exe
4392	Nlgbon32.exe
3796	Nofoki32.exe
4396	Nbdkhe32.exe
3128	Odbgdp32.exe
2080	Oljoen32.exe
1448	Okmpqjad.exe
1784	Ocdgahag.exe
3780	Ofbdncaj.exe
4344	Odedipge.exe
4144	Ollljmhg.exe
2324	Ookhfigk.exe
4620	Obidcdfo.exe
1328	Ofdqcc32.exe
2380	Oloipmfd.exe
2072	Oomelheh.exe
3500	Obkahddl.exe
1548	Odjmdocp.exe
3552	Okceaikl.exe
4528	Ocknbglo.exe
2144	Ofijnbkb.exe
2788	Ohhfknjf.exe
924	Ooangh32.exe
5024	Obpkcc32.exe
1116	Pdngpo32.exe
4544	Pkholi32.exe
3536	Pcpgmf32.exe
5124	Pkklbh32.exe
5164	Pcbdcf32.exe
5204	Pbddobla.exe
5244	Pecpknke.exe
5284	Pmjhlklg.exe
5332	Poidhg32.exe
5372	Pbgqdb32.exe
5412	Piaiqlak.exe
5448	Pkoemhao.exe
5488	Pcfmneaa.exe
5532	Pfeijqqe.exe
5564	Pmoagk32.exe
5604	Pomncfge.exe
5644	Pbljoafi.exe
5684	Qejfkmem.exe
5724	Qmanljfo.exe
5764	Qppkhfec.exe
5804	Qbngeadf.exe
5844	Qelcamcj.exe
5884	Qihoak32.exe
5924	Qkfkng32.exe
5964	Abpcja32.exe
6004	Aeopfl32.exe
6044	Amfhgj32.exe
6084	Apddce32.exe
6124	Abcppq32.exe
2308	Aealll32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Amfhgj32.exe	Aeopfl32.exe
File created	C:\Windows\SysWOW64\Ghnkilod.dll	Ooangh32.exe
File created	C:\Windows\SysWOW64\Kfhfap32.dll	Afeban32.exe
File opened for modification	C:\Windows\SysWOW64\Blgddd32.exe	Bemlhj32.exe
File opened for modification	C:\Windows\SysWOW64\Oloipmfd.exe	Ofdqcc32.exe
File created	C:\Windows\SysWOW64\Bkpjjj32.dll	Ciiaogon.exe
File created	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File created	C:\Windows\SysWOW64\Mkbdql32.dll	Ocknbglo.exe
File created	C:\Windows\SysWOW64\Pkholi32.exe	Pdngpo32.exe
File created	C:\Windows\SysWOW64\Hpacoj32.dll	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Nlgbon32.exe	Ndpjnq32.exe
File created	C:\Windows\SysWOW64\Cqbolk32.dll	Bboplo32.exe
File opened for modification	C:\Windows\SysWOW64\Amfhgj32.exe	Aeopfl32.exe
File created	C:\Windows\SysWOW64\Alkeifga.exe	Aealll32.exe
File created	C:\Windows\SysWOW64\Cfhhml32.exe	Cdjlap32.exe
File created	C:\Windows\SysWOW64\Ebldoh32.dll	Dllffa32.exe
File created	C:\Windows\SysWOW64\Fpjepamq.dll	Lamlphoo.exe
File opened for modification	C:\Windows\SysWOW64\Pcfmneaa.exe	Pkoemhao.exe
File opened for modification	C:\Windows\SysWOW64\Aiabhj32.exe	Afceko32.exe
File created	C:\Windows\SysWOW64\Dpkgac32.dll	Dgdgijhp.exe
File opened for modification	C:\Windows\SysWOW64\Nbdkhe32.exe	Nofoki32.exe
File created	C:\Windows\SysWOW64\Fqkiecpd.dll	Amkabind.exe
File created	C:\Windows\SysWOW64\Dgdgijhp.exe	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Qkfkng32.exe	Qihoak32.exe
File created	C:\Windows\SysWOW64\Bemlhj32.exe	Bboplo32.exe
File created	C:\Windows\SysWOW64\Paajfjdm.dll	Odjmdocp.exe
File created	C:\Windows\SysWOW64\Mmhpkebp.dll	Bppcpc32.exe
File opened for modification	C:\Windows\SysWOW64\Bikeni32.exe	Bflham32.exe
File opened for modification	C:\Windows\SysWOW64\Dfakcj32.exe	Ddcogo32.exe
File created	C:\Windows\SysWOW64\Bakpfm32.dll	Obkahddl.exe
File created	C:\Windows\SysWOW64\Pcfmneaa.exe	Pkoemhao.exe
File created	C:\Windows\SysWOW64\Dfakcj32.exe	Ddcogo32.exe
File opened for modification	C:\Windows\SysWOW64\Nbbnbemf.exe	Nocbfjmc.exe
File created	C:\Windows\SysWOW64\Gbbqmiln.dll	Nbdkhe32.exe
File opened for modification	C:\Windows\SysWOW64\Pkoemhao.exe	Piaiqlak.exe
File created	C:\Windows\SysWOW64\Alpnde32.exe	Aiabhj32.exe
File opened for modification	C:\Windows\SysWOW64\Bemlhj32.exe	Bboplo32.exe
File created	C:\Windows\SysWOW64\Bcbeqaia.exe	Blknpdho.exe
File created	C:\Windows\SysWOW64\Bfabmmhe.exe	Bcbeqaia.exe
File created	C:\Windows\SysWOW64\Cbjogmlf.exe	Cplckbmc.exe
File created	C:\Windows\SysWOW64\Oenlmopg.dll	Ohhfknjf.exe
File created	C:\Windows\SysWOW64\Pbgqdb32.exe	Poidhg32.exe
File created	C:\Windows\SysWOW64\Lkafdjmc.dll	Afceko32.exe
File opened for modification	C:\Windows\SysWOW64\Dbkhnk32.exe	Dpllbp32.exe
File created	C:\Windows\SysWOW64\Bflham32.exe	Bcnleb32.exe
File created	C:\Windows\SysWOW64\Cpifeb32.exe	Bmkjig32.exe
File created	C:\Windows\SysWOW64\Pkklbh32.exe	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Pmjhlklg.exe	Pecpknke.exe
File opened for modification	C:\Windows\SysWOW64\Okceaikl.exe	Odjmdocp.exe
File created	C:\Windows\SysWOW64\Apimodmh.exe	Amkabind.exe
File created	C:\Windows\SysWOW64\Obkcmi32.dll	Alpnde32.exe
File created	C:\Windows\SysWOW64\Dbcbnlcl.exe	Dpefaq32.exe
File created	C:\Windows\SysWOW64\Odbgdp32.exe	Nbdkhe32.exe
File opened for modification	C:\Windows\SysWOW64\Oljoen32.exe	Odbgdp32.exe
File opened for modification	C:\Windows\SysWOW64\Cehlcikj.exe	Cbjogmlf.exe
File opened for modification	C:\Windows\SysWOW64\Debnjgcp.exe	Dbcbnlcl.exe
File created	C:\Windows\SysWOW64\Pmglfe32.dll	Bcnleb32.exe
File opened for modification	C:\Windows\SysWOW64\Cpifeb32.exe	Bmkjig32.exe
File opened for modification	C:\Windows\SysWOW64\Cdjlap32.exe	Clbdpc32.exe
File created	C:\Windows\SysWOW64\Okmpqjad.exe	Oljoen32.exe
File created	C:\Windows\SysWOW64\Cqgkidki.dll	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Blgddd32.exe	Bemlhj32.exe
File created	C:\Windows\SysWOW64\Cmmgof32.exe	Cefoni32.exe
File created	C:\Windows\SysWOW64\Edjgidik.dll	Blknpdho.exe

Program crash 1 IoCs

pid	pid_target	Process
7116	6968	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aidomjaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Albkieqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciiaogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odedipge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apddce32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bboplo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabmmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbhbbn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cifdjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpcila32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdgahag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllffa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofijnbkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbgqdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkfkng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amkabind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bliajd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfjeckpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odjmdocp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkklbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcppq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepadh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okmpqjad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pecpknke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkocol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maoifh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nocbfjmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qejfkmem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acgfec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcpika32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbaehl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7addc0f78fcc36ff9114bfe8a3aad950N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bimach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abpcja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooangh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obpkcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcpgmf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjlap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbdkhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pkoemhao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bflham32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Okceaikl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oloipmfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdngpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pbddobla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cplckbmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhgmcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmjhlklg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkeifga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aecialmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afceko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bblcfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bejobk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofoki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfhhml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcnleb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfeijqqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clbdpc32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckjdhni.dll"	Aeopfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfhfap32.dll"	Afeban32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Obpkcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll"	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkebqokl.dll"	Aidomjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aahgec32.dll"	Bikeni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcbeqaia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofbdncaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfdgep32.dll"	Ofdqcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Honmnc32.dll"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pfeijqqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abcppq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bllolf32.dll"	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcpgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbbel32.dll"	Debnjgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmhpkebp.dll"	Bppcpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbddobla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bboplo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfakcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mhpgca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odbgdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofbdncaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ookhfigk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbljoafi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcnleb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Befogbik.dll"	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiagoigj.dll"	Clbdpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpjepamq.dll"	Lamlphoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mhpgca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfiefp32.dll"	Acgfec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Blgddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmabgl32.dll"	Bfoegm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnkilod.dll"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgmjh32.dll"	Blgddd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maoifh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ollljmhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofijnbkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edjgidik.dll"	Blknpdho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfabmmhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcoeiajc.dll"	Pbddobla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngllodpm.dll"	Cehlcikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeiam32.dll"	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Apddce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bppcpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qejfkmem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odemep32.dll"	Nkeipk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Poidhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Maoifh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ookhfigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmanljfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbhbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfhhml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbaehl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbbqmiln.dll"	Nbdkhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obidcdfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgfdkj32.dll"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pomncfge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1316	3324	7addc0f78fcc36ff9114bfe8a3aad950N.exe	91
PID 3324 wrote to memory of 1316	3324	7addc0f78fcc36ff9114bfe8a3aad950N.exe	91
PID 3324 wrote to memory of 1316	3324	7addc0f78fcc36ff9114bfe8a3aad950N.exe	91
PID 1316 wrote to memory of 512	1316	Lamlphoo.exe	92
PID 1316 wrote to memory of 512	1316	Lamlphoo.exe	92
PID 1316 wrote to memory of 512	1316	Lamlphoo.exe	92
PID 512 wrote to memory of 4224	512	Maoifh32.exe	93
PID 512 wrote to memory of 4224	512	Maoifh32.exe	93
PID 512 wrote to memory of 4224	512	Maoifh32.exe	93
PID 4224 wrote to memory of 3600	4224	Mhpgca32.exe	94
PID 4224 wrote to memory of 3600	4224	Mhpgca32.exe	94
PID 4224 wrote to memory of 3600	4224	Mhpgca32.exe	94
PID 3600 wrote to memory of 1216	3600	Mkocol32.exe	97
PID 3600 wrote to memory of 1216	3600	Mkocol32.exe	97
PID 3600 wrote to memory of 1216	3600	Mkocol32.exe	97
PID 1216 wrote to memory of 2972	1216	Nlnpio32.exe	98
PID 1216 wrote to memory of 2972	1216	Nlnpio32.exe	98
PID 1216 wrote to memory of 2972	1216	Nlnpio32.exe	98
PID 2972 wrote to memory of 2208	2972	Nhgmcp32.exe	99
PID 2972 wrote to memory of 2208	2972	Nhgmcp32.exe	99
PID 2972 wrote to memory of 2208	2972	Nhgmcp32.exe	99
PID 2208 wrote to memory of 2764	2208	Nkeipk32.exe	101
PID 2208 wrote to memory of 2764	2208	Nkeipk32.exe	101
PID 2208 wrote to memory of 2764	2208	Nkeipk32.exe	101
PID 2764 wrote to memory of 1132	2764	Ndnnianm.exe	102
PID 2764 wrote to memory of 1132	2764	Ndnnianm.exe	102
PID 2764 wrote to memory of 1132	2764	Ndnnianm.exe	102
PID 1132 wrote to memory of 440	1132	Nocbfjmc.exe	103
PID 1132 wrote to memory of 440	1132	Nocbfjmc.exe	103
PID 1132 wrote to memory of 440	1132	Nocbfjmc.exe	103
PID 440 wrote to memory of 3656	440	Nbbnbemf.exe	104
PID 440 wrote to memory of 3656	440	Nbbnbemf.exe	104
PID 440 wrote to memory of 3656	440	Nbbnbemf.exe	104
PID 3656 wrote to memory of 4392	3656	Ndpjnq32.exe	105
PID 3656 wrote to memory of 4392	3656	Ndpjnq32.exe	105
PID 3656 wrote to memory of 4392	3656	Ndpjnq32.exe	105
PID 4392 wrote to memory of 3796	4392	Nlgbon32.exe	106
PID 4392 wrote to memory of 3796	4392	Nlgbon32.exe	106
PID 4392 wrote to memory of 3796	4392	Nlgbon32.exe	106
PID 3796 wrote to memory of 4396	3796	Nofoki32.exe	107
PID 3796 wrote to memory of 4396	3796	Nofoki32.exe	107
PID 3796 wrote to memory of 4396	3796	Nofoki32.exe	107
PID 4396 wrote to memory of 3128	4396	Nbdkhe32.exe	108
PID 4396 wrote to memory of 3128	4396	Nbdkhe32.exe	108
PID 4396 wrote to memory of 3128	4396	Nbdkhe32.exe	108
PID 3128 wrote to memory of 2080	3128	Odbgdp32.exe	109
PID 3128 wrote to memory of 2080	3128	Odbgdp32.exe	109
PID 3128 wrote to memory of 2080	3128	Odbgdp32.exe	109
PID 2080 wrote to memory of 1448	2080	Oljoen32.exe	110
PID 2080 wrote to memory of 1448	2080	Oljoen32.exe	110
PID 2080 wrote to memory of 1448	2080	Oljoen32.exe	110
PID 1448 wrote to memory of 1784	1448	Okmpqjad.exe	111
PID 1448 wrote to memory of 1784	1448	Okmpqjad.exe	111
PID 1448 wrote to memory of 1784	1448	Okmpqjad.exe	111
PID 1784 wrote to memory of 3780	1784	Ocdgahag.exe	112
PID 1784 wrote to memory of 3780	1784	Ocdgahag.exe	112
PID 1784 wrote to memory of 3780	1784	Ocdgahag.exe	112
PID 3780 wrote to memory of 4344	3780	Ofbdncaj.exe	113
PID 3780 wrote to memory of 4344	3780	Ofbdncaj.exe	113
PID 3780 wrote to memory of 4344	3780	Ofbdncaj.exe	113
PID 4344 wrote to memory of 4144	4344	Odedipge.exe	114
PID 4344 wrote to memory of 4144	4344	Odedipge.exe	114
PID 4344 wrote to memory of 4144	4344	Odedipge.exe	114
PID 4144 wrote to memory of 2324	4144	Ollljmhg.exe	115

C:\Users\Admin\AppData\Local\Temp\7addc0f78fcc36ff9114bfe8a3aad950N.exe
"C:\Users\Admin\AppData\Local\Temp\7addc0f78fcc36ff9114bfe8a3aad950N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\Lamlphoo.exe
  C:\Windows\system32\Lamlphoo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\Maoifh32.exe
    C:\Windows\system32\Maoifh32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\SysWOW64\Mhpgca32.exe
      C:\Windows\system32\Mhpgca32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        27⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3500
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3552
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2788
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:924
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Pkholi32.exe
        
        C:\Windows\system32\Pkholi32.exe
        37⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        48⤵
        Executes dropped EXE
        
        PID:5488
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5764
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5804
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        57⤵
        Executes dropped EXE
        
        PID:5844
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        67⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        68⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        70⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Afceko32.exe
        
        C:\Windows\system32\Afceko32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        72⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        73⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        74⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        81⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        89⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        94⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6612
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        95⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6652
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        96⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        100⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        101⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        102⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Clbdpc32.exe
        
        C:\Windows\system32\Clbdpc32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:7092
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        107⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        108⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4176
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        111⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        113⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        115⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        117⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        118⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        123⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6604
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        128⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        129⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        130⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 412
        131⤵
        Program crash
        
        PID:7116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6968 -ip 6968
1⤵
PID:7068

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ffb020877b9d74b7b1f521f89103a4c6 v1nZdZM4NEqMcutUowkVnQ.0.1.0.0.0
1⤵
PID:6968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:5268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Hjnmfk32.dll

Filesize
7KB

MD5
8d90f56a9f830def1c2b0713c2baaa02

SHA1
88b5aaf4bf595a015c36aca37dcbcffbaa5263be

SHA256
793bff3ef0bdacd4b8902bc6403d0b55c48a6bfa1e737cfff9480bf752f793bf

SHA512
f8f48d59f2b5e7d026022729a57ba55a86047267b4309267eb618b3299b0ab7c165425a911042e4b0b7ff2306704ac14cbdb4c8a4ac20f448d28fc4f9be5299a

Download Submit
C:\Windows\SysWOW64\Lamlphoo.exe

Filesize
1024KB

MD5
b81ae7caef238968c31aa1fd44761e2b

SHA1
7339ad069856c08bc0d0410133a1eca7807d4a10

SHA256
7e1dc0d3ecd025270d813d7c11c0ba66ecbf1a1cd920f0f3a3ec7a4f14ff5f95

SHA512
7af57dd6d553bdd8e811d2663db7a36a981fa69d73c225419fcb742067f1c636c82f6d2e2ddbee4da2e923b4f745cc927739e5f782f8d8690f489e0cdc4dd6bd

Download Submit
C:\Windows\SysWOW64\Maoifh32.exe

Filesize
1024KB

MD5
a006d3603bc8bbdff85ff3b067d4e601

SHA1
c2d48c10b511719299d1a9f74be2832b99dc2d39

SHA256
2568a288f9e3a93176983e287c0b0f4022e311e53c4515f54daa1a19ac7f139e

SHA512
fdee791e9dd8f9205d46183e622861fd181af964cb60189a0784ad65c267558bdde340e62f34d935b1580b7f8cc38f074bd813f57286daa759d7521c2aa86334

Download Submit
C:\Windows\SysWOW64\Mhpgca32.exe

Filesize
1024KB

MD5
d4b4e358c52bf821043e91eb56fc340f

SHA1
07912dca1f2fd244651d340c8c18e0da0259a4bb

SHA256
d7b842487c3414e14555aef0cb9c5cc724b08d46dc2c5d44baa65097bd5c23e1

SHA512
5edde32d726c2ccb659c2ef7c60ce6b1ffd547c56e7694df1a8963f913812817db561f5a3868e8092c78334ca62796dc9e13ddc146ade07c75ea20157819ce23

Download Submit
C:\Windows\SysWOW64\Mkocol32.exe

Filesize
1024KB

MD5
79774abe2400f5257db09e306fe020e4

SHA1
5436dd3164b2984a1643ccd5cf6b7ca7d383c7ed

SHA256
7d6727fa7e8eca2d752c16fad5dfb609152dd84c736e4bfaf7921cb058288d78

SHA512
e3805002774a4342124d4e43f8bafeeab0ab005c72a9125ede2a101bf4e7351ae7ab6850e6c3a8f04eba7db14d668923269651b555e5e0f848bd62a2365a3bfe

Download Submit
C:\Windows\SysWOW64\Nbbnbemf.exe

Filesize
1024KB

MD5
9855b654d4f06fac8818ff479893d626

SHA1
45798f2264661ce9b494d679b9d7a768d010fbb4

SHA256
8a37663fe0bb8377b24b33309b8096c75bf67f610ecae99d38795c3f0d52913c

SHA512
db4aab38271baa14b6e1814e84cfe85101abb20f587363a921660e688ea7558f32aab49b4abb3a5a7e14fa4e6e14256ff3a3c964d3b7b88bf8952c3ff5d7e61f

Download Submit
C:\Windows\SysWOW64\Nbdkhe32.exe

Filesize
1024KB

MD5
fe9f4ea481f3b6692bef0c5c808e740b

SHA1
9ebd4dfcbe809b6020c145faddac8e0304b1ed13

SHA256
f6fff14a9e76a267dbe3ee63bd22dc18d24e6a656abd77966aace958e0e7c7b9

SHA512
03257a7085610961800f18224f57841fb8817df1ffaad481914a2fa4967b873a082d337809159506ba11298eaac9258884ff50624fe0270bf990a1d8f8413225

Download Submit
C:\Windows\SysWOW64\Ndnnianm.exe

Filesize
1024KB

MD5
a70fac2a2f8cb2ed87f63e5656e8bb65

SHA1
e5a8d2b48c5c794c19267dafa45de4a4671baf59

SHA256
2f376ef79712e4e940b6e1588a9cc5b69ee4fca37158a1a3d40d173db694700a

SHA512
0ab686b8441353c7b43c84728c15be2860774464b3e619589226b1fe9d886c7c134398b094b5ec98dff254e62bd497a9a0579c71469be4b01f11b531d1711ffe

Download Submit
C:\Windows\SysWOW64\Ndpjnq32.exe

Filesize
1024KB

MD5
9b4476d2e699696baac647afa377d01b

SHA1
f85cef77d88a2eb9e64c3cfcadeeba0b3dee8c44

SHA256
fea3f05fbe892d596d49984e752b1d919c40a18752d2ad58171f2e6b15510705

SHA512
a204e7074f52cf86637ee1af5e8d66fbd9bdd1a5601be119a297135269bc2c527da1101722706da89cfa4ed33d5737789a0a8eb9e1f71d954106663e46627ed3

Download Submit
C:\Windows\SysWOW64\Nhgmcp32.exe

Filesize
1024KB

MD5
bb5c4a50818b38e306b33cd4cb2d50b8

SHA1
d880afa88603d588e0071a40315e47d3972874fa

SHA256
243b4910c79a01b7d1c4ad5ef0e09aa097d31ee43fa183029b2b43c959a2c8f1

SHA512
308d8c2e797c492a33ac0c2403f03f1d25986263981c9027a6323da812ba28416f31fdd3ad4146b9c9d2cee8c39d6d61d68bc5361103d9eadffa254bce078d7b

Download Submit
C:\Windows\SysWOW64\Nkeipk32.exe

Filesize
1024KB

MD5
4a184d5d4c300c03f4befafa66a12421

SHA1
8719c89ca27a45e3c0bd945e3c12931663f4d878

SHA256
fecb633356eba8c55b9ea05a349443d58a7ddbbae7621676c170bfa4199d0b1e

SHA512
9b813b67200312683242eff1c63d7858cd72b40e2cb35021adc57b47df09a80773e6b0c206d48eb9218a4f69ef40b032c721f65f794da4a8bd5604093844efe1

Download Submit
C:\Windows\SysWOW64\Nlgbon32.exe

Filesize
1024KB

MD5
e01c92d837e2fedf621a9134fd534d1f

SHA1
4a4e8a5ab814b6913c8ddfcc87178a7f3f40ff98

SHA256
4e1f8519ecfbc87727d2bf1c41056f1e5c5a2788d6bbcfa47d53232339d5da41

SHA512
0b1826c45820cc4e90a513f86bfbe38fbf29cc0f9f19311cc5bfb035b2d8b7314462b6b1fd3e81eb867a81cd3627dedb47d0fe303612c39db419e95fbc045302

Download Submit
C:\Windows\SysWOW64\Nlnpio32.exe

Filesize
1024KB

MD5
bd44214430402f21528103bd467b2d3f

SHA1
1426d2e9034b86a6fb9c762dbb593b8c84015bae

SHA256
12870a9ad1532a8a126ae388468611d691fb9d3f5118be28a49523909a278ad6

SHA512
f79e14e886280eb55eb89352c184585e01b1ef67f8b2f45a20f68c3eab1b97aed0962771889c380ab64334df4f575150a3c71c036ee0087988e7755e8fbaf99d

Download Submit
C:\Windows\SysWOW64\Nocbfjmc.exe

Filesize
1024KB

MD5
3f08a39fdf21133517aa224e91cb4631

SHA1
359809a471361563f8669a8833a1889c9358e7a9

SHA256
25c405e4d66c83e416e35a3d74bd1d8082ad828536a6b61e9d0dd0b9ab20abd4

SHA512
36c3c74e3b74ded1b778a8a8a7a1041a47832d70eff0e4833abf4f84b0683f56fe5c5d9f16221bcc3e9907d0efe44431c3389115506adae83279b380b5718608

Download Submit
C:\Windows\SysWOW64\Nofoki32.exe

Filesize
1024KB

MD5
c43bb4029e7a683c53444a0ab1956c07

SHA1
5087694053cda8a170bcbce652e2bde069415664

SHA256
3b56a98b5f0f8347f041c15a37e927c21f64fca6e5a406fcdee1d78c00b9e751

SHA512
f1c3f5e09a22902d454753f450acded45a3e3d8ee718b2ef55f046c280dcb2dace03c5774df68454b5cd6de67317ca91dfc340329391ecb9c9bd22dac78b2666

Download Submit
C:\Windows\SysWOW64\Obidcdfo.exe

Filesize
1024KB

MD5
72d84db0b7171d1444e5cf9d2eeda32c

SHA1
472c3cb912a395d9e750c9d4b0c1bb66968ab6e2

SHA256
855b25103142ba6baf4018c9f955c07b3bdf59b238303441d900640f22d7fbe2

SHA512
5f9526f107de102ee7fc6fe3aa8cbe5fc92e5a953f29908767b457e908edbb4f67cc08676c7eee1a828313e03048e2dd1730f4ab469d320736b102cee2e7314e

Download Submit
C:\Windows\SysWOW64\Obkahddl.exe

Filesize
1024KB

MD5
3917fedf13a29688d9798b5661121628

SHA1
855addeb987617ad6fd25801a1bebe9b7c201026

SHA256
ef2ed7ea9fdc5906aeab5949af979faf4fbb7a8ee0c6d015a7da4c62e8ec45c1

SHA512
7dd30135b055b7b7b80dc7d04ed96949612232455e72191fd5b0c84b6b76ff18a3be284ccd3edb5a6486cea0fd106834be5aec8ce014f9fd3140970bf8eb6219

Download Submit
C:\Windows\SysWOW64\Ocdgahag.exe

Filesize
1024KB

MD5
9a724197059821cd9c398915583c6385

SHA1
71e94e41ee4faf51a5082d8200890de0854933cd

SHA256
f2c90925fc2ccd12d190bf0e1bed2ff36cf22a03e3f3b3157d9bd87b5b322147

SHA512
cafd37e816ed51dbdee8a0097625ef462b1b914f07e56535eef4960f0399b74d0c1f75e3861aba58595a654068d5ca3886aadeec1481134700c14e766e050f83

Download Submit
C:\Windows\SysWOW64\Ocknbglo.exe

Filesize
1024KB

MD5
61843576a28a22424f203c2b4f109f50

SHA1
8a2e3406edee3c72ba85456e878469be11ecf731

SHA256
a2c768047ce16edc0bab983ae7d6dd3941576e8b1058ba3d77d2ac4b30fc7ef6

SHA512
397a53ac42f95df62ea4bf64391575d29c0d4db981a561c9415eed465829783849ba6bbe4928b96b5396c161fbb474798f79d7e589ab5987e45b212109c5ccb0

Download Submit
C:\Windows\SysWOW64\Odbgdp32.exe

Filesize
1024KB

MD5
72760106c9a065c7882f032127946ce7

SHA1
bd5d5fd11808dce889d739f11c2d6da21fec4f16

SHA256
49053a548ff8db834075c36078adc3f82c93730478205bfc3d99c85129e3ae5e

SHA512
570b21204823855ddf87bda914555cebd19b632e7669e7fb91c4db26935021a7df5d90dda188019b5f1b8e5b55e552692b5fc4b62a030515ad2974a28e6e2fb2

Download Submit
C:\Windows\SysWOW64\Odedipge.exe

Filesize
1024KB

MD5
50eec62d9c7a825ff0693bacb70c162d

SHA1
33874c4ae57d8f4fc70899a61e3d0727f2e7130f

SHA256
9284c19b283138dfac7fc3e8c9781d918b986c924821ea17dec9fa1b307aac10

SHA512
d35d4a3aebb442add53686e2f1a01b81ab3eb6a214f2657322e17fe5084310a8793e5c2a161dd413041952ff2499ab43961a74b34ec484c6bd3ae1379f92daf8

Download Submit
C:\Windows\SysWOW64\Odjmdocp.exe

Filesize
1024KB

MD5
3a95a4ae886559414a5d806d78fe8478

SHA1
74bf2f7b85900c4cf71823e3bf83f8053f2a57b5

SHA256
ed01212ec5c07bea9bec6b2b9c0781c0b0bc19590d954e575ad68d188ed08a4e

SHA512
87ce8017e77d21a3f79986e24a7deaa4386b00dddc76313043ee7cc7be49512abcb7cf48567672abd2b4f108346d727bcc0a1c86ecd26590081e1bf7e1e3dba4

Download Submit
C:\Windows\SysWOW64\Ofbdncaj.exe

Filesize
1024KB

MD5
fd9688f6a1e9082514eadac1fb67287d

SHA1
1d96393f665e267a94b03c28e97d9f660703ade0

SHA256
0155242f013a46b76d0d2e4cb6a6e0ce4f899982be394a9957f412aa8329effc

SHA512
68fcdaafc32f07954114751b012bae67689088e9836b50a10cdde3636acf7b6c4b7ab7e5300b86a46ca03052c5012a94709239b66b1b6e5f39426f8209d4b7f0

Download Submit
C:\Windows\SysWOW64\Ofdqcc32.exe

Filesize
1024KB

MD5
8bf0415ae5ba1373c31aa17588d22914

SHA1
f1960d2a5dfbd1f64c1e806909c98c03bd00d0d6

SHA256
3a469f268917aa44f2c47ac2b859f6ded444b66c84c72f1f4e69ae283c2d1ca4

SHA512
b14c91022ca38d1e3e603ab71ed7a3989c0b800704469b0649510d35144429e07170def5606a2d3e53fd2b4ad534662953635c1db5656c88522cbab66791b9d1

Download Submit
C:\Windows\SysWOW64\Ofijnbkb.exe

Filesize
1024KB

MD5
15dbfcd6a58fc49f72fab3934ed2c11a

SHA1
2b9c47deee5689ff9e5b991dee1d9d722855cac1

SHA256
02ebbf859074b4c2cd8d453a4532684c2760e049ac88492c39a499c0c0859b7b

SHA512
db85fa93873ed180763c015f4cfbf23593b2d55c4e5cc69eaaa5253f0efb173790aecaa3dd0474ce4a851565710eafdf08999563ab27138b33d6ece34b005b4b

Download Submit
C:\Windows\SysWOW64\Ohhfknjf.exe

Filesize
1024KB

MD5
c2d48f406b2ccc0008234c00b5008af2

SHA1
2b30c1e0dd721f5c2c2a6eff7ef82fa7772bb37a

SHA256
36f17398aa15fdf77ff25ea8894fcdd2ca9f3ef09ba2114514156f0f48ddac4a

SHA512
bb9811508e328de4f36de3e4a27d3b77402a13734629d071cd8e8f726891c3c2a1d2124749f1e8c31a623696f98722610ce062d56e0083fa8529a677e1998953

Download Submit
C:\Windows\SysWOW64\Okceaikl.exe

Filesize
1024KB

MD5
c0a6f6a15a9d54c7b7fb9ac41985dc3d

SHA1
bdae39d13faa9592a237846d2f9c3c67c62332f4

SHA256
78bd302e75c730ab97503ef5c840212da4cf5f780137b18fb6893ad63e3d6962

SHA512
2814466555217a46aa378d1b44dbe231a1278b06b2769c8335fde379ee97a9600e61f0c705e519eadf20b7d7ff7f50ed46002220da80a5ddbc48169882c409ce

Download Submit
C:\Windows\SysWOW64\Okmpqjad.exe

Filesize
1024KB

MD5
0d2e431e7a3fb825276baeba563b945d

SHA1
be9d7260cfcf05646bf5081b1f85a0f3405bd867

SHA256
b166393587ffe169c384cd8eb697df20b7a9b15ce9c186fcdc2e392ae7b77b07

SHA512
6411677bbf34177796ecb50f5ecf591109ddc79431b1f17a104b04eebd8093408c0ea0e3a6fa196eb76a7cb27ad96143e61cfcc82477647e3543a33285395ddf

Download Submit
C:\Windows\SysWOW64\Oljoen32.exe

Filesize
1024KB

MD5
24f53ee22df7960265028bda82c4a2cd

SHA1
a5702dc9c9764b810e0a949e0a8aa88ab795b8aa

SHA256
b9a532c152be9a3b506b52fde83f8e40250a7854e9a03119ef046b4319b75c83

SHA512
5993e8af314b793941ebacb3e4f23184ac172c18d797afa9fab5bbd8e28eff82dff2b042859ffa520be9d476d12fd113c3a74de71da981e32a8bbfa95634f052

Download Submit
C:\Windows\SysWOW64\Ollljmhg.exe

Filesize
1024KB

MD5
09819f8e5449146ff6258fe1dd6289a6

SHA1
2c12eb5e445befae8c530ed1905bea2b3e40b3c6

SHA256
3e9f8fa10fea7503c030ad5f1ed99af6bd36e000a6f3cf9a8b8bb44a8630b159

SHA512
32b50e69775d14bc009d3c40ed98cd2d9a036d6166c460ebd8c49246e55e0c4fa3fabc09729153832bc73e5019e84f0932fa8f79814afe35f13b7d0d29e2dbfb

Download Submit
C:\Windows\SysWOW64\Oloipmfd.exe

Filesize
1024KB

MD5
debf3af21476f75c60e991ac1c7b179c

SHA1
865708b4a0cc509613198c3667c85a4077d63390

SHA256
e9d75da3d499518293c0aa73fcd462d07d411ef596ba57e268d984645ca73bb7

SHA512
bc1aca6210394ccac27cc07202e54450c1781586d9506cc00cf53693f64354c8724d06456aaa06a3cbc18abecfd1c467626ab4dc144558d1e36c9a9435fe0740

Download Submit
C:\Windows\SysWOW64\Ookhfigk.exe

Filesize
1024KB

MD5
b1efb8bc8db8ae256e18de4595b1bdc1

SHA1
d975773c7690606996596f51d872ce5f7f1f9ace

SHA256
8ad0ce849e4469cb6f15591113ea75f2da72cdd721dbc2b0f5b174fd888ea9e0

SHA512
fbb119f387982841c94560ce95e20f549d6bf67270464cf2d77d122760d711d7786c3caa99b8e80155f5215689a3425b007a3b7adb2c0bcf2f3e1505d49ca114

Download Submit
C:\Windows\SysWOW64\Oomelheh.exe

Filesize
1024KB

MD5
887582b8eda963db303f1772691b7743

SHA1
1667f8a6bca480e3bacd10ec854c943a7ddbeaa3

SHA256
15f64ff69955f64045d66837c66d2b66571abde005ccaaae0ed87a3d709d263f

SHA512
04772dc58b2bcef60c5040e6a11ff90e5b2fea520cb000017bd0b1834611c293f60eceb9ebf31c6d4c035e1d5947c6bcea5c45f1ca4adf266fa07ed01b99d417

Download Submit
memory/440-84-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/512-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/512-562-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/924-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1116-278-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1132-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1216-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1216-581-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1316-555-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1316-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1328-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1448-140-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1548-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1680-470-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1784-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2072-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2144-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2208-595-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2208-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2308-452-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2324-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2788-260-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3324-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3324-548-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3536-290-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3552-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3600-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-92-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3780-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3796-108-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4124-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4144-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4224-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-116-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4528-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4544-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4620-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5024-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5124-296-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5156-476-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5164-302-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5204-308-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5232-482-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5244-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5284-320-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5308-488-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5332-326-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5372-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5400-494-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5412-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5448-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5460-500-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5488-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5508-506-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5532-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5564-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5592-512-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5604-368-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5644-374-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5660-518-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5684-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5724-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5740-524-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5764-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5796-530-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5804-398-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5844-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5876-536-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5884-410-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5924-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5956-542-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5964-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6004-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6032-549-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6044-434-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6084-440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6108-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6124-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6152-563-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6196-569-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6240-575-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6280-582-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6320-589-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6364-596-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6408-602-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6452-609-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads