6d45a553712e44382003286d9171af1f70d726b8aaa4a85ae124a1865e575054

Analysis

max time kernel
114s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1e64d1e20c667cb3979383e2db68960N.exe
Size

768KB
MD5

a1e64d1e20c667cb3979383e2db68960
SHA1

424ce0380656eae780508813c24d16838e38fdf6
SHA256

6d45a553712e44382003286d9171af1f70d726b8aaa4a85ae124a1865e575054
SHA512

4da44da0900bd30f2f510dd30a0f156efaf9f1013b06c62ea1421fb6247505d02129380c31e71a5fc2a34db0a4fb7cdf04de1bc1ee6a5ed4878eea6347cfc860
SSDEEP

12288:SKmvx6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGJ:STq5h3q5htaSHFaZRBEYyqmaf2qwiHPX

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ciiaogon.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	a1e64d1e20c667cb3979383e2db68960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmmgof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmbpjfij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddqbbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfonnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acdioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddqbbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ciiaogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bimach32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnjecfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a1e64d1e20c667cb3979383e2db68960N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Defheg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffkhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpqlfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acdioc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blnjecfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdnelpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bimach32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfonnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdgolq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjompqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmahknh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfjeckpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkogqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdgolq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffkhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkogqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfjeckpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmahknh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmifkecb.exe

Executes dropped EXE 36 IoCs

pid	Process
3712	Acdioc32.exe
644	Ammnhilb.exe
4044	Apkjddke.exe
3032	Bemlhj32.exe
3596	Bbalaoda.exe
1332	Bimach32.exe
4676	Blnjecfl.exe
2492	Cmmgof32.exe
1288	Cdgolq32.exe
3508	Cffkhl32.exe
4444	Cdjlap32.exe
3248	Cekhihig.exe
2208	Cmbpjfij.exe
3668	Cpqlfa32.exe
4680	Cdlhgpag.exe
4448	Cfjeckpj.exe
4904	Ciiaogon.exe
1664	Clgmkbna.exe
5048	Cdnelpod.exe
4184	Cfmahknh.exe
4268	Cepadh32.exe
2740	Clijablo.exe
3096	Ddqbbo32.exe
3868	Dfonnk32.exe
3536	Dinjjf32.exe
3920	Dmifkecb.exe
2892	Dpgbgpbe.exe
2568	Dbfoclai.exe
3156	Dedkogqm.exe
3004	Dmkcpdao.exe
4516	Dpjompqc.exe
3516	Dbhlikpf.exe
1256	Defheg32.exe
1536	Dmnpfd32.exe
572	Dpllbp32.exe
2404	Dbkhnk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dihmeahp.dll	Dfonnk32.exe
File created	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Fiinbn32.dll	Dmkcpdao.exe
File opened for modification	C:\Windows\SysWOW64\Apkjddke.exe	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Dbkhnk32.exe	Dpllbp32.exe
File created	C:\Windows\SysWOW64\Bemlhj32.exe	Apkjddke.exe
File opened for modification	C:\Windows\SysWOW64\Bbalaoda.exe	Bemlhj32.exe
File created	C:\Windows\SysWOW64\Cbhkkpon.dll	Blnjecfl.exe
File opened for modification	C:\Windows\SysWOW64\Dedkogqm.exe	Dbfoclai.exe
File created	C:\Windows\SysWOW64\Acdioc32.exe	a1e64d1e20c667cb3979383e2db68960N.exe
File created	C:\Windows\SysWOW64\Cqbolk32.dll	Apkjddke.exe
File created	C:\Windows\SysWOW64\Bimach32.exe	Bbalaoda.exe
File opened for modification	C:\Windows\SysWOW64\Cdjlap32.exe	Cffkhl32.exe
File created	C:\Windows\SysWOW64\Befogbik.dll	Cfmahknh.exe
File opened for modification	C:\Windows\SysWOW64\Clgmkbna.exe	Ciiaogon.exe
File opened for modification	C:\Windows\SysWOW64\Cepadh32.exe	Cfmahknh.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Plmiie32.dll	Ammnhilb.exe
File created	C:\Windows\SysWOW64\Cdjlap32.exe	Cffkhl32.exe
File created	C:\Windows\SysWOW64\Cdnelpod.exe	Clgmkbna.exe
File created	C:\Windows\SysWOW64\Dmabgl32.dll	Bbalaoda.exe
File created	C:\Windows\SysWOW64\Amkejmgc.dll	Cekhihig.exe
File created	C:\Windows\SysWOW64\Idcdeb32.dll	Bemlhj32.exe
File created	C:\Windows\SysWOW64\Cekhihig.exe	Cdjlap32.exe
File created	C:\Windows\SysWOW64\Cfjeckpj.exe	Cdlhgpag.exe
File created	C:\Windows\SysWOW64\Fbelak32.dll	Cepadh32.exe
File created	C:\Windows\SysWOW64\Jgfdkj32.dll	Dbfoclai.exe
File created	C:\Windows\SysWOW64\Idbgcb32.dll	Dedkogqm.exe
File opened for modification	C:\Windows\SysWOW64\Ammnhilb.exe	Acdioc32.exe
File created	C:\Windows\SysWOW64\Clijablo.exe	Cepadh32.exe
File created	C:\Windows\SysWOW64\Dmkcpdao.exe	Dedkogqm.exe
File opened for modification	C:\Windows\SysWOW64\Dmkcpdao.exe	Dedkogqm.exe
File created	C:\Windows\SysWOW64\Dchhia32.dll	Cmmgof32.exe
File created	C:\Windows\SysWOW64\Mkfbmfbn.dll	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Cdlhgpag.exe	Cpqlfa32.exe
File opened for modification	C:\Windows\SysWOW64\Dfonnk32.exe	Ddqbbo32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmahknh.exe	Cdnelpod.exe
File opened for modification	C:\Windows\SysWOW64\Cdnelpod.exe	Clgmkbna.exe
File created	C:\Windows\SysWOW64\Dfonnk32.exe	Ddqbbo32.exe
File opened for modification	C:\Windows\SysWOW64\Dmifkecb.exe	Dinjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Dpgbgpbe.exe	Dmifkecb.exe
File created	C:\Windows\SysWOW64\Defheg32.exe	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Naefjl32.dll	Dpllbp32.exe
File opened for modification	C:\Windows\SysWOW64\Cmmgof32.exe	Blnjecfl.exe
File created	C:\Windows\SysWOW64\Cepadh32.exe	Cfmahknh.exe
File created	C:\Windows\SysWOW64\Ddqbbo32.exe	Clijablo.exe
File opened for modification	C:\Windows\SysWOW64\Defheg32.exe	Dbhlikpf.exe
File created	C:\Windows\SysWOW64\Apkjddke.exe	Ammnhilb.exe
File opened for modification	C:\Windows\SysWOW64\Bimach32.exe	Bbalaoda.exe
File opened for modification	C:\Windows\SysWOW64\Cdgolq32.exe	Cmmgof32.exe
File created	C:\Windows\SysWOW64\Abbbel32.dll	Dinjjf32.exe
File created	C:\Windows\SysWOW64\Dbhlikpf.exe	Dpjompqc.exe
File opened for modification	C:\Windows\SysWOW64\Dbhlikpf.exe	Dpjompqc.exe
File created	C:\Windows\SysWOW64\Cefnemqj.dll	Acdioc32.exe
File created	C:\Windows\SysWOW64\Blnjecfl.exe	Bimach32.exe
File created	C:\Windows\SysWOW64\Clgmkbna.exe	Ciiaogon.exe
File opened for modification	C:\Windows\SysWOW64\Ddqbbo32.exe	Clijablo.exe
File created	C:\Windows\SysWOW64\Cmmgof32.exe	Blnjecfl.exe
File created	C:\Windows\SysWOW64\Cffkhl32.exe	Cdgolq32.exe
File created	C:\Windows\SysWOW64\Djbehfpe.dll	Cdjlap32.exe
File opened for modification	C:\Windows\SysWOW64\Ciiaogon.exe	Cfjeckpj.exe
File opened for modification	C:\Windows\SysWOW64\Blnjecfl.exe	Bimach32.exe
File created	C:\Windows\SysWOW64\Cpqlfa32.exe	Cmbpjfij.exe
File created	C:\Windows\SysWOW64\Bkpjjj32.dll	Ciiaogon.exe

Program crash 1 IoCs

pid	pid_target	Process
4208	2404	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blnjecfl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfjeckpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddqbbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dedkogqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apkjddke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbalaoda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmmgof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmifkecb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmkcpdao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defheg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmnpfd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpllbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemlhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ciiaogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnelpod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1e64d1e20c667cb3979383e2db68960N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acdioc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cekhihig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmahknh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpjompqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bimach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdgolq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpqlfa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhgpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clgmkbna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffkhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ammnhilb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdjlap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cepadh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmbpjfij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clijablo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfonnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dinjjf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbhlikpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbkhnk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djbehfpe.dll"	Cdjlap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfbmfbn.dll"	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpkgac32.dll"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioeiam32.dll"	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clgmkbna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cepadh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddqbbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbalaoda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmahknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clijablo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpllbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bimach32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiinbn32.dll"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladlqj32.dll"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naefjl32.dll"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpjompqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchhia32.dll"	Cmmgof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ciiaogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acdioc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qecnjaee.dll"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a1e64d1e20c667cb3979383e2db68960N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plmiie32.dll"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abbbel32.dll"	Dinjjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbfoclai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bemlhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfdnkk32.dll"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfonnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apkjddke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiagoigj.dll"	Cffkhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idcdeb32.dll"	Bemlhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaohckm.dll"	Clijablo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbhlikpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdgolq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmbpjfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiipk32.dll"	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	a1e64d1e20c667cb3979383e2db68960N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apkjddke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbhkkpon.dll"	Blnjecfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bimach32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbelak32.dll"	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cepadh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkjhlh32.dll"	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dinjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mckfmq32.dll"	Dmnpfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bemlhj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3712	568	a1e64d1e20c667cb3979383e2db68960N.exe	91
PID 568 wrote to memory of 3712	568	a1e64d1e20c667cb3979383e2db68960N.exe	91
PID 568 wrote to memory of 3712	568	a1e64d1e20c667cb3979383e2db68960N.exe	91
PID 3712 wrote to memory of 644	3712	Acdioc32.exe	92
PID 3712 wrote to memory of 644	3712	Acdioc32.exe	92
PID 3712 wrote to memory of 644	3712	Acdioc32.exe	92
PID 644 wrote to memory of 4044	644	Ammnhilb.exe	93
PID 644 wrote to memory of 4044	644	Ammnhilb.exe	93
PID 644 wrote to memory of 4044	644	Ammnhilb.exe	93
PID 4044 wrote to memory of 3032	4044	Apkjddke.exe	95
PID 4044 wrote to memory of 3032	4044	Apkjddke.exe	95
PID 4044 wrote to memory of 3032	4044	Apkjddke.exe	95
PID 3032 wrote to memory of 3596	3032	Bemlhj32.exe	96
PID 3032 wrote to memory of 3596	3032	Bemlhj32.exe	96
PID 3032 wrote to memory of 3596	3032	Bemlhj32.exe	96
PID 3596 wrote to memory of 1332	3596	Bbalaoda.exe	98
PID 3596 wrote to memory of 1332	3596	Bbalaoda.exe	98
PID 3596 wrote to memory of 1332	3596	Bbalaoda.exe	98
PID 1332 wrote to memory of 4676	1332	Bimach32.exe	99
PID 1332 wrote to memory of 4676	1332	Bimach32.exe	99
PID 1332 wrote to memory of 4676	1332	Bimach32.exe	99
PID 4676 wrote to memory of 2492	4676	Blnjecfl.exe	100
PID 4676 wrote to memory of 2492	4676	Blnjecfl.exe	100
PID 4676 wrote to memory of 2492	4676	Blnjecfl.exe	100
PID 2492 wrote to memory of 1288	2492	Cmmgof32.exe	102
PID 2492 wrote to memory of 1288	2492	Cmmgof32.exe	102
PID 2492 wrote to memory of 1288	2492	Cmmgof32.exe	102
PID 1288 wrote to memory of 3508	1288	Cdgolq32.exe	103
PID 1288 wrote to memory of 3508	1288	Cdgolq32.exe	103
PID 1288 wrote to memory of 3508	1288	Cdgolq32.exe	103
PID 3508 wrote to memory of 4444	3508	Cffkhl32.exe	104
PID 3508 wrote to memory of 4444	3508	Cffkhl32.exe	104
PID 3508 wrote to memory of 4444	3508	Cffkhl32.exe	104
PID 4444 wrote to memory of 3248	4444	Cdjlap32.exe	105
PID 4444 wrote to memory of 3248	4444	Cdjlap32.exe	105
PID 4444 wrote to memory of 3248	4444	Cdjlap32.exe	105
PID 3248 wrote to memory of 2208	3248	Cekhihig.exe	106
PID 3248 wrote to memory of 2208	3248	Cekhihig.exe	106
PID 3248 wrote to memory of 2208	3248	Cekhihig.exe	106
PID 2208 wrote to memory of 3668	2208	Cmbpjfij.exe	107
PID 2208 wrote to memory of 3668	2208	Cmbpjfij.exe	107
PID 2208 wrote to memory of 3668	2208	Cmbpjfij.exe	107
PID 3668 wrote to memory of 4680	3668	Cpqlfa32.exe	108
PID 3668 wrote to memory of 4680	3668	Cpqlfa32.exe	108
PID 3668 wrote to memory of 4680	3668	Cpqlfa32.exe	108
PID 4680 wrote to memory of 4448	4680	Cdlhgpag.exe	109
PID 4680 wrote to memory of 4448	4680	Cdlhgpag.exe	109
PID 4680 wrote to memory of 4448	4680	Cdlhgpag.exe	109
PID 4448 wrote to memory of 4904	4448	Cfjeckpj.exe	110
PID 4448 wrote to memory of 4904	4448	Cfjeckpj.exe	110
PID 4448 wrote to memory of 4904	4448	Cfjeckpj.exe	110
PID 4904 wrote to memory of 1664	4904	Ciiaogon.exe	111
PID 4904 wrote to memory of 1664	4904	Ciiaogon.exe	111
PID 4904 wrote to memory of 1664	4904	Ciiaogon.exe	111
PID 1664 wrote to memory of 5048	1664	Clgmkbna.exe	112
PID 1664 wrote to memory of 5048	1664	Clgmkbna.exe	112
PID 1664 wrote to memory of 5048	1664	Clgmkbna.exe	112
PID 5048 wrote to memory of 4184	5048	Cdnelpod.exe	113
PID 5048 wrote to memory of 4184	5048	Cdnelpod.exe	113
PID 5048 wrote to memory of 4184	5048	Cdnelpod.exe	113
PID 4184 wrote to memory of 4268	4184	Cfmahknh.exe	114
PID 4184 wrote to memory of 4268	4184	Cfmahknh.exe	114
PID 4184 wrote to memory of 4268	4184	Cfmahknh.exe	114
PID 4268 wrote to memory of 2740	4268	Cepadh32.exe	115

C:\Users\Admin\AppData\Local\Temp\a1e64d1e20c667cb3979383e2db68960N.exe
"C:\Users\Admin\AppData\Local\Temp\a1e64d1e20c667cb3979383e2db68960N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\Acdioc32.exe
  C:\Windows\system32\Acdioc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\Ammnhilb.exe
    C:\Windows\system32\Ammnhilb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\SysWOW64\Apkjddke.exe
      C:\Windows\system32\Apkjddke.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1332
        
        C:\Windows\SysWOW64\Blnjecfl.exe
        
        C:\Windows\system32\Blnjecfl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Cffkhl32.exe
        
        C:\Windows\system32\Cffkhl32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Cdjlap32.exe
        
        C:\Windows\system32\Cdjlap32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3868
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3920
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2568
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3156
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3004
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:572
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 400
        38⤵
        Program crash
        
        PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2404 -ip 2404
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acdioc32.exe

Filesize
768KB

MD5
73d3f002a246c859ad75ba36f0fbea5c

SHA1
a2e2172b596bb66d54238e0d7570d2704ba09990

SHA256
b0a3752be8e1f68b76a662f148884cf1a672e8e0faade1ff8fcbfdf31e61f4e0

SHA512
89d9fd0b4b281dedb35336e9c03f95eb3c345499ffecac99c00c42230b08b0b2eeca31d8e2f5c7651381e940602ef32817bfb545d64a770b4dabea7f99099328

Download Submit
C:\Windows\SysWOW64\Ammnhilb.exe

Filesize
768KB

MD5
0757d7a9f43ca4717f3cf97dce5b279a

SHA1
7bd20fa0703d28e6717af977310fd15945c2adb4

SHA256
002ba2d1868a178fdeead96a93dc86b9b04df715e09c4aeae79aeaa986450708

SHA512
55a53021d917d6ab25ae8c07caf58fd074721f4f7981b03ee4a9aaf5023df37ff4b88668718a7c1829a0c678ed16b3c067449c9519dcab09128da0924393d34a

Download Submit
C:\Windows\SysWOW64\Apkjddke.exe

Filesize
768KB

MD5
4b714ce178e7881b23844186ce657571

SHA1
a05d712424334be9eedf1c70d45427cd49158030

SHA256
409d464c9a34eaf65ace2f283161ccd690c36f005c2de9d8a087b36ecba920c5

SHA512
36928718d7b8e9d19e564dc8b4ea29e99eb746eecbbfc7960fefa03f0380500f012ea0c5488c525f2f6052f76db8b56d0e40011a3743f5509d51d5e7e32bcf13

Download Submit
C:\Windows\SysWOW64\Bbalaoda.exe

Filesize
768KB

MD5
dc855b9921b050b85ee695413c2ca2bd

SHA1
84c744f432b8ebba387510ad89963f9c7cd08f64

SHA256
42a01106670320baaea42b9e02ecf3f896219095e0eecc8cc1690798e4dab961

SHA512
ce1faa2c84b4caa9fe332de8073f2a2e0f47d4086713626f03ee1613f87c392d6d6eeb5409420c0d45565cc7c0996f0007682f8479187cda30c6df1638f84836

Download Submit
C:\Windows\SysWOW64\Bemlhj32.exe

Filesize
768KB

MD5
b4be2bb15014b1b89ebc7df29920449c

SHA1
b73d25110f7e53bf09f2e1b90dab390227f2afb2

SHA256
c15653941ff294e5b6f6c963707db91979f0fedbfe174d47d06b97edfc1b2fd1

SHA512
941b4ff5272c06d523cacb3f339b15316e11604118e83236ba85e41a2a12c5f58aea499c5bd5cec12872f197527611105addcd884cfb4800a6e111148f7f99ce

Download Submit
C:\Windows\SysWOW64\Bimach32.exe

Filesize
768KB

MD5
9ce2d0005405f83d42583efa724bdfa3

SHA1
f13358643f0831217830a68108701113f91bb076

SHA256
b2c9c2e02b8362bd66122991f67821c20be4282eee491dd29948f9d7f5dc36e0

SHA512
0b4f8a3e9c49819868cd9e9346bcb2fc2f824d7531a6ec9fa604a7f0aadabb4778328031c6dadf772427b6cb6ef686070c595f5ce2fafd1c52b2bd38a96c2aa4

Download Submit
C:\Windows\SysWOW64\Blnjecfl.exe

Filesize
768KB

MD5
c4fa4e7836ee794844f18a7b3c52d70e

SHA1
542905c972fe8b39d3d68482d05f03538e87b9db

SHA256
a6927a52a01f7bed09b39304ff782237d15856f6ec2fe118fd817d58dec06798

SHA512
4630c2c61cd747d1ea4f72600d98a21c5d989748b48fb1c435b58ba0980f73fd4d3cc01fd550e18388510fbb8c4c05c77e3b5b52216110a78fc5c0d01889b56d

Download Submit
C:\Windows\SysWOW64\Cdgolq32.exe

Filesize
768KB

MD5
536b0d4e6e8a785c8eb42201a76178be

SHA1
f29f6782b3a50b25f4f3c6697f3355698dd12bed

SHA256
82cf4f29ecd0087e75d4a3c7b0121041e73d5d5ef75667a68a4b2658bb522487

SHA512
63c6e881f92bbdc9e8648649417620ef6fbbec52e21574fbae2c201955dd2acc30d1baedca76df125d4aaadfd33406f34776ba979555c0d85e48a74d271ec546

Download Submit
C:\Windows\SysWOW64\Cdjlap32.exe

Filesize
768KB

MD5
95ceba5c4e42ea5b40d5bc090b45d361

SHA1
c6a9201c6c313dde34472f88c0b4e36b7e1569a9

SHA256
7bb9ce2beb1347574ab75d7deabce30ddba6d142caf422bf4a8b7c3de615dbb4

SHA512
46b28c7f04d33d7a1ecd818ccbf32e314202f6ccf680c76e1fe3aa5c033e503328ba268b02fee76c2011b08fa888ba5954e45f0eee69d32e1a07fa1ce8e13620

Download Submit
C:\Windows\SysWOW64\Cdlhgpag.exe

Filesize
768KB

MD5
3a3752e9e1c81544789e8ce9d40aca25

SHA1
936a1644665d3103cc8404ed5b416a8a5e03a155

SHA256
6ba3b17c3da5b54ca708687b55004b11f966f02409d7283f245f64a56654a2fa

SHA512
0bffaf5823da233c83b32912df55accd4f660dee716dd18757314acad2577735b7ecf5b4106f180328b7fbd0c53b0bc804529cbf8cbfb47b5f9cec079c5b9b1f

Download Submit
C:\Windows\SysWOW64\Cdnelpod.exe

Filesize
768KB

MD5
c3471dac2c1ec98533ddc5f6f0af3fbe

SHA1
f2cbc6dbcec180f344d6d54afed40a91c9885fce

SHA256
ab3fd8fc545aa33e503c6bdc77791228d62d63dd1642c2d38e47d3a2e646a55a

SHA512
d15c5721b16dda0969663481e52ed9b3ad9b09765529f6f905ca403b0b7b712f5e1c128edbfddea1ee7c7fa0844c41cda67181eac5a9681e32318f63ca37c8e5

Download Submit
C:\Windows\SysWOW64\Cekhihig.exe

Filesize
768KB

MD5
adca46d09b3e8b71b917ed359007ceb1

SHA1
0816681f3abe20b3bd0d2e30e8aa351eb61fbeb4

SHA256
d0667236d531434a978904c051826aed2090b52bb00b72fbda879b28baf53bef

SHA512
f6645a33893fb3728fd0d9d60cefbe761eced4dbfb59dc5af538dbf1a34bd06db09734a848cc6782642d579251ce65586ca636493cb06e9d4016c4baf619bf89

Download Submit
C:\Windows\SysWOW64\Cepadh32.exe

Filesize
768KB

MD5
38b82fe4958dcb39111be413484ee301

SHA1
855638854427198e87cf53f201599aa2b03ae0cf

SHA256
90a3b7af9c67671e2ad9e96db982c5d32ddf2249d83a3f0fad1ffaf8cfe4491b

SHA512
c73a7235520e1556aba77045181e694cdcd94d869ca71734b192be069fd7bc4520db6d8f40bf86f36b6cb3eba85633fd842971d89a04316580e22626504adc5f

Download Submit
C:\Windows\SysWOW64\Cffkhl32.exe

Filesize
768KB

MD5
022267ed0270857a21940ba4f0a2b2c4

SHA1
f5691d640edcf246cb23625ff8f81e73914cc19c

SHA256
1f87d8d2e6584f2ce646e687b1abc9f1a0ee94a0190146786bb7752231f4b00d

SHA512
51e87b42496686663b6d614683ceed325a320a7c2e8d92b826c71194eebbb049ef945f353924328661761dae194dd2d78847b57eee45eb45e30f913b0e15e35b

Download Submit
C:\Windows\SysWOW64\Cfjeckpj.exe

Filesize
768KB

MD5
58305c730ff68aa1647e612783e6393d

SHA1
6afc4acd87e799ab51154bdfbaa0f69e05a002dc

SHA256
3fd97e7f2581bfb82465793b736bc2292263a283bee30bc5f7feed0af3db2111

SHA512
6d5b4723eae4c183b34813582e92ff76c4fca06f654af8cd190584dbb3b4d3ade4275bfd7d1f273eb5bfec7644b94f69b9c637ac05674b5373ef94e9b54bb988

Download Submit
C:\Windows\SysWOW64\Cfmahknh.exe

Filesize
768KB

MD5
1e11e2fae53e9c22aea05de46af54ae0

SHA1
1f3c5079615888b06c2548af003715e67b7615fd

SHA256
8d4d1ad27b394782ade643716aa7e482181753623f7f123eec3dcfc057c24eea

SHA512
2ae4a9c6a68c86cf8bebda214e9cfeb8ff84865181b30078da6847a9b58a36fd88c085b55d2741ce6309cd50f85b698004a49a3174585944ecd850cf0dc6cef1

Download Submit
C:\Windows\SysWOW64\Ciiaogon.exe

Filesize
768KB

MD5
b9eba5b38697dcf948086448daed3306

SHA1
d2984a4b6fcae5492530d20316d33d9ba135d3b9

SHA256
45677dd215d24a00cc319e92e53735c0f1236fe19be5fee7aa942c055a7f1716

SHA512
cf05cb646af833c025c3c10ae6e4fc13888ab5c312a9512c0687eda7bed3915abedc7d368745488f3051076f4b0a2204184f1d4885df2fff3228db20f75ea040

Download Submit
C:\Windows\SysWOW64\Clgmkbna.exe

Filesize
768KB

MD5
0c247a554bdcb5936e28213c0b445625

SHA1
4e470b1fff0c30e3714330fc29fd5ad62b65bbec

SHA256
0e3f3209f7a43717a45ff8e5de4aa949ebc057ef10ef86cebd9b904a6927877e

SHA512
d9930a90c6161d58cba2af6c71cec92759e16303f1b8b6c743082083c4ce714df6fe8737296857e7482d28034242e8be6430c8a5889a25a61b6f446234c1c9b2

Download Submit
C:\Windows\SysWOW64\Clijablo.exe

Filesize
768KB

MD5
f2ba8434425f11bc52e770b575ea3c60

SHA1
64c51845054992e95648887a047d8554ad5f7bcb

SHA256
4b9729f11995d4bd5400430c7ec5b8523e48741d2a56c84dcedf3baa743ac3ef

SHA512
99e9da8e49aa22b16d899adaedf340023000beb61ad202e4c0d858a5c7d00afc732d11bd3d33487fa74e2aeeda100ae9398af0719cb96ff36ae9c8f666b60bab

Download Submit
C:\Windows\SysWOW64\Cmbpjfij.exe

Filesize
768KB

MD5
3a4346056d94bf14e7f2ddc577db7008

SHA1
fa7a4115237382e1c1b4c33a6c9c659b3c49cf77

SHA256
aa406cfdf961d2cec02b6dc948e2be5116281656dd7f975996f3b0ed8f8e7b02

SHA512
22facd662432a063a69f41c83cf7ff479dc74da8a58b74e023a5b3083750c67ed1c3f1bc8b92ddeaa95bc258e48aa5e64e017b26de7aa6400448fd640247c095

Download Submit
C:\Windows\SysWOW64\Cmmgof32.exe

Filesize
768KB

MD5
391fc4c92c8055f61f781a89893aec52

SHA1
47982c4975a53eb04db70fadecefa4521eb079db

SHA256
9f969794215fc83075caa9d74737558272c7d635381bf38733ad6672236a5816

SHA512
79729e37180d6e0a5fc56c6ea8dba2486418d4af5f37ff92a09454c39d850c105ec641bdb31a8bb86649f379ed2ba6ac11077ff01e8d8cf3ed6614f5fa4d3a2e

Download Submit
C:\Windows\SysWOW64\Cpqlfa32.exe

Filesize
768KB

MD5
ceb29683b830cc006d48b1fee9fb40b3

SHA1
975abfb7dccef09216727156f2e3cd993d133102

SHA256
5261373a79378ba6c6f5df117afbfc8b4141719f39d11fca8fe2c09b3cc7f82b

SHA512
13c643a49389322070109e39bca195a96d06bfcc4ecf7e23a03fab9a5cbc43861ce0989c546de7718649d7d40b9b85fa1743e3f5eff0c8b89d4703328f928644

Download Submit
C:\Windows\SysWOW64\Dbfoclai.exe

Filesize
768KB

MD5
634b6c0c71af78f1adad443be64aeeb8

SHA1
757893d9c204d5decf8e29bf2a44a06cbfc96cb2

SHA256
665c7be002b85c2817acfdf189ce144329dbc91d77ac1ed843107787f80d3b3a

SHA512
da235465438dff226b9d198eebd2d2339f33bc3779eba5ff7fdb8d6bba1a9f27f8a2b3dc084484915166275536ee9243538bc943446e8323d8994a9df392008b

Download Submit
C:\Windows\SysWOW64\Dbhlikpf.exe

Filesize
768KB

MD5
d4ac7d6cb19ca3556259479cb44db717

SHA1
e672cafb64045eab6602002eecb2d8c460594f58

SHA256
4f1a3e92e12cac4bbd9f226d57a04a520f43c8c8a81ea89b5a3ea30c31808274

SHA512
84f918f50fa2f171c235e284ec5174ae772b2f3b8adf5ab290b4dfc82a35676cb83860f3451282d8c6dc09a288c041b0804521f057e487272050c79bdc277be4

Download Submit
C:\Windows\SysWOW64\Ddqbbo32.exe

Filesize
768KB

MD5
80aa24c548648eed864e0e4a2835592d

SHA1
33088d2819bb052766afe148f0d862d8b4dcd4a8

SHA256
a7f63d11036105cfc99c8074ee085a97ca44918169d75a833f8e59baafc0c5b2

SHA512
731ec3ad53af6161bdbbc59aa3276c6ecdfa31a88c1f9e2d04562f879527d3efc5cb62f0e678cbc649ead588f95b722e4960e14a60d79876c8e021a0634596af

Download Submit
C:\Windows\SysWOW64\Dedkogqm.exe

Filesize
768KB

MD5
9b1a6622ec1d9e1434c58dd505f9c325

SHA1
719d99c04b0fa2483f0e002ec362fb2db140bc6e

SHA256
454e5c372961d5af9ac229cf48c873739117ca769426110715f63c7696e5d2ac

SHA512
0b89bbec9734cea7738569d5b174aa8fba639bd7914d40571a1a53618dc8fdf4a7b09a8d11c5c39a69cd42f0bc173c4b4e15373a83e45f76d370244d67210492

Download Submit
C:\Windows\SysWOW64\Dfonnk32.exe

Filesize
768KB

MD5
f99c71392927a684d903aadbcaa612c5

SHA1
2b0c07bac526f749ea89f160a7011878f7ffffc7

SHA256
b8991bf5392e945b1457c0e6916e8d0789fbe6a4e02f66c4f709d907bc4ba6d2

SHA512
11f12e51d37af84c0a5c6fe3db81b994a8a32051d5d0d0996e96e868b0f3ae4ae3e88fe15d79c8987a9e6dc5e479f1d29366e69d77e3a492d31182e3986e9523

Download Submit
C:\Windows\SysWOW64\Dinjjf32.exe

Filesize
768KB

MD5
91f64230f33ab4b8c0403800bb2d9c80

SHA1
6f3eebdfcd7522a6a61679c91045191eb3e9e269

SHA256
58f4bf72f0aa47f2c22ced4291afecb3841c2211772cb861ded01b5a86c3a4e7

SHA512
b67e2ab098c2c2d345cd78c78f0fe5c793d97c9eed8299b729458245ed87f32616708566bbf2bcac411154a591b3740d7c42e410ac60674e28980e11965fb775

Download Submit
C:\Windows\SysWOW64\Dmifkecb.exe

Filesize
768KB

MD5
0856d6751dd96da63016dfe4aeea253f

SHA1
7e8de92f44aecbc0bc398904189a31037d71e91d

SHA256
2f422919a215cad0f437fee745293a07dedcdc782d4b43e6e9967df2b47a9150

SHA512
1a8d66ac8e6db14b18b61955dde1b9f25af68eb5cbeb67e2492812452098e38e0c322d5a297fa00f983a6da389fc93046357bb6d351342860108f53d61998594

Download Submit
C:\Windows\SysWOW64\Dmkcpdao.exe

Filesize
768KB

MD5
fbcd0138e13394671a9d1f30388758f9

SHA1
09616df6aca601193bd66143e836872d659c9046

SHA256
bdf59787009696af90baf4b93a59dc7dccdd0b921eed5a90bf082f3524443fed

SHA512
3b85c1326c6394057c2c143c899c26f1b4e06fbf62cba8e539ad14053157cf16761f56995fcf67a6503d159a13ba069ed16950294cf6934227430c33ad5fb11f

Download Submit
C:\Windows\SysWOW64\Dpgbgpbe.exe

Filesize
768KB

MD5
db317a844c1b07dc0ef732e589868428

SHA1
2580094d75e8f33e97b15caf7985c1f924e2003e

SHA256
47a7cac04a4caf63d07ad3cc07da915e117ba96c6930029431143e5a84b841f8

SHA512
8ac732c1128beb755954f48fd12669b199fbc973f1f3ae87ae444ed53e63495cdcb3cff950075de8e7b63a3dbbe60bdb0657d38ad7ee24393236fd5bb3fb9984

Download Submit
C:\Windows\SysWOW64\Dpjompqc.exe

Filesize
768KB

MD5
9e0e557c2cde67222553664c8cb1b9b7

SHA1
462d9dd2a9ac069544add4fc64b5f804a5a56383

SHA256
e92caa2f6c915a51c823a445a3b3ca6d749d8e37b2693192f34d2810fde550e7

SHA512
e7b519acf89115f4972b773028961fb40d8ad64e3c43c569fa3ef192098221530501775c97cbc93915b3596b662abafee5ae8a38dd539ca08fc5deca00615cb1

Download Submit
memory/568-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/568-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/568-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/572-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/644-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1288-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1332-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1332-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1664-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2208-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2404-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2568-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2740-181-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2892-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3032-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3508-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3536-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3596-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3596-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3868-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4184-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-93-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4676-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5048-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads