e5c8cba5875226ab2fd73d9bee08517270c945569495005da9b0741bb433ad2f

Analysis

max time kernel
101s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bb8b797604d4a9ef70ec94036bdfa80N.exe
Size

94KB
MD5

6bb8b797604d4a9ef70ec94036bdfa80
SHA1

5ff2864c8ffa7209a35b6f0cb530bdadebc04c05
SHA256

e5c8cba5875226ab2fd73d9bee08517270c945569495005da9b0741bb433ad2f
SHA512

66a3bf47cf591f5431564316fd7111a7f23faad6969fe50f3cc0b21027b747e877081488f6efad30bae8bf6937c1d870084d276325f283a22f002c2034803a80
SSDEEP

1536:cDZf3jWT0R6QEt4XTATGQ67gPu5bHgXcW/PY8OULaI7BR9L4DT2EnINs:bIRuqjAPvP02T/dVN6+ob

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iejcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeklag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe

Executes dropped EXE 64 IoCs

pid	Process
4492	Iblfnn32.exe
1856	Iejcji32.exe
1080	Imakkfdg.exe
3440	Ippggbck.exe
868	Ifjodl32.exe
5076	Iemppiab.exe
4280	Ilghlc32.exe
4468	Icnpmp32.exe
2504	Ifllil32.exe
5012	Iikhfg32.exe
1468	Ipdqba32.exe
4592	Jfoiokfb.exe
4840	Jeaikh32.exe
1424	Jlkagbej.exe
4112	Jbeidl32.exe
936	Jioaqfcc.exe
1620	Jcefno32.exe
2912	Jfcbjk32.exe
2824	Jianff32.exe
4016	Jlpkba32.exe
1948	Jfeopj32.exe
4872	Jidklf32.exe
4300	Jlbgha32.exe
4504	Jcioiood.exe
4488	Jeklag32.exe
3008	Jmbdbd32.exe
380	Jpppnp32.exe
3484	Jcllonma.exe
4768	Kboljk32.exe
3944	Kfjhkjle.exe
1708	Kiidgeki.exe
2188	Kdnidn32.exe
3360	Kbaipkbi.exe
4040	Kfmepi32.exe
3748	Kmfmmcbo.exe
1608	Klimip32.exe
464	Kdqejn32.exe
3616	Kfoafi32.exe
3084	Kimnbd32.exe
3700	Klljnp32.exe
1180	Kdcbom32.exe
3976	Kfankifm.exe
3216	Kipkhdeq.exe
2412	Kmkfhc32.exe
1964	Kpjcdn32.exe
3112	Kbhoqj32.exe
3108	Kefkme32.exe
5100	Kmncnb32.exe
4596	Kplpjn32.exe
4600	Lbjlfi32.exe
4888	Lffhfh32.exe
1064	Liddbc32.exe
1644	Llcpoo32.exe
2236	Ldjhpl32.exe
2724	Lfhdlh32.exe
2612	Lekehdgp.exe
3836	Llemdo32.exe
4900	Lboeaifi.exe
736	Lenamdem.exe
5016	Lmdina32.exe
3352	Lpcfkm32.exe
1056	Lgmngglp.exe
3852	Likjcbkc.exe
816	Lmgfda32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gcbifaej.dll	Jeaikh32.exe
File opened for modification	C:\Windows\SysWOW64\Melnob32.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Eghpcp32.dll	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Ncbknfed.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Bnmcjg32.exe	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Kdnidn32.exe	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Kbaipkbi.exe	Kdnidn32.exe
File opened for modification	C:\Windows\SysWOW64\Klimip32.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Codqon32.dll	Nngokoej.exe
File opened for modification	C:\Windows\SysWOW64\Ipdqba32.exe	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Kfoafi32.exe	Kdqejn32.exe
File opened for modification	C:\Windows\SysWOW64\Pclgkb32.exe	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Mnbcedcn.dll	Icnpmp32.exe
File created	C:\Windows\SysWOW64\Ngpccdlj.exe	Ncdgcf32.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Chempj32.dll	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Kmkfhc32.exe
File opened for modification	C:\Windows\SysWOW64\Nlaegk32.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Lgepdkpo.dll	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Ogpmjb32.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Ecaobgnf.dll	Mipcob32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Ofeilobp.exe	Ogbipa32.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pqbdjfln.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Ippggbck.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Jidklf32.exe	Jfeopj32.exe
File opened for modification	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Kplpjn32.exe	Kmncnb32.exe
File opened for modification	C:\Windows\SysWOW64\Pjmehkqk.exe	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Hdhpgj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File created	C:\Windows\SysWOW64\Eikdngcl.dll	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Kmncnb32.exe	Kefkme32.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Mmpijp32.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Lffnijnj.dll	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Kmfiloih.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Kboljk32.exe	Jcllonma.exe
File opened for modification	C:\Windows\SysWOW64\Mpjlklok.exe	Mipcob32.exe
File created	C:\Windows\SysWOW64\Mmbfpp32.exe	Migjoaaf.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Mgkjhe32.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Nkenegog.dll	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Mjbbkg32.dll	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File opened for modification	C:\Windows\SysWOW64\Jcefno32.exe	Jioaqfcc.exe
File opened for modification	C:\Windows\SysWOW64\Jianff32.exe	Jfcbjk32.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File opened for modification	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7376	7104	WerFault.exe	319

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpccdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iblfnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kboljk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmncnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neeqea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llemdo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjolnaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pncgmkmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lffhfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdqba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcbmka32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlpkba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlaegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjcdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nphhmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imakkfdg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfmepi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdkcde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lingibiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmbfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfaigm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lgmngglp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfoiokfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpppnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlaml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfjhkjle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimip32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	6bb8b797604d4a9ef70ec94036bdfa80N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqdqof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmbplc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lommhphi.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmehcnhg.dll"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlden32.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnjpohk.dll"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkgoikdb.dll"	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jianff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kboljk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlingkpe.dll"	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afomjffg.dll"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efjecajf.dll"	Kmkfhc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4492	1768	6bb8b797604d4a9ef70ec94036bdfa80N.exe	85
PID 1768 wrote to memory of 4492	1768	6bb8b797604d4a9ef70ec94036bdfa80N.exe	85
PID 1768 wrote to memory of 4492	1768	6bb8b797604d4a9ef70ec94036bdfa80N.exe	85
PID 4492 wrote to memory of 1856	4492	Iblfnn32.exe	86
PID 4492 wrote to memory of 1856	4492	Iblfnn32.exe	86
PID 4492 wrote to memory of 1856	4492	Iblfnn32.exe	86
PID 1856 wrote to memory of 1080	1856	Iejcji32.exe	87
PID 1856 wrote to memory of 1080	1856	Iejcji32.exe	87
PID 1856 wrote to memory of 1080	1856	Iejcji32.exe	87
PID 1080 wrote to memory of 3440	1080	Imakkfdg.exe	88
PID 1080 wrote to memory of 3440	1080	Imakkfdg.exe	88
PID 1080 wrote to memory of 3440	1080	Imakkfdg.exe	88
PID 3440 wrote to memory of 868	3440	Ippggbck.exe	89
PID 3440 wrote to memory of 868	3440	Ippggbck.exe	89
PID 3440 wrote to memory of 868	3440	Ippggbck.exe	89
PID 868 wrote to memory of 5076	868	Ifjodl32.exe	90
PID 868 wrote to memory of 5076	868	Ifjodl32.exe	90
PID 868 wrote to memory of 5076	868	Ifjodl32.exe	90
PID 5076 wrote to memory of 4280	5076	Iemppiab.exe	91
PID 5076 wrote to memory of 4280	5076	Iemppiab.exe	91
PID 5076 wrote to memory of 4280	5076	Iemppiab.exe	91
PID 4280 wrote to memory of 4468	4280	Ilghlc32.exe	92
PID 4280 wrote to memory of 4468	4280	Ilghlc32.exe	92
PID 4280 wrote to memory of 4468	4280	Ilghlc32.exe	92
PID 4468 wrote to memory of 2504	4468	Icnpmp32.exe	93
PID 4468 wrote to memory of 2504	4468	Icnpmp32.exe	93
PID 4468 wrote to memory of 2504	4468	Icnpmp32.exe	93
PID 2504 wrote to memory of 5012	2504	Ifllil32.exe	94
PID 2504 wrote to memory of 5012	2504	Ifllil32.exe	94
PID 2504 wrote to memory of 5012	2504	Ifllil32.exe	94
PID 5012 wrote to memory of 1468	5012	Iikhfg32.exe	95
PID 5012 wrote to memory of 1468	5012	Iikhfg32.exe	95
PID 5012 wrote to memory of 1468	5012	Iikhfg32.exe	95
PID 1468 wrote to memory of 4592	1468	Ipdqba32.exe	96
PID 1468 wrote to memory of 4592	1468	Ipdqba32.exe	96
PID 1468 wrote to memory of 4592	1468	Ipdqba32.exe	96
PID 4592 wrote to memory of 4840	4592	Jfoiokfb.exe	97
PID 4592 wrote to memory of 4840	4592	Jfoiokfb.exe	97
PID 4592 wrote to memory of 4840	4592	Jfoiokfb.exe	97
PID 4840 wrote to memory of 1424	4840	Jeaikh32.exe	99
PID 4840 wrote to memory of 1424	4840	Jeaikh32.exe	99
PID 4840 wrote to memory of 1424	4840	Jeaikh32.exe	99
PID 1424 wrote to memory of 4112	1424	Jlkagbej.exe	100
PID 1424 wrote to memory of 4112	1424	Jlkagbej.exe	100
PID 1424 wrote to memory of 4112	1424	Jlkagbej.exe	100
PID 4112 wrote to memory of 936	4112	Jbeidl32.exe	101
PID 4112 wrote to memory of 936	4112	Jbeidl32.exe	101
PID 4112 wrote to memory of 936	4112	Jbeidl32.exe	101
PID 936 wrote to memory of 1620	936	Jioaqfcc.exe	102
PID 936 wrote to memory of 1620	936	Jioaqfcc.exe	102
PID 936 wrote to memory of 1620	936	Jioaqfcc.exe	102
PID 1620 wrote to memory of 2912	1620	Jcefno32.exe	103
PID 1620 wrote to memory of 2912	1620	Jcefno32.exe	103
PID 1620 wrote to memory of 2912	1620	Jcefno32.exe	103
PID 2912 wrote to memory of 2824	2912	Jfcbjk32.exe	104
PID 2912 wrote to memory of 2824	2912	Jfcbjk32.exe	104
PID 2912 wrote to memory of 2824	2912	Jfcbjk32.exe	104
PID 2824 wrote to memory of 4016	2824	Jianff32.exe	105
PID 2824 wrote to memory of 4016	2824	Jianff32.exe	105
PID 2824 wrote to memory of 4016	2824	Jianff32.exe	105
PID 4016 wrote to memory of 1948	4016	Jlpkba32.exe	106
PID 4016 wrote to memory of 1948	4016	Jlpkba32.exe	106
PID 4016 wrote to memory of 1948	4016	Jlpkba32.exe	106
PID 1948 wrote to memory of 4872	1948	Jfeopj32.exe	108

C:\Users\Admin\AppData\Local\Temp\6bb8b797604d4a9ef70ec94036bdfa80N.exe
"C:\Users\Admin\AppData\Local\Temp\6bb8b797604d4a9ef70ec94036bdfa80N.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\Iblfnn32.exe
  C:\Windows\system32\Iblfnn32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\Iejcji32.exe
    C:\Windows\system32\Iejcji32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\SysWOW64\Imakkfdg.exe
      C:\Windows\system32\Imakkfdg.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3440
      - C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5076
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2504
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        23⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        27⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1708
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        34⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4040
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3748
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:464
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        39⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        40⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        43⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1964
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        47⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        50⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        51⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        53⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        56⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        57⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3836
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        62⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        66⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        67⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        70⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        71⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        72⤵
        Drops file in System32 directory
        
        PID:1564
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1680
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        74⤵
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2572
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:388
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        77⤵
        Drops file in System32 directory
        
        PID:4416
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        78⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        79⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        80⤵
        Drops file in System32 directory
        
        PID:1756
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1904
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        82⤵
        Drops file in System32 directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        84⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        85⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        86⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        89⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        90⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        91⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        94⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        95⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        98⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        99⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        100⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        101⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        102⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        104⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        107⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        108⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        109⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        110⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        111⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        112⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        113⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        115⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        116⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        121⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        125⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        126⤵
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        127⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        128⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        129⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        132⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        133⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        138⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        140⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        141⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        144⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        147⤵
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6932
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        151⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        152⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        153⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        154⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        155⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        157⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        158⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:6464
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        160⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        162⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        164⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6920
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        166⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        169⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        171⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        172⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        173⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        174⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:7004
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        178⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        180⤵
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        181⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        182⤵
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1436
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        185⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        186⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        187⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        188⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        192⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        195⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        196⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        203⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        205⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        206⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        209⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        210⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        212⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        214⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        216⤵
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7372
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        218⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        219⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        221⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        222⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        226⤵
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        227⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        228⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 216
        229⤵
        Program crash
        
        PID:7376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7104 -ip 7104
1⤵
PID:7288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amgapeea.exe

Filesize
94KB

MD5
b4578acec51c9b3789dd65e145f294d5

SHA1
4501c7a163f295feb6a0d0b561ef8baaeaeea1bd

SHA256
f1a2fddb05a71e2514caad389a1dd571bed01b20d0fe57f8cddbe91d76a8dcab

SHA512
9e51af7ff304358edb8791322503dfa66383183b64162c3e9ccc04b2440841252d645682579cf8cc60246a0bf1bae70bab90bab34abad67521ced4fdde4c28ce

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
94KB

MD5
eab5eb5c3417ea8d5c77e972fa11bfd6

SHA1
15806cc881f2b368e7bdb724d945792a3b0cca76

SHA256
72ffb456cfdcbb8da654ac30fb1e648182a4e246b424ae0255c500ddd298e1aa

SHA512
5163ff6126b4f48b45cf611ca1385dc3c1a4ea90a4230c0dadf008f1f6ee8ae0420b88057fb9bd9ec61de50d014f8b9f259e0e8783e7cecb4f14345b7f0b5715

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
94KB

MD5
6b99881cd777bced3811e9172deb590a

SHA1
e1000975775a8cb7a0f883e5ef313767e1701fd3

SHA256
a0bc3d9d1c00bae40c8eb16a35f84e2b25248552e777934fee7e7ebb8cd099ea

SHA512
6dac71f192b13193d75bce5075be932a910dc3f8e6605210f31665ede4ccf8aeec129792916c96d2849dd826c1965146b79f8f7bb2539d705ce56d22d7d56b82

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
94KB

MD5
94f40a82ca29b431736cb7dd0b9d749a

SHA1
30eaa1adfc2786f2d943544bf08b5596b65b47e2

SHA256
66555c4d7b4f02296220e1053787bd10e74ffbceb8cafdf482c8e8d185202ddf

SHA512
f4c8ad8278be5f31472c8301a8e5bda610cab6951b8a889a5183298b57214c740df82e7ecae0e386bb76d085443117a1a73c459a509ba260027648efdac81259

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
94KB

MD5
3d48c585f2a478953dfeb1716a265fbb

SHA1
d331e64c4d20249e770d72dfb95feff3f2f0ded3

SHA256
f5312694a657697d1c476cd4c1f1ea0070a63bc6a2004bbc559618664673aaa0

SHA512
fe53d0e533d1984fbd4366e4b4139762a960fb287cbcf540c59c29e5a0408036800f7ae38dd5b96756b409775e333a3f6dee6b093bab45e34e924cc87f3da6c3

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
94KB

MD5
55c39a2ab2aebe19c24389a870efc3f1

SHA1
19d387152de55adea0a13084a27aeac3837d5e9d

SHA256
ab108208b5b83b201fc139d353abc013224abad850e3728953ed4a21479b1988

SHA512
b5f765f0be098ad0a26810befea44b81d4fcc2684deaeba74b589c64fdd4e529e31a85adf8c9c8f142ff8b72c06b19397a36574eeaa43b9708c44b5234f19b48

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
94KB

MD5
ec8b001fa9c5e17302d675bddfb6de05

SHA1
2f4d5011ef8bd712f2c2d451f37a254f0ab12af4

SHA256
5703e8f20f2e716bbad471e248ac057018ba7ae16d12011a0f7f621d8dc5cff4

SHA512
c6614ce3361f260e3f3100949563e39198f220721b9d2c8844642dddff11c077582def992b48275fa13f9dd2075783443ebc5cb6a73850479adf5dcae4662574

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
94KB

MD5
de5688f50a61dfc6faa38a315bfea6b1

SHA1
240dab54944644008cad05290c88271e103d1172

SHA256
ba6bd9a48f5a478b674484afc0cd1b440404fe52f3379f282e00c74864e50c5b

SHA512
abb1ce5abd32c14a966b2735d9f598bcf9cb24f86d2cf331b41eb15f9d8d8ee76b3651b4d873cc5504de79879637fdcd9005c8518713f802d33161042fabf20f

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
94KB

MD5
7fff83c9fe1c407f7dce48e537093582

SHA1
be0e696b30de71b59aca35437b2348b90e45795d

SHA256
3ea40908105b70742dbe4818fc9f0a5298df05f7b3ca157b1500614331e5c1ca

SHA512
79cf32678643cf558681416c8065b1f170a11e008629019290536740101a5b56f039744cb62cd790171419c4b5b32f44f419d2dbc079eff75139365b89537e6e

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
94KB

MD5
804acb2574dd47a667d0d8376ea4857e

SHA1
74c3a1e6e5a1aa2b9b0026a5d8b50ccb69868b44

SHA256
32b1f902ae0333665a34ec9391f0ccaef537c2ccf704b846b3d5ae8f1ba48655

SHA512
83d3aa3b057f0c2957d815567e578c2511b69349ec9fa0c072b27bbfc41e55e86d14b420469add83b615006909f6bdc5db0fa9c11942bd09bf7aaa21acf2011e

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
94KB

MD5
46dcc4c02efce2ad43ae3135b1fe95bf

SHA1
0d1bd8c87d8aa45a4b9627e33310c7d10b25965c

SHA256
db95b08f7d2aa286e5cdbba55ce9fdc6513fc20ada1cd98f10a63b684189f393

SHA512
30ca4b6248077d9ebd25d55d6edf7dded2832e048164bec6bee8fa1af63bdd6fd9cc538a913d227177b360a104e39f835112fd62724219d64b2d935aa595e8c5

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
94KB

MD5
0d58c65ba1d7a18da7548802ec3cc65c

SHA1
18c0ea245292a73e7c2c526f8fe0723f613890a7

SHA256
4dd6ee2b8d1f7f6c32809abf4a0c3f9d471edf8854dca44e217792b0d1a73275

SHA512
f1ef7d48a4c58abc447a6d788f33e3af32fde05e4b6ad25d7db9ef93a96e5dd2f4a2d3b94be57db0317305a31dfa9998bda7ab2a1c80366ae303ac33e6bdab80

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
94KB

MD5
137e3f37921d4d8153c0cd9bf33237e6

SHA1
95d1a485d17e6203fd2d7d694b5a890f7c6d7c13

SHA256
bf772a0a5a3f4caabc0876398e660665d07a830dd88c4b9afd5a3e0e41374a3b

SHA512
83f900e67ae7a064a000fdf39889d8f6ef11516b50ff77e5be844c0d74e72afb25f830717a8ea456db104fcd457e9cd88942f2b76e8c0c225ac37ce8d7393503

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
94KB

MD5
e5eec4af8ad6c979d78a86ca20d2f144

SHA1
2c3a58033fc7f4cb2309bf283d32c3944d94847b

SHA256
dc7f8e4e9ac329d3999e695819a72336857f4da4f0744374755390125ef23952

SHA512
1c8b95b3d9d76669b6c6470e14755ba50dca3dc9de4942e8981bf6bb51dd19af96871580c9ea358571215b830f2c43016a1b80946c2e477d1ec199cc95ab9d4f

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
94KB

MD5
5a5b0ed3c4a70872b1665535c83ceac6

SHA1
4aed09665630ad4f575e5b8f88e4fd9d78e6ce9f

SHA256
a9d1c81a2867d375df762cded3071717fd3303ad67b581b36aae1506c0f55050

SHA512
9d2e8337fd07a0498a8cb6f14b376e87b6f0d02fe30e05a1e1993c0ebaf7b4f02f097ad6e3454ace7f5e8121974b0c4a91074a6e1adb76b6e42e1abf116ed940

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
94KB

MD5
e530e8447c8af4c4713a1e39e694c54b

SHA1
1c3665983274ebcd27f783411e0911aad120a805

SHA256
90add70f5bf62ceb764e295eba16b99105c3875f8ed562aa0cf6265c65e12989

SHA512
8f06d27ba59541dc3f4fc1d29db888d7a548d82ad0f08975a545049e9aea66eaa9d6e4914c40e85c724d6325fccd9d7cf3b43b6b61be7c5920a5e29adaf9d314

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
94KB

MD5
294f7db72a314a2899b7da1975c50f7c

SHA1
748c2bb00a7eb151e381a2f4064f3e71f15c2b80

SHA256
c38d8fda423a2b3ffe9faa6ba40b0156dfdee72bcd4f78bebb3ac6eb0e4e5e07

SHA512
a572e946395a348d2664fa1f7eab1f16c155f892eb686ff88c11d4044b6162b1382bf3188b408803c1f1b08cd05c86688fb0c00af3ec4770acb4f1f532b0f172

Download Submit
C:\Windows\SysWOW64\Ipdqba32.exe

Filesize
94KB

MD5
1169ed2378fec2d4904acd45187ab213

SHA1
c356bb6a36ebad64c0b7c44f1d3def95f4d097fa

SHA256
22123ab0f0394966fab71ec272d00b95ef3d393aaaeba380b5601ebecaaf0726

SHA512
4f549be3fb2e73ad7e6ff471ebb9244f86307e1c38c2d1973fa768ca2ec273dcb01ac245d77866ec7c3b7dbe4f3b54b00d9a68a8123b376d20c4d20c90d09393

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
94KB

MD5
1dbdc08579d6dd3d891ca15ad1eff9f1

SHA1
7531f5817deb7c1fdfb793499880ffda85e186f4

SHA256
548316e4e9b2e8c7139613727a097e86ff8a71ded2801b16c44e15a1ac8f8499

SHA512
bf1b73a5d2aad4f4306c2a36e7fec08623cb108cafdd95a47ac1cae1fd17bbc3af29e04a9698d481f41c834c6227734e6b538c623002eae54b54ddc905ebc788

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
94KB

MD5
b8a151bdd58526b16f1c0ae1a4303f00

SHA1
3a6e948034d2b59fea4c7232155f93e28db82f07

SHA256
dfea51d95dd2f5928b2bf7bea992969667d7d5e4b182402388533f8465c26bc1

SHA512
96fc99bde3b560c79119de647e1c4d891e311a55013edbd78da5a61af76f55a0659b59be0a77d2bb887a2936d5a83b8fc89eb77350aa2795c6e89d68afecac74

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
94KB

MD5
b3d1be0e86e671da3078dc532ba3b1e3

SHA1
59d308e5d633c80b29647d80647e7ccc34c238f7

SHA256
eacd994afe853d41bac25753f2de0d60b85048780ed29ce68959cb6e97c115ba

SHA512
c34bb74b039092592bc66e767840e9c7d61d5ad6766e9592b3171fb1c1fa0ef6455e7575fce456322001bae9d74c16f2c23b36edbd90cad722618c54d6ece8de

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
94KB

MD5
9ee3905d918a8faad2f0ea2d4cf14ad0

SHA1
1b1f099cb0fc4a722ea552f377ca3d9277309e6e

SHA256
177d5b5e3d799278841c51164ca1d0620445dbca0fc6e4dc44b9288212b733d6

SHA512
51c30c4846b423ca13949cf56b7b3b33996e840c48280a3bad5f5b1dc9a782ab204fdad8b2c74c85d73a4476fd35f93396f2662d25f3318e200d71f171979fc7

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
94KB

MD5
82e27d653b3320cb743d17a802d3e4c9

SHA1
2265f06577a3761ab1c4a7b190d3a4389f965ef4

SHA256
f2e72cc619c0e833dd58e709853d87c830040b9b71477ebddc1a1def779407b0

SHA512
4711ff0b5ba78ea58eda84bd2a1737280f4149419114439bf9718973507ea25ad1c2e74ca236a54e6ae0949469a79f3e45ca02b6d135e53c00aa7ce64369cba3

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
94KB

MD5
2b92add3781667d63eafd6044a4ae865

SHA1
20633cab9180270d7226e7860ddd01aa09261978

SHA256
9ca93d8d31c6f9d781d6333ec348502dec217699531a365ecc0542ebbaa1e076

SHA512
e8a5e4a06961cf1d67ca108a6bbb4378b3264dcf353c309a393de5669189925df26fb3727faaeece56e4085575956cafb9917c906f560501ae61ebae4b78224a

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
94KB

MD5
16ac81a75578cd05a6e0412fcf2e9bf7

SHA1
77b131949d01fc89ea3966941a5e0e7cc24f421a

SHA256
ca95c342127038da89bb2bb4232a47a9567102dcdea7555f3e2d99663b06c146

SHA512
f426db1b8a44bac0dbbc722032bad7ecf4c1317b53b0cc6081d4929243693981d215f7ddc361ad10ac8b5fe8903dcb62a372556bc2b642ed0b404a7b4e67913f

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
94KB

MD5
063610d8d2f26812020e5483e7f7421e

SHA1
b4bc4e1bd3fab6e35c4df6f1417c11fd66660f59

SHA256
e908fd7e2cc589366584311781c742f21dd586330eff44f769a339912da08822

SHA512
272bd63086c783013357e3d3199a1596197c5323358ceb803d01fce37d14b778f76e09e755bfd5da8add9d68ad3ed3a1ccf2c5fcb3e7151e9871864f1da12952

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
94KB

MD5
68c861d68b89fc9dd88d75e8d97f9bb0

SHA1
fbde2039987925e139b061c000d51e6d3c63ed63

SHA256
023385b48cc0615074f376b36637bec8bb0fa15e066c9af40435535170956c7a

SHA512
004e7898adde70352223425c51779492ee4158147777bf1646efd8957d6f683b3af4273c82e6f2212ed175d8c62ab0fe7c7951df08fe29709eb2f2a82fdc1293

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
94KB

MD5
bc0a716137b38fe59b5fbca51338fb73

SHA1
83690f708806b26038834d431f4070bfe1fd3d10

SHA256
9d36c2acada94a58bc20f3acf3e8c3803586bea907032bd1a5b8872b8e25e531

SHA512
49ce7e7d5ddafdae725f52fc20439921449632f92be68fb7722eb41c0e545841cb18cee1497c9ff633e9e397616780932a7f7b6fa5c53b9ebc6bdfadbdddb9a5

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
94KB

MD5
cef4178b7c4961e603afbf930119055c

SHA1
23ec9503bdf80b8db248ea9d3b988003d40eeab0

SHA256
bcf2f7973232784826024c9132afc0635861ce72d4f2155a1f87e33a1ca5aa23

SHA512
934c8efab497f928453a5203f482948c6ccd72368c6ab5195e2d3679dc54e0070aafe7471cd1be8383e0bcbb39fefbdcf3ed26f164780ca8e884e20281953fe1

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
94KB

MD5
4e3c0b41098b90035d4a64227ee801a0

SHA1
c53a5aa4cec435ca8ddde56d4f800688a4b99438

SHA256
0504c65999de81a4be5ec15f8f08199a2a6717ba5eda54225a000c7092b504aa

SHA512
0d0188caecebec5ed5395508d59c58f7033a904c00af314a6cd9b0d2ac6d02a821fdee153b165fe2d22ec73337754102d84a9b8a5b2950ab2d7bdcfdf0899b99

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
94KB

MD5
e1537c4d3e1bfab4b37f1e3bef11790f

SHA1
dbadf112bbe3f1b0b26db1e1ade4811c00e7b6c4

SHA256
c4ee76d623411f1dcca523c481fb1e0826197e2e082152e164addfc4c1de6666

SHA512
a29d3f3a737fc8a339f5c53c0b464ee18769756e935f9645e50d69a8e51d5115186d9a66056e64493109fd082ca714d6d0749e152b6b3accad60197681af6251

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
94KB

MD5
1925060a37b715e227a447a791457282

SHA1
ff832731b06dcbdbafd98e897d9195899610bb33

SHA256
f2bf85390e1d60204c6b48d40bb107f370205297a3fcfcd566e12311a95b7f94

SHA512
7c104f712d58c703927bd5153b26c2f3c78e361a2f61a5438f71b2ff1d86f0aa9d1bf592e0bc1ddd4351dbdf2d3bd8ca1c2476cd94a7f5d3c799902fc58975f5

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
94KB

MD5
41578f2297ddb60ea31e3866ccf96dc4

SHA1
9d59381f8dbeea3bcaa093b92901a1fb991277a7

SHA256
1a00a7f473f862fe1ead207d18290c1f4f6e9a88a8478f7bcfe647d1e0d399f5

SHA512
0af1b2660278eb819779c103a9d51c21dd1510f77642cc6d95f3fdcf0d432a350776c5ab77dd48b49fb0c1bb2c5ee94154c118f251e90297471d2f2f1c715136

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
94KB

MD5
5bfeb5ed83b7b60b675f73655e04aff2

SHA1
504dcdddd1d9d6b19758919b26f97f694c1f79a3

SHA256
e7305c8176b398c390d3d7ddc387f19a92175100781f70e503e89703265944ac

SHA512
4c0881ae690b2639ecae38d590cba99b5de734765324471307ef9c0756806bf892547932e6000c1bd0f50ba6201bd5df7aef4c00891332e7f32abe4391520907

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
94KB

MD5
923d0ed2b93370acf58ae1c6942b2031

SHA1
aa406867f34295fe4f73c61a33324e6b02f63080

SHA256
c8578c53ad60d3915c7d34430ada4c1379c6313e6e8425409733ffb41dc68baa

SHA512
fee8ed2896fdffcc906bd21a086c6dd4528b8f20a50e113d051d3a862187e3d393c0627c907752aa527ad2c61288b8c21f624bd9177838c678b114aadf9031a5

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
94KB

MD5
0a332d6107369faae5c1beff97cea584

SHA1
13cac25690b8ecd22b88663b386ca3eb0acc8b58

SHA256
516dacd117f076e05b8ef6775d1e271e1eb43867018c92df4ad3367ab620b0d1

SHA512
cafc4e4a2b12bfea6b3caaeb9cd6040fe19c5fa155cfacc1b95cb8fef1f29e3f775ac91d5e3ba07c3257e548a4058b9ab740fa6ee2a691e0e7ea6d8d1577cf93

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
94KB

MD5
a93403743818d2912560097a82a8da7f

SHA1
c571cab8cd8b5f649e09c799ebef815ced6a50d9

SHA256
787ab66899d60f26ceb5785a0be356e955845d9753b958db32490593d390eddb

SHA512
59d74e6611498f0587572f34dd26ba237a1f4546034485903a15ed5364093855336f740a6732bc3e55955273283e2a35904cf9f0bd14167b6275d64b192fccb3

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
94KB

MD5
78ff97ea47595fc36797dd55e8b39b8a

SHA1
109dd252d72ab0b1a33cdb7bcde304f3c4b40b86

SHA256
dcc5d00d81bb99ffbe39cb7de090d489ede57ca74393a7ec6b981e4bedf10de9

SHA512
0dd5d0f67dccd064058e895af4f0bbd54604f93c200882b20a91399551d681d0744cf6c03ad9296d54855e9ebf47eb61102b79cbf8009693561cd0bc8947473d

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
94KB

MD5
fd2c6e9e59cdfd33e20b82a1ac3e9231

SHA1
b83a3f7da09d7c03df840eb832ae6bbdf532aa0f

SHA256
fca983cc7a09ac05df51938d61bc3938ab9dcb616fce5bf359011d697a48b284

SHA512
9e228539bd5efa6fb959f8ea9e3a0ff66ab575ed26c4c930957d583d77fde0b4db18598747c4b07de998cc9b010bea2dd7041a748f59fd03d898377472e2ac65

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
94KB

MD5
16a8709397edf7dd7a53776afcba5a02

SHA1
af487aea17318bec58f84f702896f4888f27c06e

SHA256
cb699ee95e5c24d08eb8925c05cd434c8e06852ba07664060b5356431e4ae2bd

SHA512
26f5162e08079358e4ec9e63fa7b93582eae86d4568b341627a8fbc6160f8bee475d5459598083084346927f74b04f9c7b17c98cfbc1930c690c5e04eed317a3

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
94KB

MD5
2f9f1785882454a5ce00e5af32285c88

SHA1
8993576eb1d7f75dcc27884143077a3d9cf57cd8

SHA256
e9f37f9ab501e4e7186e7abe19f39b6eeabf3257f345c1b8585b79a68ab23d20

SHA512
7f147dd6d43f97609babaea730d4eb49d623b2417270b9429e76b8f2c610f8eaa16fb775b0f610cac9fbabbdfa2a13cec598d673da11a9743040c0f190016a19

Download Submit
C:\Windows\SysWOW64\Laapnj32.dll

Filesize
7KB

MD5
35354bb8e59b04e317c8f4d44e5e7d0f

SHA1
48e8c9ff57a86a9296abc6338f19f2e426e61f99

SHA256
05d885836835a7ce455ed0568eed1934457354883d3f4e9eba8e00819d819ecb

SHA512
09f0f356fafa1e74a8e8e90e965f4d4ddcc7ec7db2aab10d7cefbfdc33fd32b41d05842391206150346914a7af5406a812b5f2ee9f962cad574cda07b397673a

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
94KB

MD5
5d6860f923af1e9858aa99aefb1074af

SHA1
6784d012cf5a633a28bf8433180bf6f54f0db9a2

SHA256
8c28c53d2e4f5ebedd0ba4666973a3fec4cecaa63d9c39c2d0618ecb36ec5d20

SHA512
e9ef3d21728d26115aa040d4f27c8c88af39f0517ba12524e341d569e04a74b996d36dc74094a9d3135b0e230b0aac33e714f8b66c1992ffc860c8bd57f1f6c4

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
94KB

MD5
5377554431c8ab7842bd4ebec19996b3

SHA1
e63bce2a73a19a13169f4dc77d6e4b53bb713d54

SHA256
2cf5139eebdfae71f8446d5e5dc38755a2f8a7bce998736e86814ef9037aecd9

SHA512
52db97b1caa4249d8d74e494da8e0d8a1abe5f431885fb47737f28848aa18edf126b2e9850765232e3e8f700c459639be90044994e64429371324bf9f4d67889

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
94KB

MD5
e6ce6200529a34090dd7ce65007234e0

SHA1
6f923e2fd0a72ab05ce4bf83147cb093ca22f0a3

SHA256
294b260f77768d09dfbbaf79d7ac54de5729a6cd6bec3829267ea46ad22c2d7f

SHA512
a1827e9012d15a342ddd6553fba3dbd59661a7d7f2a1598056c7d5a924fe2d1e054889b5de94360e032fc0d352fbffa6cb47ae5ab39a23452492c9e6209cfae1

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
94KB

MD5
87631dd36ad6246003d5bb557da7c0af

SHA1
b555310bf86f67d764c7fd0f8cca4f5262b2e340

SHA256
12ab31162b14d2a5958ee30cd75a2a95a5a219c22315156c231b208e2b7674e2

SHA512
ec9cf266cb5f08354d503898dc2fe64b9dc52117a5f855642a213bdafe63ae758ccd76724ce9d1837324e98d5738531db247d9fcebec458729fbc725d5f09af8

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
94KB

MD5
5fcf307e0af073e69c158072638ad202

SHA1
217e7244f8272533bf9367257a8b0c017772a436

SHA256
3ac7db466bb07013585faba274d8e14727dc57d4f16f7cd412a8e947c472ae96

SHA512
8e0d36f4707833106e86a4a6bf90695430c2a01abd3c7765d9599981dedd801c43506f80a5382c33d1a69fdf85e5ea3b1fa1a48120ccf9334436d4b1a3ec0a87

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
94KB

MD5
8135262a8a1c9b1669477524f4a177fa

SHA1
dee2a158fcc83e49aa40eb8639de35010dbf00e9

SHA256
3fb50c192afc5fe38846734eb8b9923f7a1d7b8fd49bc9a2d602882abe874b13

SHA512
efcaef8d265b968b05c321b21718c135d947fc78e906ae3b6842c363963ccd1c5edd64a2a2fdf1131a4bc50b7f12a9b91815e4ca9bf81459cff439399f89e793

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
94KB

MD5
6553202be8963d4e72bb408d7e1bc6ac

SHA1
53ba7c12e5325c2eaef575f165293cac2595198b

SHA256
4270f8fd45994d264e4f92f321492210e6bd13ad814c3a2c77337603374c6c09

SHA512
799580d7603aab82d6950c68aaca6e52258ce5135080f3d47d22995f141a37d1556bfb586088a548834d8953735f7868985e54a70df941fa12f7f1cc6aa7bf07

Download Submit
memory/380-220-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/388-514-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/404-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/464-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/736-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/868-579-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/868-39-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/936-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/960-472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1056-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1064-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1080-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1080-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1180-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1300-526-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1424-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1468-88-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1564-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1620-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1644-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1680-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1708-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1756-538-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-544-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1856-558-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1856-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1904-545-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1916-532-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1944-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1948-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1964-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2188-261-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2236-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2412-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2432-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2492-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2504-71-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2572-508-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2612-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2724-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2824-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3008-212-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3084-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3104-552-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3108-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3112-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3216-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3312-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3352-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3360-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3440-572-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3440-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3484-228-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3616-296-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3700-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3748-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3836-410-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3852-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3944-244-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3976-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4016-159-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4040-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4112-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4280-593-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4280-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4300-184-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4416-520-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4468-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4488-199-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4492-551-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4492-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4504-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4592-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4596-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4600-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4768-236-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4840-103-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4872-180-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4888-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4900-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4972-466-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5012-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5016-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5076-586-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5076-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5100-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5140-559-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5208-566-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5272-573-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5316-584-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5364-587-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5408-594-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads