c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe
Size

112KB
MD5

a31db3e931f77e99a9a346e88c8e3ac7
SHA1

ca469e5043e9a2828706d061ed633d3c2f9bb3f0
SHA256

c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db
SHA512

dcb7c029998a925a22269d56181e5119946450c5872cd2a7c8bcef93c1e3f5eb9545b668befc3c8071961623e6845ba33d5babd5fd6265ca2aa71409042378ee
SSDEEP

3072:VYHj3++GgH3MQH2qC7ZQOlzSLUK6MwGsGnDc9o:VYHjHH3MQWfdQOhwJ6MwGsw

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefioj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqncedbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe

Executes dropped EXE 64 IoCs

pid	Process
1888	Hmfkoh32.exe
3652	Hkikkeeo.exe
1816	Heapdjlp.exe
3200	Hmhhehlb.exe
1048	Hofdacke.exe
3304	Hecmijim.exe
3100	Hkmefd32.exe
2528	Hcdmga32.exe
4188	Iefioj32.exe
312	Ikpaldog.exe
3076	Ipknlb32.exe
4912	Ibjjhn32.exe
2940	Iehfdi32.exe
4928	Ipnjab32.exe
4632	Iifokh32.exe
3544	Ippggbck.exe
2648	Ibnccmbo.exe
1184	Imdgqfbd.exe
4772	Icnpmp32.exe
4088	Ieolehop.exe
4412	Ipdqba32.exe
2300	Jfoiokfb.exe
2672	Jmhale32.exe
3308	Jcbihpel.exe
1768	Jioaqfcc.exe
2920	Jpijnqkp.exe
1620	Jfcbjk32.exe
2584	Jmmjgejj.exe
2856	Jbjcolha.exe
4112	Jehokgge.exe
1040	Jpnchp32.exe
4580	Jblpek32.exe
2268	Jifhaenk.exe
2956	Jlednamo.exe
1448	Jcllonma.exe
2788	Kemhff32.exe
3172	Kmdqgd32.exe
2932	Kbaipkbi.exe
1160	Kepelfam.exe
1216	Kmfmmcbo.exe
2176	Kpeiioac.exe
1636	Kbceejpf.exe
392	Kimnbd32.exe
2220	Kpgfooop.exe
4304	Kbfbkj32.exe
4736	Kmkfhc32.exe
712	Kfckahdj.exe
4916	Kmncnb32.exe
1872	Lffhfh32.exe
4116	Lbmhlihl.exe
3992	Ligqhc32.exe
2468	Llemdo32.exe
5096	Liimncmf.exe
2928	Lbabgh32.exe
1392	Lpebpm32.exe
860	Lgokmgjm.exe
3144	Lmiciaaj.exe
4836	Medgncoe.exe
2924	Mgddhf32.exe
3036	Mibpda32.exe
2716	Mlampmdo.exe
3528	Mckemg32.exe
1652	Meiaib32.exe
2620	Miemjaci.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Aeniabfd.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Ibnccmbo.exe	Ippggbck.exe
File created	C:\Windows\SysWOW64\Jholncde.dll	Meiaib32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Npjebj32.exe
File opened for modification	C:\Windows\SysWOW64\Ofnckp32.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Eiojlkkj.dll	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Meiaib32.exe	Mckemg32.exe
File created	C:\Windows\SysWOW64\Jclhkbae.dll	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Hcdmga32.exe	Hkmefd32.exe
File opened for modification	C:\Windows\SysWOW64\Jioaqfcc.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Odaoecld.dll	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Bgpmhl32.dll	Iehfdi32.exe
File opened for modification	C:\Windows\SysWOW64\Jcbihpel.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Kmkfhc32.exe	Kbfbkj32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Nckndeni.exe	Npmagine.exe
File created	C:\Windows\SysWOW64\Najmlf32.dll	Oponmilc.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Heapdjlp.exe	Hkikkeeo.exe
File created	C:\Windows\SysWOW64\Kemhff32.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Benlnbhb.dll	Lbmhlihl.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Iifokh32.exe	Ipnjab32.exe
File opened for modification	C:\Windows\SysWOW64\Onjegled.exe	Ofcmfodb.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Pqdqof32.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Cajlhqjp.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Keblci32.dll	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Kpeiioac.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Ojllan32.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Ipnjab32.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Pjmehkqk.exe	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Ghekgcil.dll	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Cacamdcd.dll	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Hofdacke.exe	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Iefioj32.exe	Hcdmga32.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Mibpda32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Docjlc32.dll	Ikpaldog.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Phaedfje.dll	Jmhale32.exe
File created	C:\Windows\SysWOW64\Kbaipkbi.exe	Kmdqgd32.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Ligqhc32.exe	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Gilnhifk.dll	Ligqhc32.exe
File opened for modification	C:\Windows\SysWOW64\Qffbbldm.exe	Qcgffqei.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7760	7672	WerFault.exe	300

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpaldog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcdmga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlcifmbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefioj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icnpmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcllonma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmfkoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibjjhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdmnlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgmjqop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecmijim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jifhaenk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaipkbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meiaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdqba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogifjcdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afhohlbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkikkeeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipknlb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmhhehlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfcbjk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eheqhpfp.dll"	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmhale32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohjdgn32.dll"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdfog32.dll"	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjapi32.dll"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jioaqfcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgaoidec.dll"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkgoikdb.dll"	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmjdbam.dll"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdhjm32.dll"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpebpm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 1888	452	c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe	84
PID 452 wrote to memory of 1888	452	c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe	84
PID 452 wrote to memory of 1888	452	c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe	84
PID 1888 wrote to memory of 3652	1888	Hmfkoh32.exe	85
PID 1888 wrote to memory of 3652	1888	Hmfkoh32.exe	85
PID 1888 wrote to memory of 3652	1888	Hmfkoh32.exe	85
PID 3652 wrote to memory of 1816	3652	Hkikkeeo.exe	86
PID 3652 wrote to memory of 1816	3652	Hkikkeeo.exe	86
PID 3652 wrote to memory of 1816	3652	Hkikkeeo.exe	86
PID 1816 wrote to memory of 3200	1816	Heapdjlp.exe	87
PID 1816 wrote to memory of 3200	1816	Heapdjlp.exe	87
PID 1816 wrote to memory of 3200	1816	Heapdjlp.exe	87
PID 3200 wrote to memory of 1048	3200	Hmhhehlb.exe	88
PID 3200 wrote to memory of 1048	3200	Hmhhehlb.exe	88
PID 3200 wrote to memory of 1048	3200	Hmhhehlb.exe	88
PID 1048 wrote to memory of 3304	1048	Hofdacke.exe	89
PID 1048 wrote to memory of 3304	1048	Hofdacke.exe	89
PID 1048 wrote to memory of 3304	1048	Hofdacke.exe	89
PID 3304 wrote to memory of 3100	3304	Hecmijim.exe	90
PID 3304 wrote to memory of 3100	3304	Hecmijim.exe	90
PID 3304 wrote to memory of 3100	3304	Hecmijim.exe	90
PID 3100 wrote to memory of 2528	3100	Hkmefd32.exe	91
PID 3100 wrote to memory of 2528	3100	Hkmefd32.exe	91
PID 3100 wrote to memory of 2528	3100	Hkmefd32.exe	91
PID 2528 wrote to memory of 4188	2528	Hcdmga32.exe	92
PID 2528 wrote to memory of 4188	2528	Hcdmga32.exe	92
PID 2528 wrote to memory of 4188	2528	Hcdmga32.exe	92
PID 4188 wrote to memory of 312	4188	Iefioj32.exe	94
PID 4188 wrote to memory of 312	4188	Iefioj32.exe	94
PID 4188 wrote to memory of 312	4188	Iefioj32.exe	94
PID 312 wrote to memory of 3076	312	Ikpaldog.exe	95
PID 312 wrote to memory of 3076	312	Ikpaldog.exe	95
PID 312 wrote to memory of 3076	312	Ikpaldog.exe	95
PID 3076 wrote to memory of 4912	3076	Ipknlb32.exe	96
PID 3076 wrote to memory of 4912	3076	Ipknlb32.exe	96
PID 3076 wrote to memory of 4912	3076	Ipknlb32.exe	96
PID 4912 wrote to memory of 2940	4912	Ibjjhn32.exe	97
PID 4912 wrote to memory of 2940	4912	Ibjjhn32.exe	97
PID 4912 wrote to memory of 2940	4912	Ibjjhn32.exe	97
PID 2940 wrote to memory of 4928	2940	Iehfdi32.exe	98
PID 2940 wrote to memory of 4928	2940	Iehfdi32.exe	98
PID 2940 wrote to memory of 4928	2940	Iehfdi32.exe	98
PID 4928 wrote to memory of 4632	4928	Ipnjab32.exe	100
PID 4928 wrote to memory of 4632	4928	Ipnjab32.exe	100
PID 4928 wrote to memory of 4632	4928	Ipnjab32.exe	100
PID 4632 wrote to memory of 3544	4632	Iifokh32.exe	101
PID 4632 wrote to memory of 3544	4632	Iifokh32.exe	101
PID 4632 wrote to memory of 3544	4632	Iifokh32.exe	101
PID 3544 wrote to memory of 2648	3544	Ippggbck.exe	102
PID 3544 wrote to memory of 2648	3544	Ippggbck.exe	102
PID 3544 wrote to memory of 2648	3544	Ippggbck.exe	102
PID 2648 wrote to memory of 1184	2648	Ibnccmbo.exe	104
PID 2648 wrote to memory of 1184	2648	Ibnccmbo.exe	104
PID 2648 wrote to memory of 1184	2648	Ibnccmbo.exe	104
PID 1184 wrote to memory of 4772	1184	Imdgqfbd.exe	105
PID 1184 wrote to memory of 4772	1184	Imdgqfbd.exe	105
PID 1184 wrote to memory of 4772	1184	Imdgqfbd.exe	105
PID 4772 wrote to memory of 4088	4772	Icnpmp32.exe	106
PID 4772 wrote to memory of 4088	4772	Icnpmp32.exe	106
PID 4772 wrote to memory of 4088	4772	Icnpmp32.exe	106
PID 4088 wrote to memory of 4412	4088	Ieolehop.exe	107
PID 4088 wrote to memory of 4412	4088	Ieolehop.exe	107
PID 4088 wrote to memory of 4412	4088	Ieolehop.exe	107
PID 4412 wrote to memory of 2300	4412	Ipdqba32.exe	108

C:\Users\Admin\AppData\Local\Temp\c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe
"C:\Users\Admin\AppData\Local\Temp\c0ca67ef612ec50b6dc31781dcc0cbcdc39e968d5c9b6146d51fecfe532070db.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\Hmfkoh32.exe
  C:\Windows\system32\Hmfkoh32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\Hkikkeeo.exe
    C:\Windows\system32\Hkikkeeo.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\Heapdjlp.exe
      C:\Windows\system32\Heapdjlp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3200
      - C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4412
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3308
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        27⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        29⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2856
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        32⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        35⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1448
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        40⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1216
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        42⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1636
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        44⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        45⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        47⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:712
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        51⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4116
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3992
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2928
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        58⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        59⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        60⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        63⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3528
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2620
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        68⤵
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3856
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:736
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4696
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2680
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        75⤵
        Modifies registry class
        
        PID:3380
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        78⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        79⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        80⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        82⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        84⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4868
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        88⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        89⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        90⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        92⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        93⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        99⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        100⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        101⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        104⤵
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        106⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        107⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        108⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        109⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        110⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        111⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        117⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        118⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        119⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        120⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        121⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        124⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        126⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        128⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        131⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        132⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        137⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        139⤵
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        142⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        143⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        144⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        147⤵
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        152⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        156⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        157⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        159⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        161⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        165⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        168⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        169⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        170⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        178⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        179⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        181⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        182⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        183⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        192⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        193⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        194⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        195⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6304
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        197⤵
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        198⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7232
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        203⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        204⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        205⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        206⤵
        Drops file in System32 directory
        
        PID:7452
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        207⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        208⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        210⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        211⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 420
        212⤵
        Program crash
        
        PID:7760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7672 -ip 7672
1⤵
PID:7736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
112KB

MD5
67af3539224b6709a388250c6e62a23a

SHA1
817f2279c0e94832fde006c0e8055fcfffccf7ac

SHA256
cc1aceb2e8e882396ec2b4d98d3e84886949d15773b3643a3183f141ba6b29b2

SHA512
325db9128c9632425e47c0ba9797be52021f46bbab36cd88827dc2bc8a11e0a0b97d2993a670a3714fc85be220866dc91d169c0718c52c534efef6d2d995fc80

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
112KB

MD5
0f7e3a5f856f62da222d1857879885c9

SHA1
d7ac814482b77a8c2d77f2e577e07ab19fccf00d

SHA256
a8d5b66676a7e5fbed5f08257272c4dc6fef83bc8fde94ca9e1d3713d427651e

SHA512
439eb8718bef4634058ac96511442cf69fed9ef702f6772fdb5ec1591d541e447ba6eca7afdeb9f4d6e526783e1a1f80382db9f709a1429899e5746e1f429155

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
112KB

MD5
305349314fdeee283a26bc03c11748f2

SHA1
4b2fb0342f7aa0df6df482d05043e0312a6804c6

SHA256
e32829cf9209bfbf4be2ae30508725604be6db511b7464041a1d45cbef0ced53

SHA512
07579737406e8e18a112b05ba4acf2298a11f3e5845952c22d8477002b8be78ff4e36153a3b5057237eda5e858b0e2335dde7331a99120822bee3304c9647470

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
112KB

MD5
f88267707a62aa29341587a87844aab9

SHA1
69aa615b7e9f8104d3871e12b316fe45d105d727

SHA256
cca5c4edab9f9665653374a73ad9697e4bf9a0ab60d320f0ce662d4420360e98

SHA512
fc370c4d969fc4ebc9bbc15387faf73e873fedb3e184b4fba1642e1c5e257d0d3ce9c9550ade9840726509851efd5f861ec655e07a39e1c7bc313f40659b1dd1

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
112KB

MD5
43a7ac4a52e7dddcccb781c5e094b3ac

SHA1
af9e7b77c1b4de9894e41f062655657883cbb718

SHA256
2d92f4735d2f439f0f4c145086346165cdf5b3b74e4db98414fc6c4d52e132d4

SHA512
b15d4fcef732226e23350fc0fb4d51cf9128fdf0df018eb7e1a6dabf4696a9622e9f2e35add37e48be95caeb441d1812ed16edab9cb5195007178d099bb886a4

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
112KB

MD5
ccf5598c0ef02527589406ed48c1ffaf

SHA1
08d2dd48841811757b18e752e66ada2a3d18f578

SHA256
cb2547a4453ae9b5f7c7ea32f633fcbc9f3f5360044f2106c799be828900bb8b

SHA512
ff478be557fe3534940fc663f4820f3800b25ae68eb699ccfb493025b56f31f12ceabe77005733bf3900a1944e206007c14d7ad64454bf2cfe74cffe255ed485

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
112KB

MD5
159bcccda8990f2944ae567deaeda495

SHA1
a967c46340c061626586b83aa2caa1f046b72049

SHA256
3353421c7fd94de43f074c80031234d58dac82177ac6839557b75504a9bd1d81

SHA512
c6227625a0c5b74afedf5c3adfc277911d5f2f5ee2799a0a81d4e1662df32c6590e86c78fcf04fac589fc4c7bbc3d31267a21f36bb4e35fd5b38c6dc2b75318b

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
112KB

MD5
c76baddcf471295b2def51a7f5969508

SHA1
0ea949283ac85927630b1f12c452cd9ee87f99a0

SHA256
0958b9207f284df0d5639390b2c8859e3fb815ab5486b62cdfa35316855b4214

SHA512
11477f2bce47ae93b7ccd7c1d8847033a9db6ae3143a431a728b05323caab910655ec9bc0b7f5eb42d01459079ca6c620fcd6a60818ed9572f5be97bb318b072

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
112KB

MD5
8b51d80e31d375f3e864254aa5c7e42d

SHA1
0a39dfe6a7bf62e6d6ec2bddba74cd67932e19a0

SHA256
c916d31f56aab6a8bc72d63f0b268746ee9d04da1e5ccfd4a3c64913068eeb9a

SHA512
c88311f2db83b1624bbeb1a5ad2d6ca6717e3b75db4746191fdd5b52945484a8d3c728ee5abaeef4f3007bfcca13985bed7a1c65fd491b1d94235b3203262b07

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
112KB

MD5
5a29c62958d74f9ddfb31c322333d0a7

SHA1
e6f9a37903cb7965467fd6764c95da16c1ce9fdb

SHA256
518731e07548c9158c3a184493b1a2c48043fde37c569a8a9697725a09eb49b0

SHA512
71586ce5ebbc5d5dcb51552eb171d1eec8f94b3a9b74aeb424cdb26c24e08656a54661ad44e2938417404b7479515ce6c2c575fefdba665cc4d6334f5e30d384

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
64KB

MD5
d78fa8c84f0b1dd50460195138d24fec

SHA1
27425dc6c1407e2129776f9f61d5f39fd27f82af

SHA256
257d538baf71e8d5a5c1703f5003466a5f99ee71f8fd1fdbd2d6b0278017b50d

SHA512
a69a0e888c6b24e116124b1c3218aee6896712b2b4fab30f67fb633887ed18100aedf4381a7b7230cebe8a15f048b99d604d2745b7fe075a62ffea9eaab4bbe5

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
112KB

MD5
1eb4f8d8b9b375ae0071cc9ba82bf36f

SHA1
c45e327285209ce82b0cac5b25d401d163382b46

SHA256
400d89046ffdc6a9e60acd7f440552083f643573b628abd54de0a69fa7d9cdef

SHA512
c541768a1d9c7a16f687b4f6a4cb103c7d4c9054ff376deadb14a6eb0eef993b043576fa6ff14a55bc578700c9135ed7d3f1b58a05340e28cdc7729136e0283a

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
112KB

MD5
e0dbecc838d867287578a7331197f246

SHA1
f189868a334f6b3242fad9b28b7b0304f7102a61

SHA256
610394a47ef0f7eba499550d8766b3975b9fde7f652f7b3817452a621c8829c9

SHA512
21704c6e7aaf1b355bbdb9fdf9201749f4c92ff44c49f19508e6e5c1689117b59d8c0312c96ce5a0f41ccf596011b85ea9b6d9b492bf673eccf81632fd99ae11

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
112KB

MD5
a217a9cdbd5b93c434b81b5ab6a3e79b

SHA1
589bab8462bcb30ebfeee8639eb295511e081fb1

SHA256
6e4d6c9a195a54b7cc269ec1e070dff848d9466f950087b96114c700584ae9e8

SHA512
c39e23fe9fbdc23aec0204d0f09e4e8c2a8a8abcbf104703a3565d039d0bf3f17d40817d6b720c44f8daf2ce28f92ce5223fe066d4522d0d88fb4f5ca1c5097a

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
112KB

MD5
9a8510e02326cbf305fe1495619ed4da

SHA1
7e80f7c019912d0881283b670ef37afba124dad7

SHA256
d550c4b8578193fae5d35f11f081f942a1738ec3071bed13d1425e5bc14cbfde

SHA512
17b5a5f0a8379e3d8e162ec6f8057bd2d54e0c66ac1332450ad10695db8770ca6ed3a165a8a57d6b3808badaec43c633815696b53c3fd1233fcc4ff52d1e5be7

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
112KB

MD5
9b348fadc20201bef20e46be22372611

SHA1
3304a4de0de89c15c23c125efc2782cb774c52f3

SHA256
57981c668c5bbb1840190be305cb81f4983a4ce385637bb3e53bc007b0772f2e

SHA512
636b6ee8b9829bdf036d253eb2e5f7ab15fac420fae5e19a668048d469a46fe09a085c628e3af51e636dc4fdbdaaad23e8020eb6e0e15781b6f93b09b974256f

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
112KB

MD5
823cefd20259d947940cd67548168a1d

SHA1
136ba8c02072a4fae7031377af10d560386acb5a

SHA256
e2eb8da3b14e485281acbf91f43b08f250c48dd5c8d1f2bd549c0352116f8368

SHA512
566db63e9f10b8a81521927009c50b14992ef644e28df66e775c8fc1d2fdaae355814c004cfa16382a9318e62bf2beae69aa20c708e77c8b0ce666c4f9b37611

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
112KB

MD5
b492cbeae0dec8e6773ac6e0b6c2c978

SHA1
417b3bffdea505b9d5241e8cbae0cfa07c993f47

SHA256
3481cfba04eb63c1895d2e2ac511b2935d5058c0416357c658085b0c7ace35e9

SHA512
78c5169c0dc491f324fb7c8253c1aa68a0d6a3df1d2c381cb66bc9b6d4eaea74d7ca147cf9304c9d6e4c1f496d92fead578a391dd4c580e49716587c2734f8ad

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
112KB

MD5
0c2045087f6194719a02851b6cba4a6b

SHA1
50866ab6003bf0a315a01c36df9612294b5a9c73

SHA256
01d2c7d6a622ea534162e473a06f313d9f0b05ece4013dbfeb71a5ae6c1cec22

SHA512
52780d811ae0210e578e8ff6beb974eb4f8fd68577ca100480dd1672195290cd35b740cd3899d05d7ba60c58bada1e42c574ab89143ca1d0501c238b2ab679a2

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
112KB

MD5
b35636b9536ade8c91d1d7dadd5bda73

SHA1
7592bf4b0a7d4cb1f6f2e4d0cc979c0eb4c70d64

SHA256
3be9577b2c254fc51309b6f03fb0bda9af9277b25dc61b22510ce364a39f7174

SHA512
a3578324f1077dc3e7a663625a8d1fa501715b45f72c61c126d0135ee64811bf03b1872385bd7e16f30c9e5d7f822e56c191157a98e3ef83f5980e4f8231cc60

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
112KB

MD5
40ff5bf67b4f01190f0ee7a088c93448

SHA1
18ae2e41eda1712c222cb66a7ae34560814f941a

SHA256
fd023dd1974dd9929d07b9ed182289948973ed5a8864005b8e1dac89168f5a77

SHA512
f95e245fd0375bec2995b49e5285d2f92952066d3bf567dc0eb61326ff47cdff446e3f19d77ba508a621e8c317ce9a8b84c2b81bb05436ecb0ee59ece34716c2

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
112KB

MD5
b80e78e8c7cd8d1d60a2b5df6479404e

SHA1
1a1f6386dc740e715a56b260d305168eef4435e2

SHA256
68613ab1c49dd75068f77f6a9d522256f1208888abf9978122afebb73ab5da57

SHA512
3f311adce7889bfd6264a9e29bf1b6157f748839f78e1d9337699edde50ee8ff2471da940ced778176dfbd92a8e785a1864f9547dc01e610758287079351a9da

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
112KB

MD5
de5e007a8facdd75108ec7f68944b47b

SHA1
93faa4e1bb22cac7e0257cddbc7cb73cb36c17c3

SHA256
58d49cd1805c9c66f8d5143a8c6092e37fc0348904437153e1efffb2c3584c61

SHA512
0f30b6a602f6cc89f4471d23662a0aab8baed0ccce3151675791f043191d0fd15cf9120dbe04b854764ad1519760969b5a2b707209b323cef299bf0e1010cf63

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
112KB

MD5
a5c78b03b63a79d52731a3f7f44e9fae

SHA1
6a96633047c01187e26920bb859046fc6b84ae58

SHA256
432a9f2bd37b3a904162e5fd0862b366b07c5f95707e8f96ab23c0401ccc3f64

SHA512
a1f65143aa9a0746c75a183eea7661b650cccb41dcd9a1b463932d37d36a5cb15784d92909434bf6a161335d91a9b5f8c1ba9e5d48a2c798d8bf7bfd2afb5831

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
112KB

MD5
d05bbfefe806b8f3ee035434ce93f388

SHA1
2454f538a58cb8fc2f633ceed5fb8ddef83fafad

SHA256
325835def2583159b5b5d0defb8d01d091908b6745c7a26e66e3850bd251b6f7

SHA512
ae912b06959816ca813df6820cf65af5b04816fd76e8137308c268aa3290b84f0dded9f4e5ebfa596bb652ed2895ca1ef761ed4f74cadf27f20b949bee397c1e

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
112KB

MD5
3f8ec799ac984f90b5f7bed5ec38e995

SHA1
68db718648dde57dea6bd4bb4029ac804db7c5f2

SHA256
f7384305362cba61c7c4eff418e9ef5f0f88297321afac2d565a595ff38c0e02

SHA512
088f2ac97e95cb9b5477dd4f363e8b2cc0da3c013ebd3c7609439d64fc66c18dbf88a0f58570103ab21c5a1e4ee0199521bfbf70a58a72f1b406f80068d6c5fe

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
112KB

MD5
97b7933a89fc6dc5ac5b677eb2fa9803

SHA1
acf9160642ad5dba21e0b5bd5b91ee57b1c928c2

SHA256
ce62c1822b15f051501d12c9d0746aa104ea3d7b6706c7da6eba7acaf25a6192

SHA512
156a51de1a02187d6b4f894d781ada4954d6f17772631d25d3317a33184dbd590e9ba4d1a5950b70fe8a4eabb19abdfb5db481bd10dbd202f0bcf2e21f091284

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
112KB

MD5
3877d7649f3349cd629d4c009d1b686e

SHA1
4e035dead1b30493e2cd0e5c081754ae48fe2a3a

SHA256
a3a28a1bed357b2292ca4ef754a0070fc126edf4408736247c7027ba3fded2ea

SHA512
9037ae68718a64c30d5ee5c169b058d94a1a6b786c8eb91a1f8d3d7c564993f6c5a3b6f31e58ac8bfc8101aef37ac3758bb675eab14b808326cb66f6d92f41f4

Download Submit
C:\Windows\SysWOW64\Ipdqba32.exe

Filesize
112KB

MD5
c28759a4675fe459f4b974f00650cc06

SHA1
6b2fe8c83b2afbcaf2934032245b75d3dc46e2bf

SHA256
1af13764adcda19a4f809a43318c67d38887640d197a024f58b441ffec3c23cd

SHA512
4e50201228595384268c4935c709ea97f5ae0891569f24aee515547d065031e5bd69da12678f1c4929f1717656cb9fb6b05032124ae0e765c04417261b317d95

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
112KB

MD5
677e3f76fc460ecab2e4c6c8fe292047

SHA1
0a753d4fc9d8f9e68e69010025826d731008dde6

SHA256
3f5df57a7a0497030e52afe5c01df7c99e91435a637180e895c01b920387217a

SHA512
c5047076c4fc7fb990c1b917c2b50e13dbca28a8bb1072340203434481ef276cf1698314a2a498b181c8c6c52dd2d5807e88077ab3de23ca05909d775cf46b89

Download Submit
C:\Windows\SysWOW64\Ipnjab32.exe

Filesize
112KB

MD5
fb99ab5e3afe575785e2f8ce362d41f0

SHA1
22ccff1c50b5ce4ae52ba83a2d73dd0c0e0f5ad7

SHA256
5b36df95b0f4248373e202d38fe052589d3239ace44912793a56745717da6e44

SHA512
bad3d6c3ed4eea935bf02c54ff0ae03bf705670cd3c9b227646f4811e6d24ae7c6dc950ae8283c1b18d9d187ddd6e6982a94e89798f432336019219062625169

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
112KB

MD5
8de737f816832a8ab6771642cded2eeb

SHA1
60a7acd6b25df89f24cca5d5d31dba364d923c80

SHA256
ddf468fee59df429bea72f827cfc7122ade24bb5d842fc4a29670bd1244d482e

SHA512
ee9ce107a51c17aafe33c665df0fe4b55e87905b11427400a83825ee209e88fdce6d4930cda3189cbf219d90b1a96c3ee98d39f6d25d85f787cf226d9f8f0bd1

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
112KB

MD5
7cb1c7884faaba7eb2f6f47dd7c5d1d7

SHA1
0acb5a2eac314e3664646a3a632d92ea4909d49f

SHA256
9cbd305df6e99e59536f9ee219cc0f0f0674723882eb4490fc23f612fc8900da

SHA512
9f33c1d6fa7f6c92567333183eb5a46c7bfd013a6dcbb453a5097c55a89562a480fa714f558a2636ff9c892739c8814dd4d16631e1f53932887fe0a9d243f13e

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
112KB

MD5
15d2940cfe2efd9f759f94fb3a290f8e

SHA1
9f4083831b2d36c78c47116bf66998c962d4698b

SHA256
edc886770c394ad43699858f58495ad69c9dd4b28bfae847e28b687bcc4150fc

SHA512
44cbc6868743e7d32f4eceabf5d1db11e4e9e17e3020bef4b6f77be4cd62eabbd4d3799c1a9e6364a8d66ce787671d67ae6de824ea114400da43034de4aada4e

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
112KB

MD5
a51e5ea332e0f12999de71fc78ead817

SHA1
a9168be242d0b0c4b32bd5d4503defd8a844584a

SHA256
1d84db70e4fc4ab646193dc26576f1b2ba11a6a0f0ccedf7557cfcd3cf1f02df

SHA512
bb64dabd0b25a78e8fb85667847e7058b5c933611eb702d32c457c1d81ac355e1ba5ec39724c68f27dcb45acc6cb684b64d1bb6dcc0c1cedbb51c04c67b72a04

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
112KB

MD5
8b6e20ee10e1b0c3be69fff47fbe297e

SHA1
b21582c2ae58c1381824d1e8b354bb4472a51bbb

SHA256
3f12e3137ed75c070cec0967a1ad756c9d49c94530add231b6410b01c5a17642

SHA512
ec18bb06144862435bf29c05b0d7d2618a518d4d0fdfd8a5a7f4c6c8272acdaa2108a939578dab281f1fd822b80db2c1c513cea5becc8a9c0ecc97a6bb33aea7

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
112KB

MD5
efd4283790a360b48c141e289e12a6ee

SHA1
9cea1cb8df55c5fcc9ba5bdc282995d06d0e0f8c

SHA256
62ed486442076e4f6accb4d6034c23a288ef2ff428e7de6c4d32410ef7c5119a

SHA512
9ce68bf7f86dbce39d6c69e83022b49b68ebef22d0b967828f4c9178290780cf5221c780cec462ba5e512101d3a5d26f18193837768f514773c89e46ae975e94

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
112KB

MD5
ddee5706c4eb7c752ceea92d2475a2ed

SHA1
ad20d5e81105546cd8d2fb4a1ef72e7fecde2c7c

SHA256
3746c86324efda1bbe45c8d926d654fa3d4249c6ecfe92c40bf70659f8262657

SHA512
c898e1caf84009ad8bf7a492f3fe612671f3c8d171852f1652fe28c954816c353b15184902c88e203e056cbbb151bae02b348338e86c86c4eb757106f9d641ea

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
112KB

MD5
b0954c238526cd6cca75737e72eeab8c

SHA1
08d4c0a65b0051da3c2040471e99ecad27eebb92

SHA256
acd1a1333d02892d2b82f83d3593dca1cd6223b79ccfffd52edc3db6e18bd71d

SHA512
7c6ce10103906540086164bcd211fded30bc39ce822f16f7f9fd603f57b1e528201a3dd2ddb26396a0ef295ed0c49f219987562535aae607ee37912eb5793514

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
112KB

MD5
0c526b3701d8721eda5b8465b3b81af4

SHA1
575853b34f43435b0ed888e49156b8abb563601f

SHA256
feae3d583ea325423968fd52d5a26187c7024f1d29df7dfb6ea3b8e6f3d6290b

SHA512
c7d0e28ba6b14f0dc1811700f904bd38f6f6d1c3b4d706160be01fee5e84ef3cebca64a7d5b779769dba8dee57ae82e793256092ab62b6be99dee16afc899a10

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
112KB

MD5
8da0fd9127a88d864226c9f62f7776ea

SHA1
8ac1b003f1e8d1d35d6d95952aab806952a6ae10

SHA256
2b30f19a27b1bff67c1ffd632b4eb4d73f03ad15287fd09c2be3eb9308e842d8

SHA512
c738de20bdfc3ce6f9cb1ce04cca4747010f946d00f0b78040d0ba71232bae92575534e3d806e7ccaf57fbb142e9cee4d7be0ce42efecdacd249a2193b509b3c

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
112KB

MD5
e64f58c77d9235de77b57729e72aecf9

SHA1
8f26f888a02f92274e5437625aad1ede23034772

SHA256
fcbccd5d04f8d1cbe4980a15b6c186b513ec2dd6cfa2a1378b4aa74c90583354

SHA512
7d68e922525168135d220ac4f4b381d003be4f5c4c68f5838075e0c1d99952c71167bfb9e2bb7bbdf7321b4d0a24e890f10764c6556e840ee140f7df0ed101c6

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
112KB

MD5
c8b8f6f77851d7cbdea7ad4282b9a787

SHA1
42850529367a04534e8f0e0ed3d9c57808772a9c

SHA256
1ca6921d9b795019dc00914c6d533166028e49bb1a9fad65695785c4941ded73

SHA512
d13ac0437783129405dd89ab9fd76c0ba82246a19262832646b32d22174d3e2fd91372b02220f948c1d138de814e256283ddc7235e330c388fb1a7804922040f

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
112KB

MD5
dcfe125584c8c825ba9f17584f75d975

SHA1
ce47df353b8387e6ef659985ed9df694197d3c16

SHA256
2b45eacd0ef9f76fa5ddb6f712e9f5ad9fe653d19f6fc219d96fb06aa31171c0

SHA512
bee5a53e29278ad21850f19e357cb901450a9062e8adbdf3089f4b0b95ad89afc61aeda8c5ed7ac44e09577b0f305be24f7b962ef516f58bf2b954b5cd5d82cb

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
112KB

MD5
c2c569079c2f10a6c789b55284b21c8f

SHA1
09029abd30fde364ad884a70f88b279399e30713

SHA256
471fa5b9ba7bc09fc42ae629cdc48b4138e72971660b83fe34772f482404a574

SHA512
b7406390e81d131159dea58e2bef898ae1603006c4c39e2f03f103e54dce5baf8e2d49117dc1a10fcdff7e7ffbac9ca2ef591b687077e43a16d6ce908dac7d37

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
112KB

MD5
d5d7d265646078771aeb464175d72afc

SHA1
ff7f192a7e07611e3533f9f2db3f1cddfae68fdd

SHA256
83e3946464b08860b1b12b4c9002ff8809e6643cd59bd170adc4239ca3c81e33

SHA512
64f687be5576eee7f6c4951edf184c540bfa52b7f43ed49a8f09e0ca254e56fe28e23e4503bc0c705aa35f465e997d30f46f06817e58f25df41eac7913816bb0

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
112KB

MD5
621caaddcd571bbd487ed9db91909442

SHA1
2dc3b45cc2babdec244d731c864cb93a3da9b34c

SHA256
88294a3b5ea696a132d689a20c5b088ead57de425875cb3ab316fc98d89a9bf9

SHA512
a160dccedb8508c4f24eb316086974bc0497f44364756359e935559960f3b8bc7069e93d160dd99e0d451a7de4f7897235a93d2a557a333f28b7d11e4e8a4cd0

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
112KB

MD5
2009f832671b1d9e23533447697e23c9

SHA1
710c7f5e42a40fe2d0cc4127621496a2ca30d422

SHA256
0748ac8c1c3d0385ac2d552a70df8c4dbe4c3d532c635e8b7aeba91c0a72c336

SHA512
2dfc767c548ea94a1caab428bce138164ce0439e8e4c0ad1843bae02c54aadbe977befa31d5916bbafaf0f2784b5f0c1fb27d141e9f37d7f60929ab2191ff758

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
112KB

MD5
1aee15b2553cae78949cfa2a1b7cf46c

SHA1
af67d2a5b2871fe8f3bac2c7c3bfa2ecb117f7be

SHA256
fb3c9cbadc8be0f461ccf5a7e42b9192bf3a98d498bf7379bf8ef04795125a06

SHA512
ad9ccb6238d323ffdafbaa91ef2a134854b8b276f1c87f759b43fd37d4a2eff8a46280619feb157ce10a86c2b5aca3a5a554210ed53222003bf2c9ec1a5ef638

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
112KB

MD5
de95c837ab30987b4fd3fa7c9cdc8d42

SHA1
06ef45c971a7d1d8e808703b08f6569905a6b4b2

SHA256
8c30d8329abec9d2b8629528f205d3784d9c0c4feed094f5998afd5f7388982c

SHA512
1b487df31a36132124835fa44fb66c755c36a1dd75b62cbcde94345edf12362d46754fbe0a6e60798083a468c6f5c826a072a04d9b809fa447fe92753521bf97

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
112KB

MD5
c6a3152283648c9b64eec6ee64fffc9b

SHA1
3463f24a38be0535ba9995191c28a55ba3d1b5cb

SHA256
1672f85233413a6547a1e8555c6f11a57b10a1289566af1e32104beca1f144b7

SHA512
c8c8fd6296c6bd40774a9942db336772ad83f5be19951543cd2c36f557ca31e38c5b2fa2f3099a11e9bdd7ce2a4217d230276ab79b9fbead5a5843b5f8285205

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
112KB

MD5
0a544fd32858a1a3a1c4ac5f3cd7da64

SHA1
129879039dbce32b5bb72b88aed8751377608302

SHA256
071e946fdcecc3d8ac14c7c892ff1fe52278ba8eb0d3202450352f6566e7d591

SHA512
d0fa6b92184d07fffbf7c2086b0c39eb1f3343cdc98b4c13b9717cf141d2c4a3d031eb0c35e7632e2bb86d8f49c4ff99f4a9686dfeed44a2ac144da9893de897

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
112KB

MD5
83cf7fdb8755ea25065eb745d1aa5cfa

SHA1
801578c1b3290b4192e59c980034211896b723fb

SHA256
29b5641534163451fbaf0b36c6c84896133576150082575b33ca3bc496d3ee0b

SHA512
62539bd058f9d991e726a517d191c307a239b07b9caa732b6250588297a778b5a85daf8c64c7e2ad58ff6ba94c99bbaadef92ed77f9f88163dbc7f5d1da59ca4

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
112KB

MD5
955a4c4a7fed7e71db502a9aa82f1893

SHA1
67c11e8ff3ccd829130c6b466ca14e934c2e35e2

SHA256
df173d79e2b43c1197d18944e905fb6bd959f3fb3d450cf66faa842d41030126

SHA512
cb4193d81efa2ad6730b62b57bbaf52c05988589189e2d6df4ea86d9f2ed4a53668973479ca90a73760124740f68adcbb01cf7945c28d588444f86a780ab444c

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
64KB

MD5
fcc49a6c1cf952d0b211393b5175d97f

SHA1
271a12726cc907fb72403d14c0f3a56e39f85308

SHA256
2e682c7db1499156a42c6e65604aec7917b5d5af51b997e22bf22546ed2e98ea

SHA512
a4f2ebc8bf4ccab2c7bce022592502ca339f8963a06f2ed6f6498faedc32bcb9107683103b07790b18354086ff62e9df8edb09304a83bb85616e15e8f2ff862b

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
112KB

MD5
17e2e051fdccaa5e0cc80a8629e6c1dd

SHA1
64fbb419257f47d555de7f5f205ba3ddc42a788b

SHA256
5a7c7dcd777c96dc9fc805c76c989c2fae5566a0e96d8da296549e441e468f02

SHA512
a167cb33b5e76251e103792418176351ea533e7e839d385a6b76b24f51d41b3a483b9faad76e833fa5b44db6ed6a4891e41d0ba4782ecf1c97f6965cdce4fe4e

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
112KB

MD5
200ae737ecfeb1bc1223cd986efd0c34

SHA1
8de7cc6826de4fd3ad4978b5f4f3cb766a10a949

SHA256
84e01d7e5f7ed598bf3862a7d39e9ea317287a37aa93d3c855a4a8bf1f2347de

SHA512
5a1346a7c0a6d8fa53024deedcfae083023520f0ef99ea3d1495526be6673873234a8f6644ce59622e795cd0b5a35dbea75cfd83ccdfd6a66775e4596015d4fd

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
112KB

MD5
500378fd87e698178165e9ac52684b95

SHA1
8875788f3a5f782394f55877e0daef485a63e1ba

SHA256
4fcd46f4318e8a20b4c339e2733cfb651fc558b10b8578f7059fe84a8c4e6d29

SHA512
bf4d33ebed64a69787b79e9d9c8f3f2f312ef11b985bceb4afb14a4e626e6b126c85baf5fd5abbb68511ca00f8d5642ad48794d315374235502785be1bf934d4

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
112KB

MD5
99e01d59700bdcc2b6f603678768738b

SHA1
cf979a77b137cab1183f324ac1d478577bd5aaf4

SHA256
f2e268ad6ac5d1cbe25ab5ab921d78057f78bf80c5980b64243b0647596e0286

SHA512
8401e672637411585f4a5a3e68153f320c9f2c6fc7ad71b825e24ddf28645d63659875fa39f6de46336747d2bac8974995c181ab85511a4efbf8b34404e43c88

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
112KB

MD5
242827b69038eaac9f83402a358c459f

SHA1
0054497a7fa1570451282222f00604ca086fdcc9

SHA256
863f3b2763f75e90da0f2b76e3d2236cb85a651d4313013dc133be69ecde0217

SHA512
8105d874d3ddd84e169a5b98347883b003000ec390c0ec58eae1b15088a6a12bbde92d9fc69191ba942cbab1d3cb30142b9da6aff98b02fbd43cc3338bde9f11

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
112KB

MD5
124af540bac74a5805bb4778daa0a3c2

SHA1
2739f92cc327812c97d0768b81a3ffd823886d67

SHA256
67b72a5b29c817b391f9a5eadb639dd334eb81edd89bb4c4b94887291908740e

SHA512
070be81ba7e99b7d910b72427fc10c629222c4246186f81da629fc6fd86599ee42d71d124be632a4c68d2ff1e796ab4351ae1bd7d6c8ad402fd6655be6e770c8

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
112KB

MD5
74a13481534c78356594a8fb941427d1

SHA1
3dcdb2636401da0cd648df8d4820662317e706b8

SHA256
65f99bda9717e0dc6e3cce4d48313badbb220911ba002ecafa2cdc41151a809c

SHA512
b3e3a0d4c2814dcece22acffba57f78b4e2818206fe9ce59a6fabab746b96111c7bf91afc90eb6a66244fddb9cac8a25faad8750ba6f879e0dfd6eeaf12d4c01

Download Submit
memory/312-82-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/312-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/392-419-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/392-357-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/452-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/452-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/452-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/712-384-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1040-271-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1040-342-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1048-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1048-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1160-397-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1160-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1216-399-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1216-336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1448-369-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1448-301-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1620-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1620-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1636-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1768-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-107-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1816-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1872-398-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1888-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1888-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2176-343-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2176-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2220-363-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-356-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2292-400-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2300-278-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2300-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2528-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2528-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2584-321-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2584-243-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-144-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2648-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2672-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2672-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2788-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2788-308-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2856-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2920-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2920-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-390-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2940-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2940-197-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2956-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3076-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3076-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3172-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3172-319-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3200-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3200-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-134-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3304-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3308-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3308-207-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-99-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3992-413-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4088-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4088-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4112-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4112-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4116-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4188-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4304-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4412-180-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4412-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-279-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4632-126-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4632-215-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4736-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4772-162-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4772-251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-100-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4916-391-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-117-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4928-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads