c8ff5826f7feea8782ef63f2a2b279160a000ed519b1feeb675055fac66aea54

Analysis

max time kernel
102s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0444c34fdd3412c6b259c021c82f49f0N.exe
Size

464KB
MD5

0444c34fdd3412c6b259c021c82f49f0
SHA1

959b2bd5792841b7a736383ab2ec3d01a8ad0603
SHA256

c8ff5826f7feea8782ef63f2a2b279160a000ed519b1feeb675055fac66aea54
SHA512

bd68498fc80177d5ee6d72916cb93e391b694698afd0db9af606b3cf6cc3b5a4f5bf3fdb65c026d2e9a3be14f850378ba197a7d4a6d67e1c07e97e632ffd8ee4
SSDEEP

6144:DcUYApZTqEOIIIPCn4EOIuIPJEOOcHTETKEOIIIPC:Dc1ApZ2EVI2C4EVu2JEVcBEVI2C

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogifjcdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlpoqpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeiofcji.exe

Executes dropped EXE 64 IoCs

pid	Process
4236	Jlbgha32.exe
3888	Jblpek32.exe
3784	Jpppnp32.exe
4532	Kdnidn32.exe
3808	Kfmepi32.exe
3864	Kdqejn32.exe
2588	Kebbafoj.exe
2620	Kmijbcpl.exe
2688	Kpgfooop.exe
3788	Kibgmdcn.exe
2592	Kdgljmcd.exe
964	Leihbeib.exe
1860	Lekehdgp.exe
3212	Lboeaifi.exe
2844	Lfkaag32.exe
3576	Lpcfkm32.exe
4636	Lmgfda32.exe
2124	Lbdolh32.exe
2484	Mgagbf32.exe
2516	Mmlpoqpg.exe
548	Mpjlklok.exe
3376	Mgddhf32.exe
568	Megdccmb.exe
4964	Mmpijp32.exe
752	Mcmabg32.exe
2376	Mlefklpj.exe
4256	Menjdbgj.exe
372	Npcoakfp.exe
4020	Nngokoej.exe
5080	Nljofl32.exe
4220	Ncdgcf32.exe
2804	Njnpppkn.exe
1204	Nphhmj32.exe
1668	Ncfdie32.exe
4612	Nloiakho.exe
4328	Ndfqbhia.exe
4392	Njciko32.exe
1108	Npmagine.exe
2792	Nfjjppmm.exe
2148	Oponmilc.exe
2044	Ogifjcdp.exe
4460	Olfobjbg.exe
2448	Odmgcgbi.exe
1680	Ofnckp32.exe
4780	Olhlhjpd.exe
1420	Ocbddc32.exe
3432	Onhhamgg.exe
1540	Odapnf32.exe
1464	Ogpmjb32.exe
3840	Ocgmpccl.exe
2464	Ojaelm32.exe
856	Pqknig32.exe
2436	Pfhfan32.exe
884	Pqmjog32.exe
2020	Pggbkagp.exe
1356	Pmdkch32.exe
2216	Pcncpbmd.exe
1076	Pjhlml32.exe
4524	Pmfhig32.exe
1452	Pgllfp32.exe
3872	Pcbmka32.exe
4100	Pjmehkqk.exe
1620	Qmkadgpo.exe
2172	Qceiaa32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kpgfooop.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Nngokoej.exe
File created	C:\Windows\SysWOW64\Chfgkj32.dll	Nngokoej.exe
File created	C:\Windows\SysWOW64\Jclhkbae.dll	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Pdheac32.dll	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Bchdhnom.dll	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Kibgmdcn.exe	Kpgfooop.exe
File created	C:\Windows\SysWOW64\Gaiann32.dll	Megdccmb.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Andqdh32.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aminee32.exe
File created	C:\Windows\SysWOW64\Kbejge32.dll	Bnkgeg32.exe
File opened for modification	C:\Windows\SysWOW64\Jlbgha32.exe	0444c34fdd3412c6b259c021c82f49f0N.exe
File opened for modification	C:\Windows\SysWOW64\Olfobjbg.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Mfilim32.dll	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Icpnnd32.dll	Kdqejn32.exe
File opened for modification	C:\Windows\SysWOW64\Pcncpbmd.exe	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Qceiaa32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Ohmoom32.dll	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Mcmabg32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Cfmajipb.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Lpcfkm32.exe	Lfkaag32.exe
File created	C:\Windows\SysWOW64\Pcbmka32.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Kmijbcpl.exe	Kebbafoj.exe
File created	C:\Windows\SysWOW64\Lekehdgp.exe	Leihbeib.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bclhhnca.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Ffhoqj32.dll	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Olfobjbg.exe
File created	C:\Windows\SysWOW64\Ogpmjb32.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Megdccmb.exe	Mgddhf32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Kdgljmcd.exe	Kibgmdcn.exe
File opened for modification	C:\Windows\SysWOW64\Menjdbgj.exe	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Mmpijp32.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Eiecmmbf.dll	Leihbeib.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Oponmilc.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Ogpmjb32.exe	Odapnf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5880	5744	WerFault.exe	201

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmgfda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Andqdh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpjlklok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnidn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgljmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncpbmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpgfooop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Megdccmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjmehkqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngokoej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqejn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogifjcdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lboeaifi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0444c34fdd3412c6b259c021c82f49f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lekehdgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocbddc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njciko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcmabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpppnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndfqbhia.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lipdae32.dll"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleecc32.dll"	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Megdccmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icpnnd32.dll"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfbgbeai.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nniadn32.dll"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llmglb32.dll"	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	0444c34fdd3412c6b259c021c82f49f0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclhkbae.dll"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4236	1344	0444c34fdd3412c6b259c021c82f49f0N.exe	84
PID 1344 wrote to memory of 4236	1344	0444c34fdd3412c6b259c021c82f49f0N.exe	84
PID 1344 wrote to memory of 4236	1344	0444c34fdd3412c6b259c021c82f49f0N.exe	84
PID 4236 wrote to memory of 3888	4236	Jlbgha32.exe	85
PID 4236 wrote to memory of 3888	4236	Jlbgha32.exe	85
PID 4236 wrote to memory of 3888	4236	Jlbgha32.exe	85
PID 3888 wrote to memory of 3784	3888	Jblpek32.exe	86
PID 3888 wrote to memory of 3784	3888	Jblpek32.exe	86
PID 3888 wrote to memory of 3784	3888	Jblpek32.exe	86
PID 3784 wrote to memory of 4532	3784	Jpppnp32.exe	87
PID 3784 wrote to memory of 4532	3784	Jpppnp32.exe	87
PID 3784 wrote to memory of 4532	3784	Jpppnp32.exe	87
PID 4532 wrote to memory of 3808	4532	Kdnidn32.exe	88
PID 4532 wrote to memory of 3808	4532	Kdnidn32.exe	88
PID 4532 wrote to memory of 3808	4532	Kdnidn32.exe	88
PID 3808 wrote to memory of 3864	3808	Kfmepi32.exe	89
PID 3808 wrote to memory of 3864	3808	Kfmepi32.exe	89
PID 3808 wrote to memory of 3864	3808	Kfmepi32.exe	89
PID 3864 wrote to memory of 2588	3864	Kdqejn32.exe	90
PID 3864 wrote to memory of 2588	3864	Kdqejn32.exe	90
PID 3864 wrote to memory of 2588	3864	Kdqejn32.exe	90
PID 2588 wrote to memory of 2620	2588	Kebbafoj.exe	92
PID 2588 wrote to memory of 2620	2588	Kebbafoj.exe	92
PID 2588 wrote to memory of 2620	2588	Kebbafoj.exe	92
PID 2620 wrote to memory of 2688	2620	Kmijbcpl.exe	94
PID 2620 wrote to memory of 2688	2620	Kmijbcpl.exe	94
PID 2620 wrote to memory of 2688	2620	Kmijbcpl.exe	94
PID 2688 wrote to memory of 3788	2688	Kpgfooop.exe	95
PID 2688 wrote to memory of 3788	2688	Kpgfooop.exe	95
PID 2688 wrote to memory of 3788	2688	Kpgfooop.exe	95
PID 3788 wrote to memory of 2592	3788	Kibgmdcn.exe	97
PID 3788 wrote to memory of 2592	3788	Kibgmdcn.exe	97
PID 3788 wrote to memory of 2592	3788	Kibgmdcn.exe	97
PID 2592 wrote to memory of 964	2592	Kdgljmcd.exe	98
PID 2592 wrote to memory of 964	2592	Kdgljmcd.exe	98
PID 2592 wrote to memory of 964	2592	Kdgljmcd.exe	98
PID 964 wrote to memory of 1860	964	Leihbeib.exe	99
PID 964 wrote to memory of 1860	964	Leihbeib.exe	99
PID 964 wrote to memory of 1860	964	Leihbeib.exe	99
PID 1860 wrote to memory of 3212	1860	Lekehdgp.exe	100
PID 1860 wrote to memory of 3212	1860	Lekehdgp.exe	100
PID 1860 wrote to memory of 3212	1860	Lekehdgp.exe	100
PID 3212 wrote to memory of 2844	3212	Lboeaifi.exe	101
PID 3212 wrote to memory of 2844	3212	Lboeaifi.exe	101
PID 3212 wrote to memory of 2844	3212	Lboeaifi.exe	101
PID 2844 wrote to memory of 3576	2844	Lfkaag32.exe	102
PID 2844 wrote to memory of 3576	2844	Lfkaag32.exe	102
PID 2844 wrote to memory of 3576	2844	Lfkaag32.exe	102
PID 3576 wrote to memory of 4636	3576	Lpcfkm32.exe	103
PID 3576 wrote to memory of 4636	3576	Lpcfkm32.exe	103
PID 3576 wrote to memory of 4636	3576	Lpcfkm32.exe	103
PID 4636 wrote to memory of 2124	4636	Lmgfda32.exe	104
PID 4636 wrote to memory of 2124	4636	Lmgfda32.exe	104
PID 4636 wrote to memory of 2124	4636	Lmgfda32.exe	104
PID 2124 wrote to memory of 2484	2124	Lbdolh32.exe	105
PID 2124 wrote to memory of 2484	2124	Lbdolh32.exe	105
PID 2124 wrote to memory of 2484	2124	Lbdolh32.exe	105
PID 2484 wrote to memory of 2516	2484	Mgagbf32.exe	106
PID 2484 wrote to memory of 2516	2484	Mgagbf32.exe	106
PID 2484 wrote to memory of 2516	2484	Mgagbf32.exe	106
PID 2516 wrote to memory of 548	2516	Mmlpoqpg.exe	107
PID 2516 wrote to memory of 548	2516	Mmlpoqpg.exe	107
PID 2516 wrote to memory of 548	2516	Mmlpoqpg.exe	107
PID 548 wrote to memory of 3376	548	Mpjlklok.exe	108

C:\Users\Admin\AppData\Local\Temp\0444c34fdd3412c6b259c021c82f49f0N.exe
"C:\Users\Admin\AppData\Local\Temp\0444c34fdd3412c6b259c021c82f49f0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\Jlbgha32.exe
  C:\Windows\system32\Jlbgha32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\Jblpek32.exe
    C:\Windows\system32\Jblpek32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SysWOW64\Jpppnp32.exe
      C:\Windows\system32\Jpppnp32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4532
      - C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:568
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4964
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:752
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4020
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1668
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4612
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1108
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2148
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4780
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3432
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        51⤵
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3840
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2464
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        54⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2020
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        61⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        63⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2172
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        68⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        69⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:4944
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        71⤵
        Modifies registry class
        
        PID:2672
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:780
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1212
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        80⤵
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3932
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        83⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        87⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5524
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        93⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        97⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        100⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        109⤵
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        114⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 416
        115⤵
        Program crash
        
        PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5744 -ip 5744
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
128KB

MD5
ef58f8f7e08f08d2145e6fc6dcacefb4

SHA1
52596ec0f4503522b6170042d7cf965782f219d6

SHA256
3bd9067175fec5060f033ee88c35198959d207a3c5f12cca50e5dc0c4a165c35

SHA512
09ab6d286ed29b3bc8a08de3ac46f3e1477f77ac0c6db8673edcbb413c1d9bbd1899fce096785f728337c907680d53d504ba3665457dfd38fc3b90328e7a2c8d

Download Submit
C:\Windows\SysWOW64\Aoohalad.dll

Filesize
7KB

MD5
fe6d4631152661f5d02a0c520dfefbe8

SHA1
551f8f7e7fd4d12daecb84ae255d6ed03867b100

SHA256
2ff0482e08cf68e657aa259f8eeb4763bf5e10511b04ea4ac3ae47ea7b19761d

SHA512
1b071f1351eb59788fb06c5d6adfdcf6c61c80e4b80c15ed9dbd307a01cd7bf39a6d8ad66428ab64d3c122a46f8d79af74d25cba022d310f6c1fa43c8d35474a

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
464KB

MD5
d0c0e7568db977f00b53c626b9cb504a

SHA1
e7a2acc4ef1a16c0ae598d7b2dcf12e515426c91

SHA256
3356a1c4392edbfed58bf32d5facab1f8a98639f37fe7a5d8ff242e9d7772943

SHA512
75df8781042db1b2e90d9e6ed3e4584f535c7a4c472a52f0967c24491a9536fce80b362c280e300c9868468f608518748cca95c22ff6bd28b50e8a4ba1236bb8

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
464KB

MD5
3465c44e81681ab23ff0f304a37a481c

SHA1
06659cbe27cc190c221a2fe3b8b6f76c71b7f396

SHA256
3b6ff430886776bded0742723e78d3688fd407c104f87e2f914ce92c34bb548d

SHA512
e8eafe54ee778f414695c0ca09b26090fe7314c53b7b51609114cfcd7226b6bf78ea6ad054e1bbeea0013a2652d4ab04bb363b95ad8fa44b1d56d321014c410b

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
464KB

MD5
70f312bcc921ab56ee28b9097df09fd5

SHA1
88e72252088c5c3dfe259c5ce9bcd5ea882236bc

SHA256
cbb968bb1d74d5fbf638548167c75c84ec1fd6bd988b9804f6239784b1728fea

SHA512
b16dd82732cac27055591970d4911cd01d1a4a88efb892bf93004a72dbae015f7214725f632ade28ce04e41974e0bdc34acca9f648ea09c3dca1e565fe24be56

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
464KB

MD5
8ee8ef088aaa7843897cca674e597316

SHA1
05ee27bbfeb21c26acacacb3b0c819b2be7c0184

SHA256
972688ca997bb3deed49824606e5d2cc8fbd65300209c3a75935d66454023fd0

SHA512
6951e23411b864b4e789c997ed234b9357812c7b0649ad8bd35713094bae05f08fa1473d37bda6177d38b8a67cf0676e30252b2c389fb36198991e8f37e52e39

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
464KB

MD5
29227bc500522305a96209f9a49a2faa

SHA1
f56cf1449bcfbf46d0802eeff4c36a5387904c98

SHA256
bb83139a0b4dfb575af3ddb77e1f354610228fd0861d011f892a7af38d71828a

SHA512
dc48c08b511468e71d6cefbd7f2fa5fdc2e8551033d36d0c82e29afee1ef3a4ddc07ad8a56327705bf89f18fc62372fbcb64f473a7c8b68a732c7e3302b71169

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
464KB

MD5
3f226e6d8cdb99c2072a520ee45f806d

SHA1
5bebc425da4b35db3dfc23ec59092a2c7f45310e

SHA256
ab8026ac7b769450fa5af704b46d6bbf51679323c5f0e9d9998370333376cb22

SHA512
36dd63f7d9a6e898825b1c89d13a55ad9ea631c3724f7b3cdca35a0b946dd977a97361291a0fc4854fc3083b0d9e6eceb5f0370440d9e5fe0e596c8adaf766f4

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
464KB

MD5
a5921656609e7c5f849f540337bd1298

SHA1
ce9c432ead169b8ee68880ca9e42d26b1d6aafa0

SHA256
a7dbfa2673e70d7990d75b1e8baa597f86457064672b56a7656a184987bde088

SHA512
cb6e873c7bc0c832b5caf98847694d13f87dac2cd5774a57df2416e671853118483d75ebe73124fc1f27a83f8c0030d87100b5cd027ec2f9ba45d4f1635889a5

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
464KB

MD5
cb181bafc55781dcf8fb32c5a03d916b

SHA1
4f94182c287d138300e47c59237cf85bd32e7454

SHA256
7d123cfffce5cb9d2cf535c966741b609885897e44242a12b90618d36651a231

SHA512
2f4610420dbb3761998abe7566faf8aa07b727acd18f7f6b48c385a8f60560c7f5ac2f81fdfc5e0f578b407c6d1357d7c73d501b42f28d59dafa468611e08d5c

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
464KB

MD5
f0136e64bed3ddd94267d63505f69b23

SHA1
c625aee0fd10131fc07b867b08ca6ff2faea18d4

SHA256
b3eb3c8677b1a1903b4a941af5da4d61dbf8f6616a1d190deb138f723de0a59d

SHA512
2db9bbb3ff9d0f2a90d2d8fc0e05a93331e37b502ce966d81db4a482d8b6d6a01286e9b1f6a481ad2972cf9d31b0e4793cca34a27d86986e176efa1a76e133fa

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
464KB

MD5
69192252d71d1d920398da08588f998d

SHA1
7bdba8da1b16c26a553b18ede5d4b8293e86ceca

SHA256
410274f7f5dab6993ea2f220abda3630a80f45a0d887476c260606ddcee93972

SHA512
d9d6310c5e8274d4e66dee540c3e5dd80e02c864b16f9e7fdae675f64a6e75b5073ed7d8d3ef0ab6d132e24fc507685d93e97754e0425e2c8ca42820e0c87c24

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
464KB

MD5
2483701976bd6a6e8c25034f149f260d

SHA1
c373647b176ef9569ea81ae2c0a7dc1f863b6792

SHA256
2420e6c5ef78a035686c0d5f9994f626760a81c184ccaeebc946421ceb40d4d1

SHA512
96428d9fca097a47b876f8da9ee955c726a681a1c7a902c62b86e10ab4e308018d35e5d4bfcd568c4fa18c54d293a66d08e89add0485f7ca1d84fab5ab7752d4

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
464KB

MD5
fd5b7dfb6b3fd033bd934258da21c6c1

SHA1
4f1f146d2b2a1339306eb982e27b079421b106c5

SHA256
1b5414566434493227396010beb1b10f94fd804252f526b8d129b267fceec776

SHA512
4c7bf8b9e84c91e97b1a8ccabd18de2b5ae4b3235ce5b806d1983bc9a412d2a8ebca785e4c109a8a2cc8a266a371c90955c82edf04143a6705c5219a51529913

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
464KB

MD5
7cac29242739e4890117bcd4bdaeca54

SHA1
f9c65e0927afdf24d0cfb5aa3e169e9670cf5ebf

SHA256
1bf44801ebccedbfc6240ea6bd549ab5f00f9f6e29732ef73f70686a769a8544

SHA512
9e24b12bd80e13888a242187db9bb3192117b52586180da5910c0b8dfe4b45efa8d51a92ac6d601cd1192c89f8b6561b53976d8e4594870bff88eeb302aba1a1

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
464KB

MD5
ec9238bd6cfdcab63d72379efe3c996f

SHA1
809041a4a46357a56fd58fcd7c161d4099c08837

SHA256
61afb4fd33281601dfe54351386251ed180893761eff7259eb53cab8fa7504e6

SHA512
5144b35ffd16089413f0d1cd6b1c877d4841400f0248b6a828c045084df927aafb8e2a0490101bb3b975ddd00754d66fb771e6ce7e544f731ca1ea694bc2d191

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
464KB

MD5
8a1a15434647d13e859fa9319f211204

SHA1
024e910ebd9941552bdd143eacc6a8ab4298905a

SHA256
a7e3e72b355cced34efbba64c1af15b0418a4a85ff7d4b796ebb0768806eb7cb

SHA512
2bd1d83e4f6e4433d32a8135f94ebdf3828e27f9185bc7f82c969e1fd3502a2115c2ae435a07cd63555baa456e2e5048274ae819724848fde70e4a756b0d2b87

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
464KB

MD5
62bc27afde6c4fe02267715cd134691c

SHA1
8fbc379e11695f80c9c58dbb3ac151921d7b0ea7

SHA256
ac8d5b51c1e7fe6fe51d567ca69bafe44e8b97b365586d3ff4169e58af925cac

SHA512
5196ad0c44335ac6a4d2e5cd427b30657d693c7b4321b2f9592213c7591f5d07ba724cfe49d3796d818ca0eb8081b810d0e5b27544915d661a51c8d5538a4a3e

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
464KB

MD5
2bc11bbad0dbe3c306dcebac5fed17da

SHA1
cd1e439b74449d4a94b19f34b9ce54e9096fe30a

SHA256
9ff0712c74cd7b1b62ce5224677d2b2094ebc546b3e318aeae4a95f5fae6aa47

SHA512
191333d4e5aae6c9eaffc608e74b03764c33ea09d413d2b0b8d94c892b9d3cf68ceea345daa14a4049989c81e646247164352dfdbf2e85d8f800184f686af00a

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
464KB

MD5
86aecc1ac43f5816224952a676778a71

SHA1
f9caa3af3d1e3a3ab29cadb2a38672e8cc4b34ba

SHA256
e57545b8e832359c86055516a0f776af1d85619cdd71d98ce3929d6fd13443c8

SHA512
c403b5cf298dd6456baf9270a5e64c0a0ac014a1f2c2cb89d478faa1687ba7206173d8f49dcd011ad40af0c755f15e6cacc818db3436bcf0cf81c140da2d3068

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
464KB

MD5
145eb55537c676f4c61f7853a9ba0693

SHA1
ae0719dd305dc419b805e101e1b6d8b85c075e62

SHA256
8a541958167f722fb34bf07449e633960459467b26ccfa7f36aa8bc1bcd1c5fd

SHA512
298e042d1cfe7ef8eb69371e901675c3b3e4c622639de76616982811d9e61715e21c45d21c91489de6e1ee4d2b5b337a3489066cdfc8f648d0c49f3f5d6b752e

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
464KB

MD5
7c0b6685606b765062691d091cc89a51

SHA1
a5996f394e399928ff9694b668b3c429c708e155

SHA256
a7a20580c448019120e4840a3a5ed697501da985a00b326b93ccfc3b35c0dcc0

SHA512
9aad35098a9e29ddf29f01aee77751714c85e116835447bbd1c9db0699fb7abd19f699919e0f0129109037c731734742124dd22064e8459c89248400a358a7bd

Download Submit
C:\Windows\SysWOW64\Lekehdgp.exe

Filesize
464KB

MD5
59e8dbf8d68075b827c385f919c46274

SHA1
ab79ce7500ea0e943066888525f8d30c6b771cb0

SHA256
259554a03362803b7bcff2d6b8e4b4dedfc4296d1ef4142f3524cf426e935e8f

SHA512
2f9fc82afc4a15d12a2a1977099a7d1a4292b8b8234095925c4b817e0a13d232bde4219646fddd5e7846569a51762829bc269ad89467c740a9b6d7d4bcb263fe

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
464KB

MD5
2337d488c7bc70cb9e0a10f04ac98b5e

SHA1
808b6f96d194d7a9ade55eb4329f232eed6d6daa

SHA256
0111152c535cc0c43499a1185aa65ecb9adae03377274f8778788801a2867fc7

SHA512
5494b200aa24764e20c19fe91895e05ad678b47f3d69fe9487f710329f9c16b573de0d0c1eb77365fc4490661a5c1684fa47736fbcdefcad157590e1370cfaa0

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
464KB

MD5
cfaa211bcfb4d558996b8124d2cf20b9

SHA1
f6b68540f26a1ce362ada8560ca6bdfdc53fdddf

SHA256
04ffdaaea2d19545a284e72b1b0dae6b49a23fe762316d6888a1bae3246b24d6

SHA512
7afd497e649644a7545351362576346f0e0fb8ea873d4aca0d1320ed6b3e4e64e1368be6f28fbc8bcc465e562bc3060d7d2286589820d3d186f187f261b94583

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
464KB

MD5
9eb38e050f635ed6a1a8fcc3aac80fd4

SHA1
139be73e07f1a6e211af0643332c446b4d0c97ec

SHA256
34207180cec7b2df8fdef36ca4cb25fbf56df0959ebd2aeeeae841edcdfae1f8

SHA512
a407668cd411e3d025980328b7f8d512f77456aa31ead391cc15648fb0da170a8302d617d0c70bd7d3e02f386ac7e358b14e1382811bf2ec19d6defc782a43cb

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
464KB

MD5
0c23e2157dfaa11676994e85ef9f4a29

SHA1
536098755c972fe5299a6a837e37b20af6bfa549

SHA256
8a0d54725141221cc6e39bca46746e5aa657d7b3a449563ae1db70417aa58b6d

SHA512
fe7556f07579fc2e48595c69d0b196104169c38881e4820aa7fda22e9beb3387f6d068b7daf627c0944a4eee7a0b3edd0b6d3992f03f66b471bd5f80135e5a39

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
464KB

MD5
be1f80015458a33f52d8336ed734754c

SHA1
2e7c995a5115490e6f50c01b49dd320265913326

SHA256
b6d74f85f0f7217a3ffdfcb71a6239484c1f1715dabda09298ef7ffbb4b56fba

SHA512
f9b02f7a603166402dcb19edfca91aef1d98ebefda465fef88e251131d5957510150941120854a428c474ea85721f0086a788a6e10c552afba88e5484744e441

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
464KB

MD5
5c4be02e952a1813fcac16d5ff298cc3

SHA1
673925bf160b9ba8382cb2f5b2b00c4b00b6707e

SHA256
00f851b1465d63efbd60e7c281a709d76cd1a66db27e8d64ccc1e55bae78654e

SHA512
72cfd0188fabe908ab4d3e94c0b3bd171c992214ea0388ad76f829541c797d4fbf7232e3b1f7fd07baf98f110927a09ff43b935dec66d9ae193771e2a99b6668

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
464KB

MD5
2a3e7bcbcde8123f79fa643275771492

SHA1
fc861ebfad4177b4b2f444803f8a3f0aaa6c44c7

SHA256
b2efa5f18139f52c519479c7534bbf891e1e8c1c1c1b15973c2b8e3310eda004

SHA512
f6f14a198bf5fe794aedba4a9149818acf5f1ebebe0f4eba95099256a52e4223a1cf1e82135fa9fe4dada0bfa837514b12227fa04e8d70a9479138d8b7b1a0c9

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
464KB

MD5
116170af2ef4be06f70dee8da7102d3c

SHA1
091f0b628d466668b5a302415eb328edb316cfe1

SHA256
0186155db5cae2ebebf55501e1c90eb6e422e36cf771179d91dcfd4d4bb583c7

SHA512
d52e087f059f930e9823a24e5742c8eae5a421e1350555ccadfd694cd382a73c3303d954822be55b9874fc8f6c2bdcc2e0005be578bb0dd39c21db39db3c616b

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
464KB

MD5
155d14c555994674fe9c74933b02c6cb

SHA1
b1a5965a107ce77ff67226b99a2e86d64fa3daff

SHA256
55c1fb95e0bd0ba2d5c6774f5986a173b257535b88b2a200c5b3ebb29d272003

SHA512
0d3f28ab18587393f060abcbfc66827eb1e1b9baab5fb392f348fc2d2ef4c9a850aace8d6f5f9350d2d30e2448202c2bd63f8a69cefdb9e04f731e2e980fb4de

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
464KB

MD5
a83401493c055b6b29cd8ffc22d45691

SHA1
a986a5f0543d2e11d2d295a9e9a829d072f722f4

SHA256
be57707820504b18fdca117870f816de507d1083336f4a02cead62c0a73e421a

SHA512
785ec8e4d9ac89a8e713083044f060d34f71a4fe5f1ae479824ca693131149796bf45df57d8005308dee447af073bea9294b3143c7c22f74d551e30cc0cb8339

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
464KB

MD5
7741255caa997646f7bedce349ec5a42

SHA1
300d37d2b87045764ffe1c4482e28e90db51de23

SHA256
d15c603ba3e65312804c03288895be6ab8dfa98e6be6d7f8a94d928c0d290ea8

SHA512
d386435b97d26f4f94a94ee686f0739106f8d95c2d04cb5d71714c0547322bf21c1e0ad64d68373f9922bea346d3ff6f6c309a8a69d30bc7293e4b108438b968

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
464KB

MD5
bb655035a41a873d2becf7d69b98d5a3

SHA1
eb5c5cec0d2caba226f3218743b814df302d4103

SHA256
3b7d2fbbe469660937da4c8f412c6c40e3145f92674a379326c3ebb2da24d6ed

SHA512
92844e299bf15420b3985476fa9b7d579e3c77e4fff398f25f0778789d53c9a8fec0ba0690e5dbe6f541998bf43080b3b3ce683b5dd00ef88237a8f5629a4a00

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
464KB

MD5
896b451ac8f70ee302c899dfffe22887

SHA1
00e57c5a6809ccb7cade05d12b07bc0d318cbf12

SHA256
9a2d4b522b6ba90134d78a8636d8dcd48179a347630121222822c4132ffdaf7b

SHA512
21df89af50bc33e42f40cf220a109e3fa921c27384438373b63ad659e584d24e6bf1a61df243def627fd1d55a60d40bb696f52182fbcb2f384eee57c8a4e45f5

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
464KB

MD5
f5e7a371a52ec9906dbc4819c5288baa

SHA1
18cf7a5f6d056b71b598da50317ed63c3af06dcf

SHA256
df744d3c037e283ad843cdbc378c0e3ba1e962cd2d7c9130826be9484458ab81

SHA512
dec9b2f30a191d3296fb97ea0008b8e47e0925e2feba49b930e225edb874be36a872a73ade95e604e9b21d2dd3eddf6566873552c42773a0042a58750f676fb3

Download Submit
C:\Windows\SysWOW64\Nljofl32.exe

Filesize
464KB

MD5
ef867d00ae5a6754107c0c44a3bf148a

SHA1
c4754edf4fda1479a79b781121486682b80ce6dd

SHA256
8c9c92d93ee1a89b91eb67633deb349bc074efb2b991fe8e23796232f1a0bad8

SHA512
d3c741e56af86ad73820cd81a75982cfe0a9294723695214674753ceefa7087724238f633fb9e1c623a8135e5d364b0545dae08731ef028a71e31847677f03ff

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
464KB

MD5
d4321e6d8236d95c965bb97fc601237b

SHA1
16a290f8a7ed84aeeac4cf4f28c69aa01be14493

SHA256
ba36a08b5c18b0ae4cede1fc29324e81930b4f0c75ebf6c07a2aaf5480608a31

SHA512
fbcb8da700a135fd48f3a36bdc5237d6a4e3dfa19ddbe4181a35b2bfcd5cf31c0141045d9aa1c1dcb496e27832933427b1c618f45a5a668f69653ab4fa2f4142

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
464KB

MD5
9b60695b4ae72b3f4af89e9096b1b2b6

SHA1
9d2d40f1432fa8fb93185852c989b3873a1b017c

SHA256
e412debf4f003dc398256b628480091fb75e90b13dadb13b03ce1d7a95ddbea1

SHA512
b7e20fd4913c608e4509bc7dbb36d2e8085a27e54591f6a5c1ca73282aa94dfe3edb43d16b4f6e7b7bdf80f681d18894b15ce1834d92d04a802efec8d92d2864

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
464KB

MD5
ca4e7552db51ce3150b1525278f5c4af

SHA1
d7dbac4cc76d1be7643f5abc950075583f84911d

SHA256
300efef67c7fc97dde900b6321970d1e6781ca9c402d0633c97eabfa24848385

SHA512
a783e53ba04ea00caf03928a4796ac588954e752a4adcc2a89d1aa34d45c59267c5175edbe66ae6bbc02cbaadd6fb9d7079f70dbfd5a7edfd7a568958d3eac1b

Download Submit
memory/372-222-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/448-529-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/548-167-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/568-182-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/752-199-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/780-494-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/856-374-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/884-386-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/892-506-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/964-95-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1076-414-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1108-289-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1204-265-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1212-523-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1344-0-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1344-535-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1356-398-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1420-337-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1452-422-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1464-355-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1540-349-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1620-440-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1668-266-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1680-325-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1712-482-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/1860-103-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2020-392-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2044-307-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2124-143-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2148-301-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2172-446-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2216-404-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2376-206-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2436-380-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2436-880-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2448-321-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2464-368-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2484-951-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2484-151-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2588-56-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2588-583-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2592-88-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2620-64-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2620-590-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2672-476-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2688-596-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2688-73-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2764-488-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2784-543-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2792-910-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2792-295-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2804-258-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2844-119-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/2920-458-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3212-115-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3216-500-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3228-452-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3376-179-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3432-343-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3576-133-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3784-23-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3784-556-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3788-80-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3788-603-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3808-569-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3808-40-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3840-362-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3864-48-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3864-576-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3872-428-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3888-549-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3888-16-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/3932-536-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4020-231-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4100-435-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4236-7-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4236-542-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4256-215-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4328-916-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4328-277-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4392-283-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4392-914-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4408-512-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4460-313-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4524-416-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4532-563-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4532-32-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4636-135-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4780-331-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4796-464-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4944-470-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4960-356-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/4964-190-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5080-241-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5132-550-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5180-823-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5180-557-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5260-570-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5308-577-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5352-584-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5436-597-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5480-604-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/5608-803-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download
memory/6092-780-0x0000000000400000-0x000000000049D000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads