c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe
Size

664KB
MD5

ba58ead6c67f90451fba451baf2bc042
SHA1

3d2fd8ae30ccd8fa6a9f1dfcb5ffc3ae142656ae
SHA256

c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109
SHA512

b8a3cc4d4acbd5562ca37249a77ed3e17a0a1a6824e70f48d21d313075307ca664a8bf73459289c9700f26f1af8678aa41441a939bbfe9eb0995beb9a683aa07
SSDEEP

12288:hoj6X11PpV6yYPVpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDYjF:hhPPWVWleKWNUir2MhNl6zX3w9As/xOX

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apddce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcbeqaia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qbngeadf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alkeifga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpnpqakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcdqhecd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aijlgkjq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbcignbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdngpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdgolq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpcdfll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pomncfge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbddobla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbcignbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bimach32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofbdncaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cibkohef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmifkecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflfdbip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfknmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acbmjcgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afqifo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aealll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpgbgpbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbddobla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcncodki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abjfqpji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbjogmlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mddkbbfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbmlmmjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkfkng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aimhmkgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odljjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bejobk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboplo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmfqngcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bedbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfmahknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfgfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bboplo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbalaoda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abgjkpll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddcogo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bblcfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alpnde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cefoni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mddkbbfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odjmdocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeffgkkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obidcdfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peempn32.exe

Executes dropped EXE 64 IoCs

pid	Process
4036	Mlemcq32.exe
3564	Mociol32.exe
2412	Mhknhabf.exe
1104	Mddkbbfg.exe
4904	Mllccpfj.exe
4444	Mahklf32.exe
1776	Nhbciqln.exe
4304	Nfknmd32.exe
3696	Nocbfjmc.exe
4600	Nbdkhe32.exe
2128	Ofbdncaj.exe
1228	Obidcdfo.exe
2292	Odjmdocp.exe
4688	Odljjo32.exe
2408	Ocmjhfjl.exe
2672	Oflfdbip.exe
3176	Pdngpo32.exe
2284	Pdqcenmg.exe
3732	Pmhkflnj.exe
2140	Pkklbh32.exe
3332	Pcbdcf32.exe
408	Pbddobla.exe
1592	Pecpknke.exe
4560	Pmjhlklg.exe
4892	Poidhg32.exe
2964	Pcdqhecd.exe
2584	Pfbmdabh.exe
676	Peempn32.exe
3180	Pmmeak32.exe
2872	Pokanf32.exe
4384	Pcfmneaa.exe
2316	Pfeijqqe.exe
2432	Piceflpi.exe
3060	Pmoagk32.exe
1692	Pomncfge.exe
1420	Pbljoafi.exe
3204	Qfgfpp32.exe
1048	Qifbll32.exe
2836	Qkdohg32.exe
4484	Qppkhfec.exe
3268	Qbngeadf.exe
1644	Qelcamcj.exe
1268	Qmckbjdl.exe
4780	Qkfkng32.exe
1092	Qcncodki.exe
4888	Aflpkpjm.exe
5136	Aijlgkjq.exe
5172	Amfhgj32.exe
5208	Apddce32.exe
5252	Abcppq32.exe
5296	Aealll32.exe
5336	Aimhmkgn.exe
5368	Alkeifga.exe
5408	Acbmjcgd.exe
5456	Afqifo32.exe
5496	Aecialmb.exe
5536	Amkabind.exe
5576	Apimodmh.exe
5616	Abgjkpll.exe
5656	Aeffgkkp.exe
5688	Ammnhilb.exe
5728	Alpnde32.exe
5768	Acgfec32.exe
5816	Abjfqpji.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Oahmla32.dll	Aecialmb.exe
File created	C:\Windows\SysWOW64\Bbcignbo.exe	Bpemkcck.exe
File opened for modification	C:\Windows\SysWOW64\Bfabmmhe.exe	Bcbeqaia.exe
File created	C:\Windows\SysWOW64\Mahklf32.exe	Mllccpfj.exe
File opened for modification	C:\Windows\SysWOW64\Odjmdocp.exe	Obidcdfo.exe
File created	C:\Windows\SysWOW64\Pdngpo32.exe	Oflfdbip.exe
File opened for modification	C:\Windows\SysWOW64\Pcdqhecd.exe	Poidhg32.exe
File created	C:\Windows\SysWOW64\Odlpkg32.dll	Pcfmneaa.exe
File created	C:\Windows\SysWOW64\Cmiikpek.dll	Cboibm32.exe
File created	C:\Windows\SysWOW64\Pmmeak32.exe	Peempn32.exe
File opened for modification	C:\Windows\SysWOW64\Pomncfge.exe	Pmoagk32.exe
File created	C:\Windows\SysWOW64\Bemlhj32.exe	Bboplo32.exe
File created	C:\Windows\SysWOW64\Pbddobla.exe	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Pfbmdabh.exe	Pcdqhecd.exe
File created	C:\Windows\SysWOW64\Bbalaoda.exe	Bpbpecen.exe
File created	C:\Windows\SysWOW64\Idcdeb32.dll	Bpbpecen.exe
File opened for modification	C:\Windows\SysWOW64\Alkeifga.exe	Aimhmkgn.exe
File opened for modification	C:\Windows\SysWOW64\Apngjd32.exe	Abjfqpji.exe
File opened for modification	C:\Windows\SysWOW64\Cfmahknh.exe	Cdnelpod.exe
File created	C:\Windows\SysWOW64\Bllolf32.dll	Nbdkhe32.exe
File opened for modification	C:\Windows\SysWOW64\Pokanf32.exe	Pmmeak32.exe
File created	C:\Windows\SysWOW64\Hblaceei.dll	Piceflpi.exe
File created	C:\Windows\SysWOW64\Qbngeadf.exe	Qppkhfec.exe
File created	C:\Windows\SysWOW64\Ggociklh.dll	Abcppq32.exe
File created	C:\Windows\SysWOW64\Dlqpaafg.exe	Defheg32.exe
File opened for modification	C:\Windows\SysWOW64\Cdnelpod.exe	Cpcila32.exe
File opened for modification	C:\Windows\SysWOW64\Mahklf32.exe	Mllccpfj.exe
File opened for modification	C:\Windows\SysWOW64\Pmjhlklg.exe	Pecpknke.exe
File opened for modification	C:\Windows\SysWOW64\Bppcpc32.exe	Bmagch32.exe
File opened for modification	C:\Windows\SysWOW64\Bpbpecen.exe	Bmddihfj.exe
File created	C:\Windows\SysWOW64\Blknpdho.exe	Bimach32.exe
File created	C:\Windows\SysWOW64\Mmhpkebp.dll	Bppcpc32.exe
File created	C:\Windows\SysWOW64\Lgkkbg32.dll	Cbhbbn32.exe
File opened for modification	C:\Windows\SysWOW64\Ddcogo32.exe	Dpgbgpbe.exe
File opened for modification	C:\Windows\SysWOW64\Poidhg32.exe	Pmjhlklg.exe
File created	C:\Windows\SysWOW64\Dbooabbb.dll	Qifbll32.exe
File created	C:\Windows\SysWOW64\Iilpao32.dll	Qmckbjdl.exe
File opened for modification	C:\Windows\SysWOW64\Aijlgkjq.exe	Aflpkpjm.exe
File opened for modification	C:\Windows\SysWOW64\Bejobk32.exe	Bblcfo32.exe
File created	C:\Windows\SysWOW64\Jgedpmpf.dll	Nhbciqln.exe
File created	C:\Windows\SysWOW64\Fddogn32.dll	Pmjhlklg.exe
File opened for modification	C:\Windows\SysWOW64\Pfbmdabh.exe	Pcdqhecd.exe
File opened for modification	C:\Windows\SysWOW64\Cpnpqakp.exe	Cmpcdfll.exe
File created	C:\Windows\SysWOW64\Kannaq32.dll	Pokanf32.exe
File created	C:\Windows\SysWOW64\Amfhgj32.exe	Aijlgkjq.exe
File created	C:\Windows\SysWOW64\Hjjmaneh.dll	Bmagch32.exe
File created	C:\Windows\SysWOW64\Ppbeie32.dll	Bmddihfj.exe
File opened for modification	C:\Windows\SysWOW64\Clijablo.exe	Ciknefmk.exe
File created	C:\Windows\SysWOW64\Cehlcikj.exe	Cbjogmlf.exe
File opened for modification	C:\Windows\SysWOW64\Mddkbbfg.exe	Mhknhabf.exe
File opened for modification	C:\Windows\SysWOW64\Qfgfpp32.exe	Pbljoafi.exe
File created	C:\Windows\SysWOW64\Aijlgkjq.exe	Aflpkpjm.exe
File created	C:\Windows\SysWOW64\Ldhopqko.dll	Beoimjce.exe
File created	C:\Windows\SysWOW64\Cefoni32.exe	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Ldbeqlcg.dll	Ddekmo32.exe
File created	C:\Windows\SysWOW64\Qkdohg32.exe	Qifbll32.exe
File created	C:\Windows\SysWOW64\Acbmjcgd.exe	Alkeifga.exe
File created	C:\Windows\SysWOW64\Apimodmh.exe	Amkabind.exe
File created	C:\Windows\SysWOW64\Cmdmpe32.exe	Cemeoh32.exe
File created	C:\Windows\SysWOW64\Dlncla32.exe	Dipgpf32.exe
File created	C:\Windows\SysWOW64\Codncb32.dll	Nocbfjmc.exe
File created	C:\Windows\SysWOW64\Apddce32.exe	Amfhgj32.exe
File opened for modification	C:\Windows\SysWOW64\Cleqfb32.exe	Cifdjg32.exe
File opened for modification	C:\Windows\SysWOW64\Nfknmd32.exe	Nhbciqln.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5896	7128	WerFault.exe	214

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpnpqakp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cboibm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddcogo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mllccpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pokanf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clijablo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mddkbbfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcfmneaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cefoni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qkfkng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acbmjcgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cibkohef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Poidhg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aealll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dlqpaafg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nocbfjmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcbnlcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abgjkpll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmddihfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbalaoda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmfqngcg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmpcdfll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cleqfb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdqhecd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfgfpp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qelcamcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afqifo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbcignbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdlhgpag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mociol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbdkhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabmmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeffgkkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcbeqaia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bimach32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cifdjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amfhgj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bblcfo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpefaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmeak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acgfec32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alkeifga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blknpdho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdgolq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmahknh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pecpknke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pomncfge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdngpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmagch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpemkcck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cehlcikj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Debnjgcp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofbdncaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obidcdfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbmlmmjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpbpecen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cbjogmlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bedbhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpifeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abcppq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemlhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beoimjce.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Neiiibnn.dll"	Cifdjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mondkfmh.dll"	Cemeoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bejobk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cpnpqakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cibkohef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpnpqakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cekhihig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdnelpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qbngeadf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfppnk32.dll"	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acbmjcgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bmagch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beoimjce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beoimjce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mociol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogcho32.dll"	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdlhgpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bblcfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bemlhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahmla32.dll"	Aecialmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kipiefce.dll"	Apngjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kannaq32.dll"	Pokanf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggociklh.dll"	Abcppq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdgolq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bfoegm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmjhlklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iilpao32.dll"	Qmckbjdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpiidi32.dll"	Bejobk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clijablo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Obidcdfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aimhmkgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cboibm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmmeak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hblaceei.dll"	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qfgfpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aflpkpjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Clpgkcdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mddkbbfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pbddobla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddekmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjgnln32.dll"	Defheg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adljdi32.dll"	Afqifo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbebgj32.dll"	Bedbhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqfaoo32.dll"	Cmpcdfll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ciknefmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlemcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhmbdka.dll"	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Piceflpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amkabind.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpbpecen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmhkflnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfmahknh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4036	1164	c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe	90
PID 1164 wrote to memory of 4036	1164	c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe	90
PID 1164 wrote to memory of 4036	1164	c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe	90
PID 4036 wrote to memory of 3564	4036	Mlemcq32.exe	91
PID 4036 wrote to memory of 3564	4036	Mlemcq32.exe	91
PID 4036 wrote to memory of 3564	4036	Mlemcq32.exe	91
PID 3564 wrote to memory of 2412	3564	Mociol32.exe	92
PID 3564 wrote to memory of 2412	3564	Mociol32.exe	92
PID 3564 wrote to memory of 2412	3564	Mociol32.exe	92
PID 2412 wrote to memory of 1104	2412	Mhknhabf.exe	93
PID 2412 wrote to memory of 1104	2412	Mhknhabf.exe	93
PID 2412 wrote to memory of 1104	2412	Mhknhabf.exe	93
PID 1104 wrote to memory of 4904	1104	Mddkbbfg.exe	95
PID 1104 wrote to memory of 4904	1104	Mddkbbfg.exe	95
PID 1104 wrote to memory of 4904	1104	Mddkbbfg.exe	95
PID 4904 wrote to memory of 4444	4904	Mllccpfj.exe	96
PID 4904 wrote to memory of 4444	4904	Mllccpfj.exe	96
PID 4904 wrote to memory of 4444	4904	Mllccpfj.exe	96
PID 4444 wrote to memory of 1776	4444	Mahklf32.exe	97
PID 4444 wrote to memory of 1776	4444	Mahklf32.exe	97
PID 4444 wrote to memory of 1776	4444	Mahklf32.exe	97
PID 1776 wrote to memory of 4304	1776	Nhbciqln.exe	99
PID 1776 wrote to memory of 4304	1776	Nhbciqln.exe	99
PID 1776 wrote to memory of 4304	1776	Nhbciqln.exe	99
PID 4304 wrote to memory of 3696	4304	Nfknmd32.exe	101
PID 4304 wrote to memory of 3696	4304	Nfknmd32.exe	101
PID 4304 wrote to memory of 3696	4304	Nfknmd32.exe	101
PID 3696 wrote to memory of 4600	3696	Nocbfjmc.exe	102
PID 3696 wrote to memory of 4600	3696	Nocbfjmc.exe	102
PID 3696 wrote to memory of 4600	3696	Nocbfjmc.exe	102
PID 4600 wrote to memory of 2128	4600	Nbdkhe32.exe	103
PID 4600 wrote to memory of 2128	4600	Nbdkhe32.exe	103
PID 4600 wrote to memory of 2128	4600	Nbdkhe32.exe	103
PID 2128 wrote to memory of 1228	2128	Ofbdncaj.exe	104
PID 2128 wrote to memory of 1228	2128	Ofbdncaj.exe	104
PID 2128 wrote to memory of 1228	2128	Ofbdncaj.exe	104
PID 1228 wrote to memory of 2292	1228	Obidcdfo.exe	105
PID 1228 wrote to memory of 2292	1228	Obidcdfo.exe	105
PID 1228 wrote to memory of 2292	1228	Obidcdfo.exe	105
PID 2292 wrote to memory of 4688	2292	Odjmdocp.exe	106
PID 2292 wrote to memory of 4688	2292	Odjmdocp.exe	106
PID 2292 wrote to memory of 4688	2292	Odjmdocp.exe	106
PID 4688 wrote to memory of 2408	4688	Odljjo32.exe	107
PID 4688 wrote to memory of 2408	4688	Odljjo32.exe	107
PID 4688 wrote to memory of 2408	4688	Odljjo32.exe	107
PID 2408 wrote to memory of 2672	2408	Ocmjhfjl.exe	108
PID 2408 wrote to memory of 2672	2408	Ocmjhfjl.exe	108
PID 2408 wrote to memory of 2672	2408	Ocmjhfjl.exe	108
PID 2672 wrote to memory of 3176	2672	Oflfdbip.exe	109
PID 2672 wrote to memory of 3176	2672	Oflfdbip.exe	109
PID 2672 wrote to memory of 3176	2672	Oflfdbip.exe	109
PID 3176 wrote to memory of 2284	3176	Pdngpo32.exe	110
PID 3176 wrote to memory of 2284	3176	Pdngpo32.exe	110
PID 3176 wrote to memory of 2284	3176	Pdngpo32.exe	110
PID 2284 wrote to memory of 3732	2284	Pdqcenmg.exe	111
PID 2284 wrote to memory of 3732	2284	Pdqcenmg.exe	111
PID 2284 wrote to memory of 3732	2284	Pdqcenmg.exe	111
PID 3732 wrote to memory of 2140	3732	Pmhkflnj.exe	112
PID 3732 wrote to memory of 2140	3732	Pmhkflnj.exe	112
PID 3732 wrote to memory of 2140	3732	Pmhkflnj.exe	112
PID 2140 wrote to memory of 3332	2140	Pkklbh32.exe	113
PID 2140 wrote to memory of 3332	2140	Pkklbh32.exe	113
PID 2140 wrote to memory of 3332	2140	Pkklbh32.exe	113
PID 3332 wrote to memory of 408	3332	Pcbdcf32.exe	114

C:\Users\Admin\AppData\Local\Temp\c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe
"C:\Users\Admin\AppData\Local\Temp\c30e922854a3e783faa661531e28040cc23eaa2c8ce0e949786e1a5dff62d109.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\Mlemcq32.exe
  C:\Windows\system32\Mlemcq32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\Mociol32.exe
    C:\Windows\system32\Mociol32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\Mhknhabf.exe
      C:\Windows\system32\Mhknhabf.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1104
      - C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4560
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2964
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2584
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:676
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2872
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        33⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2432
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3060
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1692
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1420
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        40⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3268
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1644
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5208
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        59⤵
        Executes dropped EXE
        
        PID:5576
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5728
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        66⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        69⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        70⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6048
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        72⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4440
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3092
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5200
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        80⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        86⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        91⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Cdgolq32.exe
        
        C:\Windows\system32\Cdgolq32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        98⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        101⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Cboibm32.exe
        
        C:\Windows\system32\Cboibm32.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        104⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        105⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        109⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6624
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        118⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        119⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        122⤵
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        123⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 436
        124⤵
        Program crash
        
        PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7128 -ip 7128
1⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Mahklf32.exe

Filesize
664KB

MD5
8437c8e4b54665f80747d5ab475a1852

SHA1
bb98410785a2499cddded843bec6741958525a48

SHA256
f0c7bba10e64e153b8d962175f5e21505ceb6dbe56af3169bf96c526a9a4c61c

SHA512
b28616142b321ed3510637c7c3ba22fd35aa0ff6e951830ccc1947fe1fb4673e577ba85fd0ecdf3e5c163ad0b475cc2bd767e9710d1eb39ea743019e592feffd

Download Submit
C:\Windows\SysWOW64\Mddkbbfg.exe

Filesize
664KB

MD5
bf67b5bd24839410b590d79694774968

SHA1
4109cc28a2e5f4aa0cec1502fad35b73dac92524

SHA256
da01db4b2c07cff3cb759863d7959ea30fd177a7f0d607e32d6ec4432da16c31

SHA512
237cb73263cafb6cfa92d822cf5c81b883cf22025e27a04fc991c3642d30748b67516188113bb05971900c1ff2deba1d5effe5bf3fe1c32cdd4fcda8f769659c

Download Submit
C:\Windows\SysWOW64\Meghme32.dll

Filesize
7KB

MD5
858c679cd3e9015a3f0e98c0ce106e7d

SHA1
1b4c1d64e77f0b67a043c0224105ae5036eac8a9

SHA256
7ff4c92213acd1e1a742d5273378da6dea72323735ac9269bff9ba6641dd5b98

SHA512
9c7e0b177a854afc832ab9a279abbefdd63544192b1aafd756aa0288f76d47ad51eada9f8827731111dbe3ed14961871622826cbd26ded1b41181ef8dc123b89

Download Submit
C:\Windows\SysWOW64\Mhknhabf.exe

Filesize
664KB

MD5
aeccae758608a6e2b3cc943cafbe99f2

SHA1
a47fbaec38abf61a84c9d436c4574dc768619446

SHA256
b83b53ffb289b07cab82818d33ee4c9696122a095219bb21205fa3afb5a06a0a

SHA512
1c18ab39f2b0ccd83cd14158bd9621e0886ddc2e78179410c55d60a4e925fb3bc6d626c3ea90320fc9c699b9d4f17a2b15890b8617e27bc0fa2f2ad872eb48b3

Download Submit
C:\Windows\SysWOW64\Mlemcq32.exe

Filesize
664KB

MD5
b81587df655619374f072d5fde163596

SHA1
7af2b98c326b508a1616e1a2cbe34a2e196ffc24

SHA256
18c9c8be43d9b743c42503408f95bb5f072a7c9525f3eae7b53b1b9d8583029e

SHA512
cabd1f198fa729835a372d41da19ef61aa5ff7769221595805eaef8a7cb0a9c6812af0d5982fa542f83a3d064bb7a01287853e5ea96621d135df79d95879d6f2

Download Submit
C:\Windows\SysWOW64\Mllccpfj.exe

Filesize
664KB

MD5
8898f1ae058ec6f30b0356e1f47d86f9

SHA1
c553fd0e316fca0b1c24c445bee4049a3453401f

SHA256
9668584b0c985164c10daafdc393cce69cc66368128d9e8759283d3740723c1e

SHA512
4aa1c3e8c94a5d0e6651e596dcac71a366858d4f3175c02b8c2a9c6acf4aa6739740d31ee430e41ef99df5403c614321b8ab090bf4dc8f4527816576eec5193b

Download Submit
C:\Windows\SysWOW64\Mociol32.exe

Filesize
664KB

MD5
601b63e2aa9bac04a8118123dfe5f8b0

SHA1
26f5e4f132f72e950e0a7205bbade04bbb237d95

SHA256
d7d721c6ad2686f7e64955e3524ccbe76f7d6770793e519899ae1b9b6fa59b08

SHA512
90c26fc5e55d68721c0df5dd51e4b36cc83bec00ea0daba353fc3206e20cb7685c187c707e9e98d611f06be87342c8111f072f681e10603a19d3059862e9fee0

Download Submit
C:\Windows\SysWOW64\Nbdkhe32.exe

Filesize
664KB

MD5
31597e966aad70dcbb456ded69dad1f6

SHA1
f846ebe5a1ff5d4e0321fd6637d7da77966eb1cc

SHA256
c0a6d8f0b7028fc19929c715637bf684571c23569d11d49e18f43a0dd8df19d9

SHA512
fbaa06315fa30c6f3b981c03981897577fbe1df572c6f05994ad926b35b97ac133b8e0933ba7538bad28ff376973680e29119cffdda3998895af0760192b9cf4

Download Submit
C:\Windows\SysWOW64\Nfknmd32.exe

Filesize
664KB

MD5
924c54d3579bfc322f58c43a3d62bf1e

SHA1
b20673fa41ed2588340e26d2d56b76109aa5db9b

SHA256
442e5a0d976702594ad76061869172785c6431db8db7d7d2dfea22bb32cd8324

SHA512
33738b6fe2b86f453a687d24d5934c0931567eb1496a8afec48b16631b4866df7cca44f642e2499be9d1a1100fccadd1e0fd8a0d5cf5792ee45fc64baf637e41

Download Submit
C:\Windows\SysWOW64\Nhbciqln.exe

Filesize
664KB

MD5
df9eadd158011eb36b9ec46a279d036d

SHA1
a678bda6042386363bd7525f8bbf7744f260c082

SHA256
2c9d046f94e16dfbd99be12c3cb0a8ebb162eab3ca0ea6cffaa0deeeb8d575f2

SHA512
e7b8a54aea934c3f240846baf341db3f00dc7ca0863ba67989f1f21fc2d11cebb93124597c455ff034fed70ea4b563033ab1b3456567e8bb5138bd707812b7be

Download Submit
C:\Windows\SysWOW64\Nocbfjmc.exe

Filesize
664KB

MD5
7c78a2f622ee23e3fce830f0ffdae3c1

SHA1
ba024fb3770723acef0d84c809f4bcf890e2c37a

SHA256
bade8ae3a7994cc9f58e8a39064a24242acf9186c94632a6b50318ca7bbb942c

SHA512
ff9e5fa12b77d67721db6e547aabe90b3332d2100a68e15b03af5028617cd699a3e57b3c67f7673cccb359f61e2f4802e3be1afb8011b9a1a5f96110aa22a79a

Download Submit
C:\Windows\SysWOW64\Obidcdfo.exe

Filesize
664KB

MD5
05f2af869e30a598ec1748358bcf9369

SHA1
43dc1bf0454f8fe40483bed177502d6dc75275b6

SHA256
be41589293008881fba9475b79c71f9bdd06ed9ab6747b5ec0fa1848758051ab

SHA512
c75e6c0d51a948d03922bef5d049532a3311c280ddec2e678ddbe46bdccdbfb9f516a834a1a7a1fea1fd4c5e6c5b13cf4bbfe88c50515e73f07d6da0e0e22801

Download Submit
C:\Windows\SysWOW64\Ocmjhfjl.exe

Filesize
664KB

MD5
417a4953f389e11e26158f0087472347

SHA1
0b773dc8cb64e03a7dd9a3240499846e9f2e7198

SHA256
caeb72c28f2824bfab83d50d79e8a2dd509eeaf3f712a87b948a1ef0c7ffc498

SHA512
6840d87e2f47ed4fc43a8628890a94e03dacbf2440de6aed3752b5ade77100d8f017a0efec0f8786715b7aa6ab23f0bdb39f3fd3f2261388811131928cfc54ab

Download Submit
C:\Windows\SysWOW64\Odjmdocp.exe

Filesize
664KB

MD5
935c866f985e37b2620c2d71724d70b9

SHA1
b3fdaffee09bdb9491e4d929be598a8af59dc2b3

SHA256
c692bb36901de5fac8d7d2f7c50742b12fddcbe160058e4640895bba309241b4

SHA512
638c0a3502129fd26f75797bcbe165d626388c233a6015257cdec88c96e3477406b1cafbdc41fa7c1fe6cf052d8ddad711ae2684a3a014294ee09cabb121a6fa

Download Submit
C:\Windows\SysWOW64\Odljjo32.exe

Filesize
664KB

MD5
b18b609a35e7355d6c4e69a24efc91f0

SHA1
2ce6b2e7898246650febc0ad12d69136a9af1c10

SHA256
4535bb4bf33fafd76e96f1e6e7dcfa3c70d80b5d0c6c0a59da9bfef4cc7ffc41

SHA512
dba7d5c243e28d9d94870e53286ac1bdf809a1782ffb147b154baef0239d47ff3f4cdd4ae1c36e088fb0e703b19469b6e80a30e7ff19b4032b695995abbcc826

Download Submit
C:\Windows\SysWOW64\Ofbdncaj.exe

Filesize
664KB

MD5
2744d2a9c14dd60709f40c7e8dd7d2e5

SHA1
0bb2538839d593519d2df123a6add602119063c6

SHA256
552e7897d997eab96978dc67786b99c38388b40a77846ef38df6891f611bbe7f

SHA512
fc8e3801b9fece19056084f880e586892218345de0960e6b7d029896ec181fd47fc332fbf84a7696f6b92193cd4ffb574e726e492e90a3749ebacc70153e7bdd

Download Submit
C:\Windows\SysWOW64\Oflfdbip.exe

Filesize
664KB

MD5
78ab7857f2eb6b03783bf2a64d591bc5

SHA1
823914253e3b32c1176b8f7b5acc946f8748581c

SHA256
f38c5f608269beec356d036be2d72ed79fb4f8b46d00e2de04a2b4b2320ed7f9

SHA512
a48c8ea808977938c5ab7453145714eccbf251735e064aacc2cd698e6a4b40ad156c9c8ba5c314b64efd7845659eb92f0a9a8d7252ee2f1fd724eb9c57f9b1c3

Download Submit
C:\Windows\SysWOW64\Pbddobla.exe

Filesize
664KB

MD5
8a7ea6e330100251f4cc85057ce8c364

SHA1
e07f6390642df55e2eac5c061f322f82a01db134

SHA256
0cf42516ab23a6fa583e8fe09d179c85ca930de7dd9ac7de37671b62c97d440d

SHA512
a3eb19588b802a5a768a96b215773d00d49ad9abd2b742d8829e775de83309065054dbd37b814fc88b780e224e11c388d26b5d71d85cc5a29f9333082c871641

Download Submit
C:\Windows\SysWOW64\Pcbdcf32.exe

Filesize
664KB

MD5
ae884979aa3fc3542af745207b30a152

SHA1
5ce9069e859f79fa1e494604a5f0fd160d567440

SHA256
3ba5a05ee391c78f5d066c0baf4e8529e97d2aeb2b637c3d9a98d95e70d576f2

SHA512
7d9b7d0d044f98dbc26e57f9f631684b2ca03d114a5db02e4a7de7016becd43d6a4ae63c067999d8687b7733220207d199ab5cbd597c2e23069a355f59888df8

Download Submit
C:\Windows\SysWOW64\Pcdqhecd.exe

Filesize
664KB

MD5
c0bd2bc34dce90b2bbaffb94f9761c02

SHA1
e927729f0008807637dd04b442aca02b30cf0f9e

SHA256
e90a63d3d223288fd5f9dc70a1796550938becac08fd6f614b949baf35de15ea

SHA512
8cdd0e058366f5844305a678099ca9dab0bdc1475554ed5112870af691bc3f16646f1342fe22f0127e4557977252cd1c1e68f623805cc271b10f8cef1d4116d8

Download Submit
C:\Windows\SysWOW64\Pcfmneaa.exe

Filesize
664KB

MD5
000e01e31ea01888ba03afb1186c7014

SHA1
8a1641f0b31045f0614c290126d05334ddda07a4

SHA256
5603b50f09bc996caba3e3283f17d8eff33786aa21f3091be7c0cb1c182419ff

SHA512
a76f5e0a8ef96a1801b8e6032c2cd8c2559f6b694f0630bf6a9480375098dbc851adb5babc05cf038814e8b708d9657d19ee82a5ea97f33e14f2a9e0c317cf49

Download Submit
C:\Windows\SysWOW64\Pdngpo32.exe

Filesize
664KB

MD5
97bac95fdf6e31b52873d1b03653c842

SHA1
144bf16ea797d873f36d94d6ec90ca473a689e33

SHA256
f65dd25d40454e5f291a203d2aba132cc1b3b325f820aab749ff60d85fb70224

SHA512
106a9876a628a84c88c5694702bf2518454f694c352faa2179ebdddf0fc15c0cbcf3ae352a4123378844cc30cec45c3f5fb90ef26666da522dfcde808223090f

Download Submit
C:\Windows\SysWOW64\Pdqcenmg.exe

Filesize
664KB

MD5
f9a242fd4a2535580ed31a4981aef00c

SHA1
1f4e214d95141209d70f0789aed0c031cb897519

SHA256
d30e2d4303785050bcff7af9255b1f3f4648b1ada08f6795dd7e72a2d23434f1

SHA512
9aadeb073b3ac98e83dabfaabbf761c3a4665993a7bebda00fc874ed9b7fabd9fdd4d40c4c214fd05b215f957af8f23cfda0f7bdae41fdd5138c5b793230fa17

Download Submit
C:\Windows\SysWOW64\Pecpknke.exe

Filesize
664KB

MD5
1f9eabcc0da07ffc531f0f501b88ab52

SHA1
a6eeda3f9d1bae261d1318cc20088d4818779b09

SHA256
2d2a0db1a16ac5dc9a53a4a028099174a20bd2af8a30ab0ada978b3106875681

SHA512
098db4ccd1aecafd54480306b4a0308d8d4d18d7c4937e66a1728e9c8e80f1d2dd3166e7c571b9dc53c2ef01db220244c157d108ebfdf0e2ddc65e34be9ed651

Download Submit
C:\Windows\SysWOW64\Peempn32.exe

Filesize
664KB

MD5
3dc4416f5d3330090837cd4e8306d483

SHA1
06e64e7402775e7482c3c767d360d9f00c7c84f2

SHA256
70ea2bb89cfb74d680b8118a10796c97724078c6af10feac8d65773f4d377eaa

SHA512
8bf951a7dba270c898e59c9a30d00c3844665daf11caf3529406d2dc5e2a304200d75295959b962fef00c630f9d52c6bb37db2f59b0a53d473f4d425c97d1b0e

Download Submit
C:\Windows\SysWOW64\Pfbmdabh.exe

Filesize
664KB

MD5
3e3973865b41feff842b1a7445e4bbc1

SHA1
77be3e86ef4ee00a27e9fc1c7f40cd26e66fc38c

SHA256
2cc6f537f1dbb88187a1a2dabeda5e1dfca71fc77fc49452f01809f9ce595481

SHA512
a2b01d753cd6afd6436797d1a5a6c7f7f6d4d0391089d2e535e313c862d4a9850d45f77a46f07435c02b23bee3e45630982cd26eed0bdb9335c5da9f8b42ff4c

Download Submit
C:\Windows\SysWOW64\Pfeijqqe.exe

Filesize
664KB

MD5
211dc2cfc6eff054d3da24c653056807

SHA1
a6bc38ac74e4231e1d3939c07a7a1eb57660b7ed

SHA256
c50fac08a0a048ddac2e4eee705448aa1f5346e89516cd71afaaf2718b09777e

SHA512
1fd71b8038fc72b8a0a87a45fdbdbc79456f3420238454d0620117f6852b23e38325d290f18198470a4c442c4f63f715c257f21829472d423ec81459180c5da8

Download Submit
C:\Windows\SysWOW64\Pkklbh32.exe

Filesize
664KB

MD5
a7818f3ffe8ba9ac3ddfdcc6c1e023ea

SHA1
23a498f7dcc0e8e4070375f434761f55a33d3601

SHA256
92cfc23b8573a30c2d29202fb7addbde7745409cf823ec14071b7db3923b0094

SHA512
8249a400149f31202dd52cb18d4eb470ae95572496f3c4634ad6d4f003eba95597e53a6906bc5279f6b6c8de59b3fb3cdb3fccdefbf68b977a5456d107e9a54d

Download Submit
C:\Windows\SysWOW64\Pmhkflnj.exe

Filesize
664KB

MD5
726c5f8f268bce61c3bf0edf3c067f73

SHA1
c293633c3fa8f6197063137780ef069e19fe537d

SHA256
892eedc73e260d567320d892f2cfc51ada46db8825992bbb422b89cdbc3a21d9

SHA512
35d18bc14fe1af9c7d3e3c129335320ee65347f9db0c791253fb6fa6778817f4ce20cbd9bad23df5ced4fcbcb36c729b6a0dc889e8e07c3ade9eb9a58068e64e

Download Submit
C:\Windows\SysWOW64\Pmjhlklg.exe

Filesize
664KB

MD5
9b206dc00c63cdddcf91a249ffbf4e2d

SHA1
b1997fe3fc92a5724d4d2598e5c1386dd26f9e60

SHA256
f25f5c76b7e3c416ed66feddae3cf78be14ec593ab0991c892f990d5fbce34f2

SHA512
187ea739813bdb5d24256ba8ca49c0c4cff7061d08e7dcdd6eb5603535f016af8ea601abcc07f29c13c5c365d73f5a78499afcdf8be6a834c8fe5ec49ddef3b3

Download Submit
C:\Windows\SysWOW64\Pmmeak32.exe

Filesize
664KB

MD5
07a57c35dc5e60e6ca81b7f4edb74862

SHA1
41faa605c3db07496a453611f88d21a5a495914a

SHA256
23acfc077d561797d1462883693d7adcc390a589769be8b3fb5927aad8ac686e

SHA512
8224a9ca83985f24bca77e38be7f6642fd95d678e1bbc8dd3ee4d64b7b3511a59fd8f480f58101dad65a7b427a62a7a9a5aef041195501dbbe0561327f272a2c

Download Submit
C:\Windows\SysWOW64\Poidhg32.exe

Filesize
664KB

MD5
5e9b1a0a1d323e6b6b97dbb340b4a4d0

SHA1
e89b33ad4f694613a08e795bed1f6e16fe544e7e

SHA256
51e5475ca30cef6210dcfe6c3011128d7b612aa9805de1bb5de4c7caac79836d

SHA512
6c69f3a48ee76f35a1c4295c0bc84e43849851edbc1ea13e5851e2d79b3feb825334e6c1a67e7987503ba497e3083168906b5ae440e1816fb1538bd90d48753f

Download Submit
C:\Windows\SysWOW64\Pokanf32.exe

Filesize
664KB

MD5
454a0b842b0ce10ebc649e628ac7e133

SHA1
4ccf8071fc87563a10f0c1ea0979ebb9beea5f63

SHA256
500dc100fa1e322b3777b10afa3d092c81e2c21dc638261d606a8c1e32a3f50c

SHA512
4753abf68e1c561be291755442cb6d1d7ff051b721f0e0af15422dc60725347c1cd2783b36c2408cbe2652feed29ba7859649febb0adab9689a5a89f169b31e7

Download Submit
memory/408-180-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/676-229-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1012-525-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1048-297-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1092-338-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1104-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1104-577-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1164-548-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1164-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1228-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1268-327-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1420-285-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1592-188-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1644-321-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1692-278-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1776-596-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1776-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2128-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2140-164-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2284-148-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2292-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2316-261-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2408-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2412-570-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2412-24-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2432-267-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2584-220-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2672-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2836-303-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2872-244-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2964-212-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3060-272-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3092-531-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3176-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3180-236-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3204-290-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3216-519-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3268-314-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3332-172-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3564-563-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3564-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3696-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3732-156-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4036-556-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4036-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4128-506-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4304-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4304-603-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4384-253-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4440-512-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4444-52-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4484-309-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4560-196-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4600-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4688-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4780-333-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4888-344-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4892-204-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4904-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5136-350-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5172-357-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5200-541-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5208-362-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5252-368-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5272-543-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5296-374-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5336-381-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5352-549-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5368-387-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5408-392-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5440-557-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5456-398-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5496-404-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5504-564-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5536-410-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5564-571-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5576-416-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5616-422-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5644-578-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5656-429-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5688-435-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5724-589-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5728-441-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5768-446-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5792-590-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5816-453-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5848-459-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5856-597-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5888-465-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5924-604-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5928-471-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5968-477-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/6008-483-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/6048-489-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/6088-495-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/6128-501-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads