19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2

Analysis

max time kernel
96s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe
Size

64KB
MD5

9fb86056a50a5b83aad47b410e582768
SHA1

03261b3c5489122b36af08ccf34285a6dd778ad3
SHA256

19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2
SHA512

8a40fe5ab80b6531b0bfa4f3d5f5374c399220c1b38c0226b052e53d0a659f27803e0a62735a9543a20655ec0374c732ed08d775e84279a74f8c0850aa8a82a4
SSDEEP

768:5NuPMMtVWSz6w42njeBRl4UfKuwlNIPZOoQPVvI9Kw4JsHuq/1H5BAeOEFEkzWpF:5APDWB9LZOxPVvI9QokeO6XKhbMbt2

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edbklofb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbklofb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hijooifk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcckif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchhggno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfankifm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikpaldog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkhbdg32.exe

Executes dropped EXE 64 IoCs

pid	Process
4708	Edbklofb.exe
5072	Fkmchi32.exe
1884	Fcckif32.exe
3904	Fhqcam32.exe
864	Fojlngce.exe
4136	Faihkbci.exe
3700	Fdgdgnbm.exe
2672	Fomhdg32.exe
716	Ffgqqaip.exe
3956	Fhemmlhc.exe
4828	Fooeif32.exe
3724	Fbnafb32.exe
3336	Flceckoj.exe
4020	Fcmnpe32.exe
3356	Fdnjgmle.exe
3180	Gkhbdg32.exe
3160	Gcojed32.exe
3340	Gdqgmmjb.exe
2736	Gkkojgao.exe
3224	Gcagkdba.exe
4736	Gdcdbl32.exe
3688	Gkmlofol.exe
4516	Gbgdlq32.exe
1244	Ghaliknf.exe
3532	Gkoiefmj.exe
3020	Gbiaapdf.exe
1972	Gdhmnlcj.exe
1348	Gomakdcp.exe
4464	Gblngpbd.exe
1404	Gfgjgo32.exe
4320	Hiefcj32.exe
3916	Hkdbpe32.exe
4436	Hfifmnij.exe
4724	Hihbijhn.exe
2036	Hmcojh32.exe
4912	Hobkfd32.exe
3308	Hbpgbo32.exe
2900	Hijooifk.exe
1568	Hkikkeeo.exe
1836	Hcpclbfa.exe
4868	Hfnphn32.exe
4180	Himldi32.exe
2880	Hkkhqd32.exe
3544	Hcbpab32.exe
4324	Hfqlnm32.exe
1212	Hioiji32.exe
4392	Hoiafcic.exe
4060	Hbgmcnhf.exe
3272	Hfcicmqp.exe
4340	Iiaephpc.exe
1712	Ikpaldog.exe
2392	Ibjjhn32.exe
1764	Iehfdi32.exe
620	Imoneg32.exe
4496	Icifbang.exe
4700	Ifgbnlmj.exe
1324	Iifokh32.exe
744	Ippggbck.exe
3144	Ibnccmbo.exe
2732	Iihkpg32.exe
1904	Ilghlc32.exe
3996	Iikhfg32.exe
2080	Ipdqba32.exe
4428	Ibcmom32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hijooifk.exe	Hbpgbo32.exe
File opened for modification	C:\Windows\SysWOW64\Himldi32.exe	Hfnphn32.exe
File created	C:\Windows\SysWOW64\Ippggbck.exe	Iifokh32.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Hmcojh32.exe	Hihbijhn.exe
File opened for modification	C:\Windows\SysWOW64\Kpeiioac.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Odocigqg.exe
File created	C:\Windows\SysWOW64\Inlekh32.dll	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe
File created	C:\Windows\SysWOW64\Hfqlnm32.exe	Hcbpab32.exe
File created	C:\Windows\SysWOW64\Iiaephpc.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Njohbh32.dll	Ibjjhn32.exe
File created	C:\Windows\SysWOW64\Ibaabn32.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Gbgdlq32.exe	Gkmlofol.exe
File created	C:\Windows\SysWOW64\Jeaikh32.exe	Ibcmom32.exe
File created	C:\Windows\SysWOW64\Klljnp32.exe	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe
File opened for modification	C:\Windows\SysWOW64\Mdhdajea.exe	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Ohfjnoma.dll	Ippggbck.exe
File opened for modification	C:\Windows\SysWOW64\Ldjhpl32.exe	Llcpoo32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Aepefb32.exe
File opened for modification	C:\Windows\SysWOW64\Nlaegk32.exe	Njciko32.exe
File opened for modification	C:\Windows\SysWOW64\Fhemmlhc.exe	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Gkmlofol.exe	Gdcdbl32.exe
File created	C:\Windows\SysWOW64\Hfnphn32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Ejnjpohk.dll	Klljnp32.exe
File created	C:\Windows\SysWOW64\Lbdolh32.exe	Lpebpm32.exe
File opened for modification	C:\Windows\SysWOW64\Lbdolh32.exe	Lpebpm32.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Kfankifm.exe	Kdcbom32.exe
File created	C:\Windows\SysWOW64\Oolpjdob.dll	Lfkaag32.exe
File created	C:\Windows\SysWOW64\Ncfdie32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Oneklm32.exe
File created	C:\Windows\SysWOW64\Hmcojh32.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Gaiann32.dll	Meiaib32.exe
File created	C:\Windows\SysWOW64\Pjeoglgc.exe	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Pjjhbl32.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Qffbbldm.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Ampkof32.exe	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Fhqcam32.exe	Fcckif32.exe
File created	C:\Windows\SysWOW64\Melnob32.exe	Mpoefk32.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nngokoej.exe
File created	C:\Windows\SysWOW64\Anogiicl.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Hpoddikd.dll	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Jmhale32.exe	Jeaikh32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Naqcfnjk.dll	Faihkbci.exe
File created	C:\Windows\SysWOW64\Dlkhie32.dll	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Ocljjj32.dll	Nloiakho.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pgioqq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7944	7852	WerFault.exe	315

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gfgjgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcoakfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fomhdg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmknaell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjcdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpoefk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olmeci32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fojlngce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcbpab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fooeif32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfankifm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghaliknf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Melnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkmlofol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgldhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbceejpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfifmnij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jefbfgig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpeiioac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lphoelqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbgdlq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbeidl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldjhpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leihbeib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbfkbhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kimnbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkikkeeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilghlc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhqcam32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llcpoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdqba32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fdnjgmle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kepelfam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gblngpbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibjjhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdgdgnbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikhen32.dll"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohkhqj32.dll"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgepdkpo.dll"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ippggbck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhaoapj.dll"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngknngal.dll"	Gkhbdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncmlocln.dll"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdoemjgn.dll"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhmkaf32.dll"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkkojgao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeohm32.dll"	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ikpaldog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfenmm32.dll"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibbmq32.dll"	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkkhqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlqgg32.dll"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfcej32.dll"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmdhh32.dll"	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naqcfnjk.dll"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbkdpj32.dll"	Gkmlofol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkkdmeko.dll"	Fdgdgnbm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibnccmbo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 4708	808	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe	83
PID 808 wrote to memory of 4708	808	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe	83
PID 808 wrote to memory of 4708	808	19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe	83
PID 4708 wrote to memory of 5072	4708	Edbklofb.exe	84
PID 4708 wrote to memory of 5072	4708	Edbklofb.exe	84
PID 4708 wrote to memory of 5072	4708	Edbklofb.exe	84
PID 5072 wrote to memory of 1884	5072	Fkmchi32.exe	85
PID 5072 wrote to memory of 1884	5072	Fkmchi32.exe	85
PID 5072 wrote to memory of 1884	5072	Fkmchi32.exe	85
PID 1884 wrote to memory of 3904	1884	Fcckif32.exe	86
PID 1884 wrote to memory of 3904	1884	Fcckif32.exe	86
PID 1884 wrote to memory of 3904	1884	Fcckif32.exe	86
PID 3904 wrote to memory of 864	3904	Fhqcam32.exe	87
PID 3904 wrote to memory of 864	3904	Fhqcam32.exe	87
PID 3904 wrote to memory of 864	3904	Fhqcam32.exe	87
PID 864 wrote to memory of 4136	864	Fojlngce.exe	88
PID 864 wrote to memory of 4136	864	Fojlngce.exe	88
PID 864 wrote to memory of 4136	864	Fojlngce.exe	88
PID 4136 wrote to memory of 3700	4136	Faihkbci.exe	89
PID 4136 wrote to memory of 3700	4136	Faihkbci.exe	89
PID 4136 wrote to memory of 3700	4136	Faihkbci.exe	89
PID 3700 wrote to memory of 2672	3700	Fdgdgnbm.exe	90
PID 3700 wrote to memory of 2672	3700	Fdgdgnbm.exe	90
PID 3700 wrote to memory of 2672	3700	Fdgdgnbm.exe	90
PID 2672 wrote to memory of 716	2672	Fomhdg32.exe	92
PID 2672 wrote to memory of 716	2672	Fomhdg32.exe	92
PID 2672 wrote to memory of 716	2672	Fomhdg32.exe	92
PID 716 wrote to memory of 3956	716	Ffgqqaip.exe	93
PID 716 wrote to memory of 3956	716	Ffgqqaip.exe	93
PID 716 wrote to memory of 3956	716	Ffgqqaip.exe	93
PID 3956 wrote to memory of 4828	3956	Fhemmlhc.exe	94
PID 3956 wrote to memory of 4828	3956	Fhemmlhc.exe	94
PID 3956 wrote to memory of 4828	3956	Fhemmlhc.exe	94
PID 4828 wrote to memory of 3724	4828	Fooeif32.exe	95
PID 4828 wrote to memory of 3724	4828	Fooeif32.exe	95
PID 4828 wrote to memory of 3724	4828	Fooeif32.exe	95
PID 3724 wrote to memory of 3336	3724	Fbnafb32.exe	96
PID 3724 wrote to memory of 3336	3724	Fbnafb32.exe	96
PID 3724 wrote to memory of 3336	3724	Fbnafb32.exe	96
PID 3336 wrote to memory of 4020	3336	Flceckoj.exe	97
PID 3336 wrote to memory of 4020	3336	Flceckoj.exe	97
PID 3336 wrote to memory of 4020	3336	Flceckoj.exe	97
PID 4020 wrote to memory of 3356	4020	Fcmnpe32.exe	99
PID 4020 wrote to memory of 3356	4020	Fcmnpe32.exe	99
PID 4020 wrote to memory of 3356	4020	Fcmnpe32.exe	99
PID 3356 wrote to memory of 3180	3356	Fdnjgmle.exe	100
PID 3356 wrote to memory of 3180	3356	Fdnjgmle.exe	100
PID 3356 wrote to memory of 3180	3356	Fdnjgmle.exe	100
PID 3180 wrote to memory of 3160	3180	Gkhbdg32.exe	101
PID 3180 wrote to memory of 3160	3180	Gkhbdg32.exe	101
PID 3180 wrote to memory of 3160	3180	Gkhbdg32.exe	101
PID 3160 wrote to memory of 3340	3160	Gcojed32.exe	103
PID 3160 wrote to memory of 3340	3160	Gcojed32.exe	103
PID 3160 wrote to memory of 3340	3160	Gcojed32.exe	103
PID 3340 wrote to memory of 2736	3340	Gdqgmmjb.exe	104
PID 3340 wrote to memory of 2736	3340	Gdqgmmjb.exe	104
PID 3340 wrote to memory of 2736	3340	Gdqgmmjb.exe	104
PID 2736 wrote to memory of 3224	2736	Gkkojgao.exe	105
PID 2736 wrote to memory of 3224	2736	Gkkojgao.exe	105
PID 2736 wrote to memory of 3224	2736	Gkkojgao.exe	105
PID 3224 wrote to memory of 4736	3224	Gcagkdba.exe	106
PID 3224 wrote to memory of 4736	3224	Gcagkdba.exe	106
PID 3224 wrote to memory of 4736	3224	Gcagkdba.exe	106
PID 4736 wrote to memory of 3688	4736	Gdcdbl32.exe	107

C:\Users\Admin\AppData\Local\Temp\19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe
"C:\Users\Admin\AppData\Local\Temp\19254d5105b8f81c626f75fdbdb13afb865c3e7671e0486fbce033292f38eed2.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\Edbklofb.exe
  C:\Windows\system32\Edbklofb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\Fkmchi32.exe
    C:\Windows\system32\Fkmchi32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\SysWOW64\Fcckif32.exe
      C:\Windows\system32\Fcckif32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1884
    - - C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1244
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        28⤵
        Executes dropped EXE
        
        PID:1972
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        29⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        33⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        36⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        37⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3308
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4180
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2880
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1212
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        48⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4060
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3272
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        51⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        54⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        55⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        57⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1324
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:744
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3144
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        63⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        67⤵
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        68⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        70⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        72⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        74⤵
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        75⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:320
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        77⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        78⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        79⤵
        
        PID:460
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:964
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2264
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        82⤵
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        83⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        85⤵
        Drops file in System32 directory
        
        PID:4168
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3836
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3372
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        92⤵
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        94⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        97⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5444
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        102⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        103⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        104⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        105⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        106⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5748
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        110⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        111⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        113⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        114⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        116⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        117⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        121⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        122⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        125⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        127⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        129⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        130⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        134⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        138⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        144⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        148⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6260
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        150⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        151⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        152⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        153⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        154⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        158⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        159⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6832
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        163⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        164⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        165⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        166⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        169⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        172⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        173⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        174⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        175⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        178⤵
        Drops file in System32 directory
        
        PID:6712
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        179⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        180⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        181⤵
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        183⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        184⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        186⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6700
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6956
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        193⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        194⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        196⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        197⤵
        System Location Discovery: System Language Discovery
        
        PID:4216
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        198⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        199⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        204⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        205⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        206⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        207⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        208⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        209⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        211⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        212⤵
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        213⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        214⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        216⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        217⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        219⤵
        Modifies registry class
        
        PID:7544
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        222⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        223⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        224⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        225⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        226⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 212
        227⤵
        Program crash
        
        PID:7944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 7852 -ip 7852
1⤵
PID:7920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afmhck32.exe

Filesize
64KB

MD5
c8689dc853e8b1f619226e794effea19

SHA1
b23d9528d0fc8f7730b3067be27781f9484b1764

SHA256
75660b6ab5baa6d890245b71446cbd3ed617b8ab5034e29aa998b90dc82fde76

SHA512
3dca037ad73ad1bf0a540925801d1d5dd6da8ce5931b59ee4ddee5844dfc418d2866dbb4d379ca49d0c1e075942f321cb6d448317f47d9a41f12d9441bba91d0

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
64KB

MD5
9b015f6955e0f55fe5faed124ed8c268

SHA1
fae3d6b89f738adc10cac87c79aaff76d3474575

SHA256
3b2a2edb04d0555ae06b867c23d7bd28e545d4b7fb21946694f3d7c766608bfc

SHA512
04411a63048bf02871a747899e70d51f7bc775ce6eedadd9ddd2cc2da8dd6316b481751752d7bcbaff6a8af02ab7e6275ded4c3810544a1a2e012a7271625012

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
64KB

MD5
ef7a9fe0780fcd222b5431e9552f7474

SHA1
f6c5a153172f3d9c66a0363f2d7e62e020bcc753

SHA256
699552d6a2b6c37de9cdefbd87ef46686611ac395cf4ac3a20f4fa719904f126

SHA512
f7715587a4a7a4cc3ca1f0ad3b0cafe2d987402047b050df24c515dac324a77c5495dfc16d61f319b7f23381bc610cce0ab171e14be65460a79c9b276a9ec4b7

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
64KB

MD5
c92193b0885cedc8951d96b8c8ac55a7

SHA1
16728f2e8d5ec7722a502d3f57c8ad3184d70a4e

SHA256
c7d641fae2790cc3a9e1cc15ae7753217d8db3a3e1aac281de55f5b82efd620d

SHA512
011452e5a3c44ce6020146c423dc8f444b392359ede892ceca0790fef6a53717efdbe96043140dc3fef019425071997d94e4526cd9be8f0a440aa6b7d6f971de

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
64KB

MD5
414cbcca3cb09bf8f77852476043dc09

SHA1
f5214fa16738dd666134ee5346f89c14bdc55265

SHA256
89d8afd0af5c760e38f21b87f5fafc129f6eec4997a10566f47e20dd03198a96

SHA512
d842b48c8a88d93e7ce9867497e9456a4ab9212fa97c725010a98dcdceef43fced42d27d9a8ddb7f59292392866517f3aab90dad49aa43853a63998611d976a7

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
64KB

MD5
7630f3d415e2aa19b1df76814c63fa14

SHA1
ee2d8030ceddf194001c9f465616169901e44848

SHA256
f4f016575e08eebc0c8511cb3873b565ad236e2aa2c09656286d322f5dd534f1

SHA512
a51f4b15dfb14db824db27a5324c82ae56a2fc30e86204085504056d7190e46047b806e98e8dd0acb30380a4e4dbce685aa0ad5dd1c277955af957703cbf3ba5

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
64KB

MD5
7efeb1a7214789548d8a8aeb3d12fd3d

SHA1
77557580624d5a522b192a4373f3da8162027913

SHA256
18f7b6ecfa0bca7932e6e6902db129de54a678bd119f8eee51da50817eb7a83b

SHA512
023ba354ec118f276c357efc64043c2752477fb96af97cbf9b8812c13e165901ccd3f045552aced76ef31aaf2e3c5c488de7b42744bcb7d78ed76a5286bb49c6

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
64KB

MD5
e23122415bdf7e4b09c9f28f2ccfd623

SHA1
20a5f8c4122cda9644061227ce9d60aab26a5121

SHA256
19c986ebdde007204c8d69e7f95d9b9d41feac860ae52a5ba67b4c49a58944aa

SHA512
2701be743665662df7f1748dc2ad36f6783ae633e39e2ec06d42edef97ce497a109c14fb5755747293fce37f38bfc3bbc534fac3dad95256a12211daa8d695bd

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
64KB

MD5
7cf157f6bc7f88c69aa1f5ab31c3c57d

SHA1
34304bf3c6457d99e77c6026f31a6b9e1666e99b

SHA256
92d0f6fa194b3715bccc23cb0582a9598e9c403cbe22993f1ef330f99665b3cf

SHA512
9e9b1181216fa8caf43fdde49b7d898f1c31ba4a734867048f334f7692f002dec9175cecfd723717a9fa97de65a4e89af5e3228ee1ac182e2196ea24e3584993

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
64KB

MD5
4651ff5d4143a0abf628804bb7e10c62

SHA1
8e63b817ae32dde888d73a16f5fcdca82e6a1ae2

SHA256
451ac77646d7dc3f7ae13b02d6d463b8d04a2d68bc96a3f80871cb61c0d49b6d

SHA512
df409bd3cc5dc7ffcdaa33d740565f392343905299c313c5590e69c626f53005910978c5e413af6e792033191532422b635cae2e88f5794ef86753e8332383ef

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
64KB

MD5
6de12f915db53d913c2553a4bc4fec3c

SHA1
a85c205cdca8aabcb7624f438dc7ee2124e37798

SHA256
bfeead7cf776186fcd39a80de468d363b14bdcc6bd82be0d1d544c8de0346a37

SHA512
e7802d3a64177ef1da3b0cd0ab082458567c35cdf5274358294eadf32b5e78b4ce367ed06b51d871ea19c75471240d55773daaf04537dcc774ad9b0234b492a8

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
64KB

MD5
409907ccca45976e45d750d3f67b7afb

SHA1
a3bc5aa81f774c458786b5e82b4ad002c8fea72a

SHA256
0839b6375b6b464c2821cd962725f835e57c33e9f6ddc8d2a6570c23a4c5a2ec

SHA512
fa099c9f834952c5b3f2f5a05392408f4bfc2ea03ab3425f952f7d4f2d31cedf213ad8de6bcf97902e8d28177158ce1e85ad60e8a0331172915c0d2ba09f9421

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
64KB

MD5
cc99f4e62a53a3beb8fb7c0491f5ab1b

SHA1
04d6bfb08d9a2cd48a865a30d318b8659a392e41

SHA256
9032f29da5a358378f05f1907ced1f7c3c6272f5fbee2b765c59884aa4028ab3

SHA512
b1a0fe3228d2e5cd9580bc5c29ef037e32257e8c22377ebbb53dea261021ee84b4c3b16a81152632c98aa015066ae2b591330362c7445f2051c8d094eeadcd1e

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
64KB

MD5
16302528e8bf675d43fae82ceebbc49d

SHA1
4b35cbcfcdca92eb4ec0e23ce7f6362cb518a931

SHA256
89f0bc84a58eff54ebfbdf8965a42e1188999d75f6d89c5e0b73da46ba5279fd

SHA512
aa948591cd2f5add401384a94627fe06347ed24761ac2f70f9b816456ff7495a207b1b560d1b352329366da281b3e2a389686f4a49cd9ee603cb7fb32a87fc23

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
64KB

MD5
bc90544a40343909ec860a2bd38da8ec

SHA1
ffa96874fdcf2dcabed25dc90164a108e65bd8e4

SHA256
0887f3b4ab0ac437dac5aff6eae34617f64f1115b3acc9e2ea16de540a023c08

SHA512
9ff49a015d6f4a0097c74bb897ff06d7aefd5b7526a4e2b6408816458b5da42089bb6946d6d12b0567533727feb13396c9edebc4428411c896b9a9e94425e8cb

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
64KB

MD5
32ed9425c1209155ff836631580044a9

SHA1
2ec17971a99ca7dc3a0d2467dd63a175ba96383e

SHA256
3b5d9ec28bc1586b23cab84d0f21e1e4c3e67fab70c2084baf7860add9702738

SHA512
dc8c0aa5d3238a0c7b716b089f8fac46a324da2e4526c9e0b8b570e4981091c2731b853881e3e828b50822a274907fd460043141c7409426977c39ea5e399435

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
64KB

MD5
03bc1e995f853e8ef87d59ce83fccd30

SHA1
35735a2086a2b5c55b206610dcccc96c724b8c5f

SHA256
041f112ef6a7f3cf2d9e5278fc867f31572963b47567f926eef8924a17ef54d1

SHA512
06d67f38e21513ad78c7774147dff970773de6783de7316e127618e38ed1c872a1278b83c714af2478fe83518a559491670dcd3579fbb2785ae9611de6a04120

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
64KB

MD5
6169a506a12378bf73516fa02ad96657

SHA1
5d1acad9871096296c0d7f4ebeffa31b5303c3e4

SHA256
2eb6741988654abe6ffa0777f430bec8f09bbb40bf641802d7ff72865b63f16b

SHA512
6fd7a5d3d9aad6e94a609ef389e9719e0321872338fbf393d601b157243b8742725c3fc00b379a96c1126d5619df68816f162b0f440f1c7260a6a98ba613eec7

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
64KB

MD5
baee00cf89414de317e0f5544c981841

SHA1
2f3c6f922fa2c896aaf46435c3aa2d9b5332e5da

SHA256
6b4bba3804f6db82342277b5dfb54658583ed1e1da8970013a38e7484264bf51

SHA512
4cfb716719eac6db3c4fe8d827dcf0ed50a0b1bfb1e902565ca76fc14f79cb218cc7c1ea2282689435c1745748b296d9146f1e53874b4dba6c341d03a754e336

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
64KB

MD5
fa3f6dec8714143a504dd67f64a89ba2

SHA1
22890dbd4360189235d292f5d6d2d93a82333d5d

SHA256
0018b144c2321b849c9c746d7b3f9eaf5d57c0752e5aea12525daad705f5bfca

SHA512
d2555c72c05c50f34961345862e709119201286209578c1a1477ef13c2fc2551eeb94d890ced3b702d81f3ef7e0beb4de01c0e7939d308ad8adcb3759e1e18b4

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
64KB

MD5
5ded05dc471b776b225c4d3d7af8a898

SHA1
9d732611a4699a0530b84f7708b1ae828f5f32a7

SHA256
b9ce9f3bc38da625c88d5bfe4464364ab4846f66198494bddf828362fcfab475

SHA512
4206e98c5822f3c998aafad0e0efcf6b56b458ef8d1c3742db7b5de539dee1ea0a0b92f8de50d442f8b766dbf5aa056e05cae42dfd6ab3a94c983595eb0c7f68

Download Submit
C:\Windows\SysWOW64\Fhemmlhc.exe

Filesize
64KB

MD5
ad2f6d4b8caa21a916855f32c454385e

SHA1
a599452143e236f0c4d9234f380153dbedd5cb32

SHA256
2ffb69072b9cfc9621ebc6e4b7db0ae304b3ab6a88844755594939c5086e3489

SHA512
9d0561eea4711e04cb7b41a5dedf38f8887810a138d37ae43723f1ccb320058f816a7ae49d25b16294f2b2e3fe12c493d279d7ee902b838dd363c9dc163440a6

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
64KB

MD5
c09b5ffde23bc230d811cf0da1fb0bf4

SHA1
2b29ea48d898d0cff0e61001506dcb27d28b0b34

SHA256
341a37c73b58d8485fc60a1ba03e0227075f1ed71fa28d103a6dbb8a9a9875a6

SHA512
8e073be849e070cd26db8d42fbf97c7bc8b507c34a8b024d2dc0d58aa6ebd2c8d4bb7cd59db001d863ba292d6e2a33f111da7daa9fd5e040259c44e6d15ef375

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
64KB

MD5
84bb5a3613a99ad92ac4a7db0bfcb163

SHA1
ba2e2e079b7e0ce1fabbb7ec1261037ae65304a2

SHA256
f4e1c1589195e35881cc42cfa566411fdd23e3ec35e5220d66d803d46a82021c

SHA512
559ee17c9a25492f4eb194adb9f0f65404667eb32f52b2d136a1d3f3f08f0b428f407601e30c1f8f110b5c231fb56d28afd9034d785e881d4d7c9aee7f0c5555

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
64KB

MD5
928e89fe2d0570d97f861bf787637f9e

SHA1
9502c85f021b514af6d326bd560468b6e7a68877

SHA256
27fdd30520fedb4895275742f2443778ac93077d093adc6ec4b8d1c0fdcc5d3a

SHA512
64d663cceeb28bccf6fd871dbe670cfdd91af75027476cd58a5787c987df9e2ffefce61edf828f0c4e958d91bf420cca21cae58fca135a67e02752b7a2498b01

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
64KB

MD5
29f5dee39246690b28036d8ae1998122

SHA1
3849e488370ca911ffe3113715651ee8975b01bf

SHA256
b012defa744f998ba12b522fc00a87071eb72ed9dd9348575b4f5ff6bf2470f3

SHA512
7d0e90165a824544f3d715b8e93d95427383e87ea28ea577f012b83c2f1d220e96f106cf78e1ad30ebd8affce1fcd838e32a9b2d7cb9acd633b2742992bb3318

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
64KB

MD5
aacd6a88cdcecbf171526a99fd736e5d

SHA1
1db455b8a817f49c6be8ab40fdbfd5274887ff32

SHA256
232b57220bffa4dddfe77b0d59d111ceb0a7eaa173e3764b3669feb8368b8bda

SHA512
e523810db7a5253789d17e0480a6f4fbe3c73bca386830044d795eb71fcf979f1ccb028c6ec1dff1bff3deafdd0283e878c005cf410ce76e7871e5db8a9b6657

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
64KB

MD5
f398d12e8c883803e1e31d05a90911ce

SHA1
bebbc4003b0de04dc0c5952e9b79a9cab66ffe17

SHA256
df1f50c145051e8dbdbf5c1f6c38139b63aa7e31d4d05b9151738d8597f2a3ba

SHA512
32741548ca47628f02c34ac8a9be5f29efc0ddc7843cefaa8b786afc4837eb649181c14326b830e6a52bbaecbd73fa7a60eb31b392003c968075c44493a80572

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
64KB

MD5
1f6999e4883c6a253c67d0c67d0b1eb2

SHA1
afd66c478c9e65c30521885589abb807dbc60dd1

SHA256
9ac50865f6c9f7256cc813b29ea922f36e9306e61a5d348f6462bd25cb260f1e

SHA512
5e3d7bbdd20f83b13e7021552753bf5f1b21f154308dcfeee62989ad0d87ea9311b2586b3da7e9dadcb5a323f254a556e7ee26730317349f5f5c388447ba4a05

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
64KB

MD5
5633641cc76fbb01a1d0c05c4c0194a9

SHA1
908329f3402302b299d213ad10e0535924c7147f

SHA256
512bafe982486184c96d0a55f692f6abfcc1089b01318896b4953a1144a50471

SHA512
af8d9e3aa44e457a9a47dfeffc72e2feb7f1bb329a41a1a812e0b59f5da060916f1907fbe516e0741238b31a688a43d4c7546b8a7dbae00ad5612d48125997a4

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
64KB

MD5
e5ad930204f353a4e9eb8a1e18e54025

SHA1
7393f04677a606ed576599f34f041ef9160ef5cd

SHA256
5ad77a0abf03b5a26c42335758d66883321f83bdbc20153061d2e60ceb43a03a

SHA512
aaa1121e86f72fc01e51790a323de9dac00b9d004452259018a464c4ea638daee59a875b6787bc6a08d53a6f65886512e8b10b4dc99b983d6bfd2b562c533801

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
64KB

MD5
31456600bff79a3dcf9069fd515d6b78

SHA1
0dc7340f92640c5ef99d36f9aab469f72d90d532

SHA256
17756d060d6f39320012c9fd5e2c7f9b512c7a9864faed66dbf516656180b572

SHA512
78f64f779c45b01be301f6d8f6448c2005444f46d3bf92e805a236ec52561f0c14a7bdce9e6afe5ea45beea920b599abe9ec3c00569523d81087814809b2646a

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
64KB

MD5
e0706f4c357891f883ccf62f126b7c6e

SHA1
2ad86b175b29714112b829297d451f9fcf354471

SHA256
c5ea38e15bba65317a209afeee89d5eb264d201a7b87f9a5bb69d97ef2c9c66c

SHA512
6f70a6e63b483a02724248624e9e5d1a40cf98e9de1fcc3c4432679869ddf155ab771bd81c7cfd903832981265df1bc2352d7f6e4a519e0c8e7eb7a1c3c53beb

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
64KB

MD5
b6b9fe4546b8d1ccc0f4b15c8ec4849e

SHA1
7595a0a52fb120c5466ebeb9435d703f4b4dd10c

SHA256
f0832c35c382c5a082ae51eead9f108a005c8baf8d0742bf75b20a7b344aca6b

SHA512
d327f7584a915376ab063856ec361494c73a4acfb1e344c351290193dbed8e2b75b61cc3f18c7c935ab563bc9e85641e54724a4de941cc150869f7faaceb98bc

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
64KB

MD5
9ae09513f2ca83ce08fd296853901adc

SHA1
7f2dd8c9ea2f77008d3003188d395408c0faec1f

SHA256
b01565018cef9f72efe71fb61a97c0fa1fbc12f399b67785d2e7b32edba47396

SHA512
eadc6116f7f552c798b14166530661652d7c074a9f61443ccadc75711d42a4a71a917e5521eb05959d7f541e671b4b731bdf1094811717effd8e909dfe218d03

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
64KB

MD5
f6ffe62ef8f058e3e02ac5f37ff13e5d

SHA1
f6917ee7566b27bd1e43aaa3c8fb4d7e7351b194

SHA256
c4e0ac5a7c46e01f81d4f216f59233a6b96f4f593d6555aec897b5d92859886d

SHA512
a9c7ab8e6d7ba5de9bcde9d1e71e02221934e1a3e746a2cf10cdbad9e7a0cd0a8d5d1b6765f459e86b2b9274bf42f1c12f44b76429b5ddf8dec8f5204e6a306c

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
64KB

MD5
8a7de64de0525242793affdfc1f3fba9

SHA1
eb23aa7322320392b684bd7525ef5706fab6b661

SHA256
6e9f6556f2fed72b2f7c6ffe0a1b1d9d4815e203f75016f48208af081f44c39f

SHA512
70e2b211694864b01a6321f280aef5379934e65c0a5b1c5c65d01eb9c9610b6a7c65c965534adaed25ab42eca67db01310b9d0d061bb87b544b4db37a6932a37

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
64KB

MD5
69ce87dc8a40f4cee30afd5230b4662e

SHA1
210c72df17bc0b672c9efd9d072bdf056c909579

SHA256
ebe8c5da4cfb6ad5403918f0b1cec4de7badc285f3682d5dbc4e03f663097bad

SHA512
c2589058d4f0ad6a3e523dd598aa0c230cc5e992520563169dbd81d6cd04f638842d5754848327b30e8dc28aec838df476e029c7074f8ac0bd90f63885a85dde

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
64KB

MD5
7da129303bb9315442ad80c78f9a994a

SHA1
88bacb51913785820bc9cf730a5b601bbdf4810a

SHA256
9901068e881320243afb396dbf6f2ab54c9fd6c5656c9194ee3f8fc6f9e7daaa

SHA512
07174b1cfad846c3db026e2a767860f7f92a57021a2b18dfbc22deb17e99d9eecd270c0c258c6bcec0e2dcbad6f348fa3d506b6e69e7e79d08bd485f36db634e

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
64KB

MD5
e7f70693a928fe74772b93cf18a47329

SHA1
24532ef48888672838d88598817a1541722f7727

SHA256
a8b7f12007ba322c22a6ee17347d9caab80071861c7d6cd9a36fbb216aea9f4c

SHA512
9ffbb4055a0ef49b631ba672f8c6dca6cbc68ba31dbcea703f434776f412dadc0da834271c49c7a6b8b55951bb0399f6f8b7082ee707647ed8d20bf8efbd82a9

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
64KB

MD5
7c75be5f7434d8f31e3c9876da512773

SHA1
cdfbc7b2c23449b188debf4486b56cdc85f74d72

SHA256
d66320832400c258cf846afbd795e978f85debb6878cdda1e434242fb6014619

SHA512
b0aa8e6c4b0926572290f31e8db0d82f06fdec586e06bede248b12d718a4d1df3c31101e1cad706349c97062a7be6fe15da5beb5db67e6725f26679cfcd0edc2

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
64KB

MD5
7a1d561fadf9df0b25643418cc0bb000

SHA1
9845a2e458131e623d4e1b6d287ff03722cc00e5

SHA256
4f770b972c86165286ba9964b0c13d8dffaa29f2cb7fda760cfa3485ca50443e

SHA512
b99456f4db294e1057cd26f4724d29ac6a3add9b80b045ce62e414513cdd5c6cbba27fa493b473584ea0145d08fa02c8703abdb688982edf6f0d0eae000b3cc5

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
64KB

MD5
12b282dd3517cfc4da862c7fc5cec20b

SHA1
500d898849efac9ff184c1857474be650f90c6fb

SHA256
845eaaf014b2a8b6c6affd5413f9459159b5a3279b1385fd7e088ce8c14b1f80

SHA512
8ed225d385d8c2df211260432fa73b27a9eddad047b25ca086a0e199d42251c8971eca870ab7952ea3c68ead142d7562d88852f3c5e0962d6915a949a740cf13

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
64KB

MD5
f54fc5b0b9b3ed9da845c8de0785b791

SHA1
f2c119a2acf0fc1d632d43c182083f2a8d06b6c9

SHA256
4d8f6045418967f75edd665eec3f919fc819dbbeb20f3e9d9f95c95e5320944d

SHA512
ab837f58e94acb1c96e80f54bd2cec45daaae3bd3ae3984809d7cf2df17a8b70caaad4e3626b737760860a965b084be23ecfec4f0f089df4d8ebad26c2591c03

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
64KB

MD5
e6b722847ed08884dcf16bf1b7be0f65

SHA1
124390bf13b8405df5a1a183e890f564c84515ca

SHA256
9abe6471186a2277cf954a4902b9fbae931db089b444a1d49babe4d73bdf4db7

SHA512
174cb28aeb4fc46de78e65e0728be7dd567dfcc563ec27d5f0f3ebed1a8e6ef26621f3b1039ddf623510045d380571c1d60adb811ac17255ff89662636d99f7f

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
64KB

MD5
3322e6cf0f734c51e641c2104a010d25

SHA1
92363f975fca2b79927d15dfc1486abadae8dfed

SHA256
c316312ec69200fdfef3ddba36ad4fa5600acc6917be89a6cfa03aecdee2bc60

SHA512
7c6a199a8dec36564aa6697293dde3501229ec1b889b3350b591755430f6edee9e030725c5467d5331e40f55a9f14bf27c6c5b51d5fd54c0be6b64d4ec62d425

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
64KB

MD5
7fb6257667added84d9a265e4135603f

SHA1
aab7b282459ecd9263b1aff8db96a0cb46e4bff9

SHA256
d30910342cfc65e7d1a320eda994cb1b3a039b836b960e40fc5ef2a77d246766

SHA512
1d8d0c37429fddcdf1f23e704d1ed0f572dda027a097a7a8e35457edce351e6f0c3aced66df9a446b3ded152489fddd338ad08407ba0b0fcbde020dde8bd3877

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
64KB

MD5
062079d8eb3fdef9934d697f49bbeb9b

SHA1
67faefa57561ed2e043873ddacd284238af19ccb

SHA256
1c8e6ebd2b83cfda305660037355fded4fc3f5ec397d6687c5f76fdbb03e2fe9

SHA512
5b29b6da12e09382fd556a24419e609fb76b2b4983dedcaf3bfcb89ce993ec5af1b3aa007c7ad3dc4d340cff0a7b5b66b7b566590be1c65ebc017d2396c087c8

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
64KB

MD5
39f99ffe4eb36bbf3aff51c1bf7fd540

SHA1
6072b19ea2b72c3b2f2d11a5f8a834991091724a

SHA256
86dba1b047ee69632b6335d85b820ac68b1f0aca1f4790b12e86a2b24f960817

SHA512
fffa3ab382b9f6a59992b1a619157f992f473b88fb4776a0a3f35828f96d5aad2d38af185c81c7a5118c1acdf0010257bda30f9791660939ba4d8dfdc939d895

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
64KB

MD5
85f966ef8ec4afa59fd28a5c82236b81

SHA1
c1cfe5c5ee845f2d1b83441717ae6e91a58a8818

SHA256
6b27e063c85091b88db3e716749ece2fb85f679519d08a922c28b528d7438ca2

SHA512
ffab99718c75b313a404b245608b0c68eb470205f232991c4e3224947bd5177802460dbbffd728e91bfafa1f8f218258277104866d782f1449d50a6b44b9f0cb

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
64KB

MD5
0a95098b2cbb9c493c04d78c02803ed2

SHA1
bfe423084b89e3b56a45790ce5606dfeb8df32b5

SHA256
56e507bd63caeb28b32e3ae4994377bc8d38d33909e6989695f15348cbe1f441

SHA512
6ef6dc292e83110746e31d73b3c4f4241be70a4e920842902aa8201bf3b019f048d10d770706a076856332f2b2c98138348a7b6f944b28dd5285ee389d7d2ddb

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
64KB

MD5
f96df98f4e13b3fc2f40b5f07cbc24fc

SHA1
44a1570245b2792344e1ae02880240983a1f9a1a

SHA256
e3fa2ac651d2017c158e42ba3774b262317f11abd320b899d973dfe947baeb6a

SHA512
46b0e0289774f7093f4bf7fe4811f48b0f7d130a374945003660dea63b0fc89f56bfb47f0b7e1af26411d3399aa6d0a1cacdd7ef5cf4a6cec2fb8c11fae2333d

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
64KB

MD5
041b479667ce502d309930f83791b43f

SHA1
bc9375a79bd6899121196aa4808e29621a9d23bc

SHA256
5a29e9be71652fd5036847695effaee62e9dad2e5260586be9615aa0d989f5fe

SHA512
b1ca8647decca2cea646dc6529a06a2427a32e84a56c9d557ede17d7d117c32caac8145bc8f9d60aef635008f3b86243a7bddda71384cd3284e99120a1a2e73f

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
64KB

MD5
532d6cea38c86b33d726319f1aa6f74b

SHA1
d71171e9bb0cb0479ea84be492d2e346e40e95fc

SHA256
0f3619385855f47b24fc2fa0edc0fbb4421cfc5717771971bdad3b40a81943ee

SHA512
114611bd510f34c7f1cc710b6ed469d1e2ab1128e648e8aa6908d5c4d3621aba43d4b939551fdc2f702d72af352ffd1e6f7688f4873adafebafab38a8f888a70

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
64KB

MD5
b6b5473ae4d126b302efbe8719a8f2fd

SHA1
c0affa582fe053d4d12c2c20640255770d2bfd5a

SHA256
e08de21ea5e298ce19b0832920ba676565a40523db570764f8fca5df8b010cde

SHA512
2fb03015bab6a47ea87636123486fc00a3c49baaa8e42445a6ecea8c9d6db9279ba3c7cbf35f0693e4cdd00be45b8eb4564bec3bce98917bfc5f0c73d9d99b34

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
64KB

MD5
1c64ec184267bec99151277dd48e6f71

SHA1
b5357a710f18b452514c61c293a80f7bc91e3acd

SHA256
257db293adcfb178812957a89087199533d3ee952910a60445621fa84158c0b6

SHA512
166a995a0bc361c09b619e152f299f75fa981f11e0bb00681c9112d318e402c1ee57dccef3b84019381b27e64de8d15a5b5b94f24a562a866662c9a8baab546b

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
64KB

MD5
c56a7f13de0ef4029f9b4386627ded03

SHA1
f8f0b043f9426e9a2a29dbc4d9fdc3ba5771caed

SHA256
b41c4b0e255d340029932901212653a40f35c69d7399143ec6d14fe47c68f858

SHA512
1ab586740ffb366eda3fa8109dafa24a7436eb3a1267a5a01a7d0d133ef5caf233b37ef938ac3a023a298fab24aed787662040e9dec40fd3c99e4d357a5a86a1

Download Submit
memory/320-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/460-536-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/620-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/716-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/744-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/808-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/808-544-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/864-579-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/864-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-538-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-484-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1212-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1244-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1272-552-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1324-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1348-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1404-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-466-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1764-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1836-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-565-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1904-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1968-472-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1972-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2036-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2264-545-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2392-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2412-496-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2672-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2732-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2736-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2880-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2900-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3020-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-508-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3144-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3176-502-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3180-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3216-454-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3224-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-362-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-598-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3308-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3336-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3340-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3460-566-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3532-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3544-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-580-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3688-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3700-593-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3716-464-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-572-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3916-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3944-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3956-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3996-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4020-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-586-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4168-577-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4180-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-490-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4320-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4324-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4340-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-448-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4436-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4464-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4496-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-587-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4700-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4708-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4708-551-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4724-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4736-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4756-526-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4828-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4868-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4872-559-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4912-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-558-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5072-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads