9f3881134c3c8fd53bd6ecf68992b3fea9072eb3e3bbc1268795c4ac33367bf4

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16344fff740db7e3dcae49100c9be420N.exe
Size

63KB
MD5

16344fff740db7e3dcae49100c9be420
SHA1

c115b71bdd529f672b79fa6158a4d399ae40028d
SHA256

9f3881134c3c8fd53bd6ecf68992b3fea9072eb3e3bbc1268795c4ac33367bf4
SHA512

d79f99c090a0ce5044f572a48a067f96b3f62d665a4c9da2aa9f525bc43361b721f9e9109d66ba0e62f458f3c921332dbb232714163b1f31ae2be5dac34072d1
SSDEEP

1536:beBXyEtqNbwq+zWO9bt0cYh+VTZEn9rjDHE:aBfys7aOgc4odk9DHE

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnneknob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllcen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojoign32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfoafi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe

Executes dropped EXE 64 IoCs

pid	Process
4540	Iiaephpc.exe
4864	Ipknlb32.exe
2156	Ifefimom.exe
4900	Iicbehnq.exe
4000	Ikbnacmd.exe
2672	Iblfnn32.exe
4160	Iejcji32.exe
4168	Imakkfdg.exe
3216	Ickchq32.exe
3768	Ifjodl32.exe
876	Iihkpg32.exe
3240	Ipbdmaah.exe
3708	Ifllil32.exe
1780	Jpijnqkp.exe
3936	Jefbfgig.exe
4620	Jmmjgejj.exe
4356	Jplfcpin.exe
3052	Jcgbco32.exe
776	Jehokgge.exe
1576	Jmpgldhg.exe
468	Jlbgha32.exe
2524	Jblpek32.exe
4600	Jifhaenk.exe
3344	Jpppnp32.exe
2292	Kboljk32.exe
5104	Kemhff32.exe
2164	Klgqcqkl.exe
3760	Kfmepi32.exe
4364	Kikame32.exe
2192	Klimip32.exe
1948	Kdqejn32.exe
4596	Kfoafi32.exe
2264	Kimnbd32.exe
3916	Kmijbcpl.exe
4192	Kpgfooop.exe
4792	Kbfbkj32.exe
2456	Kfankifm.exe
3100	Kipkhdeq.exe
4932	Klngdpdd.exe
4936	Kpjcdn32.exe
3632	Kbhoqj32.exe
396	Kibgmdcn.exe
3112	Kmncnb32.exe
1256	Kplpjn32.exe
2380	Lffhfh32.exe
2760	Lpnlpnih.exe
4920	Lfhdlh32.exe
1664	Ligqhc32.exe
456	Lboeaifi.exe
2056	Llgjjnlj.exe
4696	Ldoaklml.exe
5016	Lgmngglp.exe
3724	Likjcbkc.exe
1604	Ldanqkki.exe
2520	Lgokmgjm.exe
2576	Lingibiq.exe
1260	Lllcen32.exe
4148	Mbfkbhpa.exe
1552	Medgncoe.exe
2116	Mlopkm32.exe
2664	Mpjlklok.exe
820	Mgddhf32.exe
4384	Mlampmdo.exe
400	Mdhdajea.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gijlad32.dll	Mgddhf32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Kboljk32.exe	Jpppnp32.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Mbfkbhpa.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Chfgkj32.dll	Nngokoej.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Njqmepik.exe
File opened for modification	C:\Windows\SysWOW64\Ojjolnaq.exe	Ogkcpbam.exe
File opened for modification	C:\Windows\SysWOW64\Olkhmi32.exe	Ojllan32.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pcncpbmd.exe
File created	C:\Windows\SysWOW64\Ifefimom.exe	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Oomibind.dll	Pdkcde32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Ndhmhh32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Hjakkfbf.dll	Iejcji32.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mpablkhc.exe
File opened for modification	C:\Windows\SysWOW64\Npfkgjdn.exe	Nljofl32.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Pdifoehl.exe	Pmannhhj.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Afhohlbj.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Acqimo32.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File created	C:\Windows\SysWOW64\Pacghh32.dll	Iihkpg32.exe
File opened for modification	C:\Windows\SysWOW64\Kikame32.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Hnmacdaj.dll	Ipknlb32.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Lgokmgjm.exe	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Ogkcpbam.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Imllie32.dll	Kbfbkj32.exe
File opened for modification	C:\Windows\SysWOW64\Kboljk32.exe	Jpppnp32.exe
File created	C:\Windows\SysWOW64\Ffhoqj32.dll	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File opened for modification	C:\Windows\SysWOW64\Pdkcde32.exe	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Imakkfdg.exe	Iejcji32.exe
File created	C:\Windows\SysWOW64\Mdjagjco.exe	Mlcifmbl.exe
File opened for modification	C:\Windows\SysWOW64\Nepgjaeg.exe	Ncbknfed.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pqknig32.exe
File opened for modification	C:\Windows\SysWOW64\Pjmehkqk.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Klngdpdd.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lingibiq.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Kikame32.exe	Kfmepi32.exe
File opened for modification	C:\Windows\SysWOW64\Nfgmjqop.exe	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Hfligghk.dll	Nnneknob.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7808	7632	WerFault.exe	330

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgldhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcoakfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpablkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmkadgpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjokdipf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpjcdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhbal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgefeajb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iicbehnq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfankifm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnlaml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhacgdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifllil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iiaephpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbfkbhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnlhfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnakhkol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iihkpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqcqkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kimnbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpjlklok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpppnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikame32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nngokoej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acnlgp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Imakkfdg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adopjh32.dll"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpgii32.dll"	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijfjal32.dll"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjknp32.dll"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jifhaenk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjac32.dll"	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnkjc32.dll"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klimip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llmglb32.dll"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifjodl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Namdcd32.dll"	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Chmndlge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4540	1476	16344fff740db7e3dcae49100c9be420N.exe	83
PID 1476 wrote to memory of 4540	1476	16344fff740db7e3dcae49100c9be420N.exe	83
PID 1476 wrote to memory of 4540	1476	16344fff740db7e3dcae49100c9be420N.exe	83
PID 4540 wrote to memory of 4864	4540	Iiaephpc.exe	84
PID 4540 wrote to memory of 4864	4540	Iiaephpc.exe	84
PID 4540 wrote to memory of 4864	4540	Iiaephpc.exe	84
PID 4864 wrote to memory of 2156	4864	Ipknlb32.exe	85
PID 4864 wrote to memory of 2156	4864	Ipknlb32.exe	85
PID 4864 wrote to memory of 2156	4864	Ipknlb32.exe	85
PID 2156 wrote to memory of 4900	2156	Ifefimom.exe	86
PID 2156 wrote to memory of 4900	2156	Ifefimom.exe	86
PID 2156 wrote to memory of 4900	2156	Ifefimom.exe	86
PID 4900 wrote to memory of 4000	4900	Iicbehnq.exe	87
PID 4900 wrote to memory of 4000	4900	Iicbehnq.exe	87
PID 4900 wrote to memory of 4000	4900	Iicbehnq.exe	87
PID 4000 wrote to memory of 2672	4000	Ikbnacmd.exe	88
PID 4000 wrote to memory of 2672	4000	Ikbnacmd.exe	88
PID 4000 wrote to memory of 2672	4000	Ikbnacmd.exe	88
PID 2672 wrote to memory of 4160	2672	Iblfnn32.exe	89
PID 2672 wrote to memory of 4160	2672	Iblfnn32.exe	89
PID 2672 wrote to memory of 4160	2672	Iblfnn32.exe	89
PID 4160 wrote to memory of 4168	4160	Iejcji32.exe	90
PID 4160 wrote to memory of 4168	4160	Iejcji32.exe	90
PID 4160 wrote to memory of 4168	4160	Iejcji32.exe	90
PID 4168 wrote to memory of 3216	4168	Imakkfdg.exe	92
PID 4168 wrote to memory of 3216	4168	Imakkfdg.exe	92
PID 4168 wrote to memory of 3216	4168	Imakkfdg.exe	92
PID 3216 wrote to memory of 3768	3216	Ickchq32.exe	93
PID 3216 wrote to memory of 3768	3216	Ickchq32.exe	93
PID 3216 wrote to memory of 3768	3216	Ickchq32.exe	93
PID 3768 wrote to memory of 876	3768	Ifjodl32.exe	94
PID 3768 wrote to memory of 876	3768	Ifjodl32.exe	94
PID 3768 wrote to memory of 876	3768	Ifjodl32.exe	94
PID 876 wrote to memory of 3240	876	Iihkpg32.exe	95
PID 876 wrote to memory of 3240	876	Iihkpg32.exe	95
PID 876 wrote to memory of 3240	876	Iihkpg32.exe	95
PID 3240 wrote to memory of 3708	3240	Ipbdmaah.exe	97
PID 3240 wrote to memory of 3708	3240	Ipbdmaah.exe	97
PID 3240 wrote to memory of 3708	3240	Ipbdmaah.exe	97
PID 3708 wrote to memory of 1780	3708	Ifllil32.exe	98
PID 3708 wrote to memory of 1780	3708	Ifllil32.exe	98
PID 3708 wrote to memory of 1780	3708	Ifllil32.exe	98
PID 1780 wrote to memory of 3936	1780	Jpijnqkp.exe	99
PID 1780 wrote to memory of 3936	1780	Jpijnqkp.exe	99
PID 1780 wrote to memory of 3936	1780	Jpijnqkp.exe	99
PID 3936 wrote to memory of 4620	3936	Jefbfgig.exe	100
PID 3936 wrote to memory of 4620	3936	Jefbfgig.exe	100
PID 3936 wrote to memory of 4620	3936	Jefbfgig.exe	100
PID 4620 wrote to memory of 4356	4620	Jmmjgejj.exe	103
PID 4620 wrote to memory of 4356	4620	Jmmjgejj.exe	103
PID 4620 wrote to memory of 4356	4620	Jmmjgejj.exe	103
PID 4356 wrote to memory of 3052	4356	Jplfcpin.exe	104
PID 4356 wrote to memory of 3052	4356	Jplfcpin.exe	104
PID 4356 wrote to memory of 3052	4356	Jplfcpin.exe	104
PID 3052 wrote to memory of 776	3052	Jcgbco32.exe	105
PID 3052 wrote to memory of 776	3052	Jcgbco32.exe	105
PID 3052 wrote to memory of 776	3052	Jcgbco32.exe	105
PID 776 wrote to memory of 1576	776	Jehokgge.exe	106
PID 776 wrote to memory of 1576	776	Jehokgge.exe	106
PID 776 wrote to memory of 1576	776	Jehokgge.exe	106
PID 1576 wrote to memory of 468	1576	Jmpgldhg.exe	107
PID 1576 wrote to memory of 468	1576	Jmpgldhg.exe	107
PID 1576 wrote to memory of 468	1576	Jmpgldhg.exe	107
PID 468 wrote to memory of 2524	468	Jlbgha32.exe	108

C:\Users\Admin\AppData\Local\Temp\16344fff740db7e3dcae49100c9be420N.exe
"C:\Users\Admin\AppData\Local\Temp\16344fff740db7e3dcae49100c9be420N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\Iiaephpc.exe
  C:\Windows\system32\Iiaephpc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\Ipknlb32.exe
    C:\Windows\system32\Ipknlb32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\SysWOW64\Ifefimom.exe
      C:\Windows\system32\Ifefimom.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        23⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4600
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3344
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        26⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5104
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2164
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3760
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2192
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        32⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2264
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        35⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3100
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4932
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        42⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        43⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        47⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        48⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        49⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        50⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        52⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        53⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1604
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4148
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4384
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        65⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        66⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        67⤵
        Drops file in System32 directory
        
        PID:3020
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        68⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        69⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        70⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:1848
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:980
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2904
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        74⤵
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1524
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        77⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5040
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        82⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        83⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        84⤵
        Drops file in System32 directory
        
        PID:788
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2932
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        86⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        87⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        89⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        90⤵
        Drops file in System32 directory
        
        PID:3032
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        91⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        94⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        95⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        97⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        100⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        101⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5636
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        104⤵
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        105⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        106⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        107⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        108⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        109⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        111⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        112⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        115⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        118⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        121⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3752
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        122⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        127⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        128⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        131⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        133⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        135⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        136⤵
        Drops file in System32 directory
        
        PID:2624
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        137⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        141⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        142⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        143⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        144⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        145⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        147⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        150⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        152⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        153⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        154⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        155⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        156⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        157⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        158⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        162⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        163⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        164⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        165⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        166⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        167⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        169⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        170⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6612
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        175⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        179⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7120
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        186⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        188⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        189⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        190⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        192⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        194⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        195⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        196⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6856
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        199⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        201⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        202⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        203⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        204⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        206⤵
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        207⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        208⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        210⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        211⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7332
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        213⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7644
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        218⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        219⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7828
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        222⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        224⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        225⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        227⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        230⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        232⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        233⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        235⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        236⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 396
        237⤵
        Program crash
        
        PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7632 -ip 7632
1⤵
PID:7768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajanck32.exe

Filesize
63KB

MD5
51cb9559fef56ef1d9571919d34aaded

SHA1
1c3f7bd521709c3021046d0294f5e5ab477296d6

SHA256
c221fef6036c1f4d878c6ba6de3b77acd2de89d1f56aa28ac71562f84f79df34

SHA512
ea65ca226ecc1707db27bad6bdba5e7f5fedddf71b3e04d85ad7f9736d411e3c7866fa5e51958003e81ee2aca77308864b4c53faf9aa173b78249952cda49242

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
63KB

MD5
3c82cfaded4290a629a2d03a361906ae

SHA1
d388e457f91e5a4a0f09e864c6317a42f027036c

SHA256
2f3cd411affa4c7d22c67a2dfedef794a4300dae0abe5b1f42f6f7b83d0690db

SHA512
d2f2bf1d883be882fed95fd7e38b9e9a14f9e0b6fbb732775858ec8c5c49cdbbe1e083762de115fa60418b48f3ac5fdebc513f474d613a2395561a44f697b638

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
63KB

MD5
9cfdf2b2a0ff1d73e0c53710f261c2d8

SHA1
54e4fa48cfae38c8ce322451988450f38cd07c94

SHA256
93dfd53c30c9bc5a9dd92a915a7c9ec8e7a4e6b6d08c6079a6a5c50dfffee9f0

SHA512
28952ee0a9c2db3975196e9e3d148e97ee5d84b43ba89825d983ab1847fa879ed2841b420c3f2d01f1e439a81bf60186ddcde691e383ee3ec507e7aa7d2a6146

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
63KB

MD5
babdedf24edf747845403998ed69d969

SHA1
62c976eef30c6dc6cf8152d9177e90f33743216b

SHA256
4685c90c06d68da0251d9c8df9706f13060d17bf1c5cc731edfd4520b3a67c73

SHA512
e4fc61cc747428a8f4b434699a2a578bedacfe5d46f93dd8b9ff8263bd4b1ddf80141fae40ccec7e1182023c5d5cde155943557cc86b0b6f9f857ad7b83e207c

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
63KB

MD5
5d40e55b47de884b888f3180a6b1710f

SHA1
87df8f7d8dac5a27373ba2044a76756c0b734489

SHA256
c14c7e81bc41c3f51d3c7832ec6c0dd6853b4a885a7bdee53292fd13f4a378a6

SHA512
853c934e565b6af09568cb0ad3687b0fba59b75e5332266902064bdad0b65949b2ad3ce0ca311cc46ceed56400d1b1b06fbcfccd71b789815c8692db0c30a32d

Download Submit
C:\Windows\SysWOW64\Ickchq32.exe

Filesize
63KB

MD5
ab2c0a5fd500b734b3c2b53ebbd64e92

SHA1
a3404d7d158ed3ca3003bc7d35c2002f5b0f4ac6

SHA256
f7b2fc446a3e46a9934759889645a0150965c7bc555f0a94ac8767f73e1b66fe

SHA512
d0bc0265f4698ab174b072275abc4443cf0010e73dd31c9ab5dd51d759da0068258848dd798440afa0354ad3e2ce9a28eb372246d08ee2f4a035d88447351624

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
63KB

MD5
a2b58a94b3a3feb9b972ce05a8ee0118

SHA1
1f523ade2c3638b5a712ead13a156eb5340c9e27

SHA256
8968ba52137e5b8db2ee6cc24b6daf7582e83fdaf33c1dbb3f5e38947106f86e

SHA512
1248b273a0da5aac4d9142c41fed39f51316512df2f5b247c53d67b54c94c7d11297c5f8fc290e504fa3c976e2beeac096404e069de66064c8e945bea4e98749

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
63KB

MD5
52a0dd945fc4af7562cbb00a513e6ae6

SHA1
ac9b0ae2473fe0b568ecee514f2131d6218b997e

SHA256
22eeb50aa1072341279798ddc7a8e31a7f5075fc6ed99c3ae185e45f510c04c8

SHA512
3ef46bda5fc468ce135b4bbd2c20ee931657115a05aa3b437309c70c1e6402d92d4ef19bbc58acc98e6f2d8c16b161362bae499cb2570faa90cf9bc06e3d204b

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
63KB

MD5
fff7718df50d8cc4d8875d8e6f58849a

SHA1
d7abf556f672dbc0ca559b98867e9ee7b315c73d

SHA256
e37ac6d2312d8b50a4b82397dd6be8aadc8320ae551853511f483f538b096ce0

SHA512
8f0246807c3d8002d20c880946a81172e989124d3c69814f5556d76212c4f1ee44e6925bcc0436e5400019a99ec8b530dcc8ce9b469cfe84cd266cf1c26e469d

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
63KB

MD5
63b07030bd5a0c3e88e7d9b201f7ffbd

SHA1
42b1e5ae029b0698c50a6700086c55ba14e265a5

SHA256
0d36d557b3778fc2830d342a355cc622b6ba560e710bf7940cfb293565b2076c

SHA512
e9a6d8b2cb23ac9772d8dcb1584811ec44a5ce89e7552543394791b9726e5d3600d2b037680d7a141769c3e1865ee30c2d3155d4dda9556b59c803463ced494b

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
63KB

MD5
235537c8cf18737f44592dc822175c6b

SHA1
fb83fd3e9d96f103f825952e3c2f163643903d1d

SHA256
dadfc170937b541eaa351699b4ac98cbedd3ef5b6fef937a15c378491045c529

SHA512
d1a751f7ac1c4b102a0bc618e6d2021fc86662612aeb0476d1c62a7db4de74128c08ed6a332f64f989d8791dcae13c5a84c8d16d700ff751ae8d7e82b6e1cb50

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
63KB

MD5
ea27b40c3ace3cfc19abd7a87495b217

SHA1
2bb52f2bcb84a7351e0fb702ef67f7fa27fcb359

SHA256
81b3ccc45979e02bcc3f98f189478f9f55b23bc408cc2efec4dafc8247038e5d

SHA512
d6cf71983a934d037b39f2a489a040833d4f999f333dc892d34f1ffac04ee00561ea0dcce7975d9615d3a28813650266997b0610a1ae4b2f577b2322a6134282

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
63KB

MD5
8164d3cc21dbb75df01c0d642512eff7

SHA1
b17cf825af6476d128db8d76895c0a02fe49a248

SHA256
c43a2e9adce7cf21c32e63d904da22e6fdbb6fac4fb290e21da28fc832076ad3

SHA512
bc814e227aff7f922df11b6a519cd448ed723e17ae1e3955863115e2fd08ba3fab8bdd5229d57a8192d3b1b895d45d1c940887b5b67ebee63067f452b89d59be

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
63KB

MD5
abe661d9d2810834b7aaa246795ddfaa

SHA1
ba267ba86b7cdefe5c1bdd83bf014af414fc1de2

SHA256
11b850180fe3a194482758e1c4ea6fafecf5945466ee540fe11e6a764a26b140

SHA512
450807a15a8d90db4f618df3d4013587e0465dab8a7b8edcf1c090c3576bcfde0c2a596ca65bcc508dd6b7cdd52dfea9312c781ab3439e32c53e50fcc05f1d60

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
63KB

MD5
80339788e6511e41ddd3f22e94d958db

SHA1
5b5f6c492329d627d888f45050b705edd3d05d48

SHA256
01714c3412705577b411ef0347e1e15e8fb513a823f855cc98a2b6c380ac6867

SHA512
e9f2ffcfff440d82df9460a98346da50575427bb780e943740fc5f6b396b3b03f5e2edf62de6acf3bf390fbbf4908aaa0f7fc54aa53f23261bde4a2d72869f12

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
63KB

MD5
feb83208bf709bc55143a12994372bca

SHA1
ff2282e0949a19bc505f846a7a2cf0caa2486d8b

SHA256
a90da544d6a45ac04627315e5b916260f006b8110229e91b27ff8767ccedb79f

SHA512
4021cb27ca302e55adbed8acaa239bc2f429825dd7a7c5c20ecca13a723a5cac3ddbfce1940bcd8940537819565ab8189612a3edca05ec9719abaaf8ec658b2d

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
63KB

MD5
f3aff546318f9cb94fa720746296ea92

SHA1
772d426adfd255d75a5570f2592b26840a6d9113

SHA256
9cd45f9dc460812b99a94e03bebc2481512cdc14983447a89a55837b023d8b0d

SHA512
ecb5ccc9c692d71e753c337f5946ed2d05fc83d7ccc17c4e0fc2bc69f944bb91335c4a93d453ba4144441eed95525c27c28b11e5803e4d8f28ca1cb52a3b0832

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
63KB

MD5
645bc81cf6926f284bc764c148416ad9

SHA1
5e7fba058b836d6bf887d4ce2de2028431243f58

SHA256
bd04e48fe04b3f549898996d03b037438a8575a27cd2c4310f90977e48376507

SHA512
12edb8eaa8bbaa26c16ca5271589d5e5dea585d0d5e9d995c6e1e51b9c8b627b61b1ce4a268e446c14c9cec877098f5694709f07f9bfa4d47fe5b9373c91e028

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
63KB

MD5
5782643d0a784eaab9244c012aabb067

SHA1
42dffb25f9931e2e9fba9afdbd6d6041771cf87e

SHA256
81a124b705372965b97bf0abb571aa255005331706ec7f40158585a1e58ac6cf

SHA512
b4b8a2e600d0d7d822312a667ea64b3e668fa67b01afac51037ca885aef6a8140f6a2bcd187e22e3f3b81006fad7dfa8007667e7bf6d05a7d36bdd879e30928b

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
63KB

MD5
cfab1786d20ebc3bd46856686436d6b9

SHA1
86b48669893180d20594eb17247acd018ea9a363

SHA256
09e5ffc18a65d7212c4cfb8cf230c80440a7297b57bc5ebf87812536442d71f4

SHA512
7fbcfb87fe5a2c85af64da0a080b5c7fe32c710e7e976bb8176feec44f2854e4d580d32837b2ef860ba8898e4e7f9ccb6eda4b93fcfc6b4d631128fededa7da2

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
63KB

MD5
9327376218603304246634e6007e47bb

SHA1
e122123ce000ef5ef2091a1f5a9fdc98426013f6

SHA256
7e748b56b77f083dc3338084be385db09f5ee7497268b278de575607b88143b5

SHA512
001dabcadd9323afb814db7433660c75c4af7552dc094823a08bd3a66d562dffb47515a84bff5bd9e77e9ba1100f4d29a6604a2db7ff5e1068dd3eba6d9c9170

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
63KB

MD5
3d70822e76b1cd6c3a6ace464fac0096

SHA1
d2a557258b1a73efbb9a50220420d7454f8237ec

SHA256
682d8f321a562d89e041a7c93f51145374a08ba4796badab3ec4aa9c38fea3ad

SHA512
8c857afb35197ac6cd0f101558bd5fc5481f330e58bdc43a116c0942b78e2d110ce1e575320089ca7dfef9789a7e0b9d3b4e7bfb687ba4a9080eecf0b1d8aada

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
63KB

MD5
f050dc92d6748056818484410b78f706

SHA1
2f77c4da034ff0a5003b4afe61e2a1b4c8c4ea5a

SHA256
b4ce3e67464f155ff88b76e2a396a1b652982faba6f54503bc69320c91de0f90

SHA512
f6101edd9516d66fabc723e8e8e781fab6f45591b00670be37d45a848a7a6ec623326c0139f2da3f241e89b11311ae417a640e90045838126930661e8a47ef09

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
63KB

MD5
95db6504e83366bf5ef41e14d4343521

SHA1
38da0131865e99436cfec46473cfc6d55ae5f672

SHA256
7e34b64fb2f1c2c824af7b51a514e66c3a667c1750996b01c0a83625133617d9

SHA512
b5a0299a433a4c956a17083716279e2f2fe344c96035e9719d726e381b72186ce113ce31c5430f7d70f36a1edca3ad6930e3656b38142cd311c1efc836694b69

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
63KB

MD5
bd76bd0f24794f6dcc0797e70a262128

SHA1
bf48856ac50312fdb4c64cff8d9ed8b5d5a91268

SHA256
81c120165193285f158ca586be91192147a77266590e8ddb57519b3e31503e2e

SHA512
090b4258f9a082b41c678f37a26a43709b39ca7b4e8a0d49fe8c614d89a586b286a52362c09df3196e17bd3ebda12618335151d28e64eed2ead03f44e3df2307

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
63KB

MD5
b72a2b4d811753c1669b4c5e1247f2da

SHA1
76447d099e516a86b029dd6e35c0a4d9a2f63ea8

SHA256
4f1645f74baf764241fc5261cd8b33c5ab6550d965d0a7449c37f9f2259293f9

SHA512
b7824d58893d5ac19046484461cc8f13757b6d64e0c2e70446b6b7f9b6ca3993590e28195fff7331848b58dc2e16b7c00ac95515d8eee0e71e005143f3cd66f7

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
63KB

MD5
5078eee2101813d7a89023afc1cbdb6a

SHA1
c9f1657fdfc441254fd61b22c3ef54d2155c1547

SHA256
cd8ea4e5541c64b8ed27f6fd00693e6bc05e1faa8b685d7a5ef391a937089ea5

SHA512
8a388bcdabe53f55f988e61ef4ca32ff0e71733a17854ccee5e174f5fc35975f30773dceaabe8706f03147fbfd4c6285e33a7d4fc20b31c89250ba872a832b1b

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
63KB

MD5
fa39488c0951867ea9f8a0069b4667b7

SHA1
63f913267a217cb829c9b42cd77bb69711b22e60

SHA256
5db8c80520562d85fa26cee5d1a08077aa5615c43a4357c0656444676602b6e6

SHA512
e5ba80d860fb05aa5199d2d036ec079472954393a589b8920e9eeec708b810dfaf209d70185d80f8672042db4467a4bf2ac2d57d5b059d5037cf7781a3e07198

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
63KB

MD5
4233cb461dc1993f352b02ee2d454b11

SHA1
33c190a83a847f218c1e715fd1165cc052125eca

SHA256
7b00555f95654f6242214f4b0cf675c3d363234c6f7df7cd905b35aec7bfba50

SHA512
021cc07e7e16113a990a9c46fe6bdfda806157d1f9d3e0b742d6ce07442d5c6cb845755097740e01797a2738139faff489cf11de73e4249ca975bfe796df85ca

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
63KB

MD5
e5d35043b3b3b6aaf79e23c4c5859f18

SHA1
2c7bc8ef6eacd31b80ffa5f38676e7f403346dfa

SHA256
7be9fc7d07c8dd3dbf6fb853c2e76f22088af20c9c7fa6b8067f2300d36eb58e

SHA512
1ffc4a0b510ee77d7f1bdf2b2d6f67b72ad8c6013deb0538ae1e1f607584378be68083736a0c02a8a8156883b74ea745fdc9c4bc399a0145bb462686c10959ed

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
63KB

MD5
4dc80ac77a6d14ca3d7effd218ab0904

SHA1
c62bea691b0504e98bc6dae02d9469c38685a26a

SHA256
181b202f36c1b0281dc0ad0619a3cb94489feb4be58ab0130a480c87d3b7e42a

SHA512
ac4645c4e4c490a4073252d2880435c91e2b25c1bf19f608c58edefb2b307f0f93b5ed9cba53a0316bbe0359ee4f0f6a0f59b973b876ba8fdd8cfac145911f7c

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
63KB

MD5
1b03c811d8086339ca2f8c34766c9367

SHA1
6758d9e4eabc6125c128465a56acd89704256fcc

SHA256
4e4d8c2197c7eb4e02aa2709f88e107d0dfda46b4c018c5d6be2427892a14509

SHA512
d01749400db5fbd0393e57b5b9734614278867feeafb30c0dc736f5145d2c3b7d55608185a8d7448517ebc50b69db81d0790a6d3714237f9f06c0a46d76926a4

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
63KB

MD5
12e287c2f9b3fb65dedab570bdf81ceb

SHA1
f61559e22bc423c27cd576972492ae16acfc2222

SHA256
9a0d070f56fe77ed53fd8ff0c365743d94490c499d850d67f1db81c348383d06

SHA512
f67783ddbfdd1e7accd55932f0eafa09a081ebc6b9502b2b539c8019047a34fde213bec3120b75496f08068b2339eb9428b5479869746e28bfb5b93b2f3aa6cf

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
63KB

MD5
566b59c19b462425d1edbf2253914d5b

SHA1
c954aaa78a1dad06ddc8485265a472db164deb37

SHA256
a2d71ef8a8abe0dd9c72f6233d03deaaa06d718673e3677f59725084a43f561e

SHA512
134b393529832fb6a128beaff309c7617a1fd208ea1f397757555be5a5f5c7de652e06dd2de710b924a487a1a752e7a93a72cd9e2acfe58c3eeb0dfe431f0d6f

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
63KB

MD5
14573d98b5413900da0050c6140dbe86

SHA1
a2d2e85f47c5d718bed1e65e3f6115a8a2660b0b

SHA256
ff2cd8ecaa282328a1d103b2e7823f5cdc18c6ddd59292c6065672ffc0928b45

SHA512
f0a0d6236de8a9daaf2c6acc01355cb411707eef9792ecb775a95792e128b7f0e4b7e7f03123b3a149cd75c339f1f625813312f23eb07eb6cea1fc8780cd9cd2

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
63KB

MD5
05225bd511ca3b3ade1c6b07ed7ef3cf

SHA1
32f2a10dc19359dd86ff221158fd1d37e26dba3f

SHA256
ef7452c51c2780915ead578e55b2edfa1661bb6667b9775c2cace45e59089772

SHA512
ee4c1e5236ff3fbe8eab85fbc9fa30db8e3a07e90542fb0cfa30af4dac8051b21734d98bc1a2a3447962734a65e534c5231af98cae7b35018d1acac5e4b2d3d0

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
63KB

MD5
132bb869cd1000d7f527f4f42b54f898

SHA1
e5f7bbc4ae72817eb1ba124035609b5c5fe95e19

SHA256
68d66334806931a9d79f0eab9c3c8773bc431a06cf2702a1fa3b62be4b258ec6

SHA512
8cedeca815d8948d800c5485f8f7cc65ab76bc1b89d236c8cc76533bb0d2970de7a02c6aaa6e0c93f2ee62fbf7f43f4922c3915be4066c0dc2bc83fc9568eecc

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
63KB

MD5
2a93d10cf2868439d317668ece7aa8ab

SHA1
a21c057165c2bdeee453cfed095195237af4e24d

SHA256
bf4a27ab5a72693a69782117e45035a5066e1a869b056ae0ba3fae7636ba7e51

SHA512
e855cc0d9e653071a0afb09df1ab47f84598134eacbf41ea04d34b50e1a738a373afbce42376ba3297ecbd8f031394c55ea4000b4d3b9f13ddc10e9878f9ec90

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
63KB

MD5
4b1a0fa8ed5dfcb33558e8e5b0470b2c

SHA1
f14e2d8de8e9115390b10501a8368c37acf6bd78

SHA256
1f21b39137d29f72b009f7955c78742ae5604c321ba9b230d54485328229adbd

SHA512
60018c26563f91a6c1842d3640eee7d89bae470c3eb133cc6418896b3510a7258b6e3595ded8b478875bd56f27d96f160b1f14f074698685ce272a3691994c3f

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
63KB

MD5
3c2ac942321637903343a15201ebd2d2

SHA1
6c8ca002651db474a81a71181790a4b0aa25992f

SHA256
546b299bbccae1681b8f1c4c72f9d3a0256dfd645d701e29b7319a93e5bc6e64

SHA512
e81dcb259b8380c9311c13acc3e8771137bcd9fef93b7831302e2a5fdb544fae9998dd5e29fb894e7f047f59b0c337b43aee41e6847407aca38d72240a8ea28e

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
63KB

MD5
95cc3b02e1e87b5381c445f31701e454

SHA1
9f7205d185cb389b2a77d72c0de6f882a5116237

SHA256
a9c47ce605e14bbe5c1c636cde85ae34cd128a3460f3a44c713f6c88ec1447f8

SHA512
41974815394bcefb1ee5bda8b1e0821007cc75641d83fef919d001e6fc7e82ddf0db2c9ce93fc7c2d5f60094a9eaac76f83839bb73ec122d1a24c1e5e0dd3063

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
63KB

MD5
222a72373f3bf8611da63269e01c8855

SHA1
bccf7c9abe7bcecf3d7e07b091a9eeb5f70b3fd5

SHA256
ceb96b6a04bd57673b36a5076f1ecdeedfa712ae5b5bb1d25eb702815b816add

SHA512
b6481b27e605e17d7f69f664e5d864efd6d5db7734e625196774a7d3cf72cef8c95550fbf3e8aca134a7d44e1ea9b363b20923f9334ad17fa4c54ab579f2d817

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
63KB

MD5
2e5f637652b354b611f9372b7f4c7253

SHA1
38f730f97615dc4fa1cfd3d3d22673ac35a3087c

SHA256
b7b3fb51569529cea09c1c944c8d79994d28c0101a6c6b5410fbe6866863fe60

SHA512
660f903f5626780dd6c2894a6d040edab83a54fe743e821077434751f928601adb65936becd8b41713764292a947af42651f6f1b9dc32fb4e87536248b96fe99

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
63KB

MD5
f3c74a3b7e0adfd43a7ff9c018f41645

SHA1
d9e25561f8a1bdfb61137806b08e9f1ebd0aaf5c

SHA256
00c2681458698446d475a7b0b3568fb1049e7ce0d6b5bda8c39d85455c09a939

SHA512
a3a93be362c568a21191a78eef571edbaca8d3fc317bcf8ae11e8f9fa595a53119eff29c48cbf35de3a307b812aa8cce0f82d69a71908f434b4926ad5066a179

Download Submit
memory/396-316-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/400-448-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/456-358-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/468-168-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/776-152-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/788-566-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/820-436-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/876-87-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/980-490-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1256-328-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1260-406-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1476-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1476-544-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1524-508-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1552-418-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1560-580-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1576-164-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1604-388-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1664-352-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1780-111-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1820-454-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1848-484-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1948-248-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2056-364-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2104-472-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2116-424-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2156-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2156-565-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2164-215-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2192-244-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2264-262-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2292-199-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2380-334-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2456-286-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2520-394-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2524-175-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2576-400-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2664-430-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-586-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2672-47-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2760-340-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2832-532-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2904-496-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2932-573-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3020-460-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3052-143-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3100-292-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3112-326-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3140-587-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3216-72-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3240-96-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3344-191-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3468-502-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3616-520-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3620-594-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3632-310-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3708-103-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3724-382-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3736-514-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3760-223-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3768-80-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3812-552-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3916-268-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3936-119-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4000-39-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4000-579-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4100-478-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4148-412-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4160-593-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4160-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4168-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4192-274-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4356-135-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4364-231-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4384-442-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4476-559-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4500-470-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4540-7-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4540-551-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4596-256-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4600-183-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4620-128-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4696-370-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4792-280-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4832-542-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4864-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4864-558-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4900-572-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4900-31-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4920-346-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4932-298-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4936-304-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5004-526-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5016-376-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5040-545-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5104-207-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads