451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe
Size

79KB
MD5

5cc293c96ba369395408dc68872272ff
SHA1

6ac67d2c136321c40861fe92156f6b52e597c9d6
SHA256

451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c
SHA512

0e4bfe6a0dc3035294fe6c504990c9e457e0624d8f116a1e3db270cc56bbbd92b6f756302f8b06b7abea7c9584b1059f145d37e09b8a1fb9853561687a5d3989
SSDEEP

1536:tGvJ+s+zQeJpkoGxcRBKFUE/iFkSIgiItKq9v6DK:Yh+R86mURB8UE/ixtBtKq9vV

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkfhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfoiokfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfhlejnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnldp32.exe

Executes dropped EXE 64 IoCs

pid	Process
5096	Hckjacjg.exe
3628	Hfifmnij.exe
4276	Hmcojh32.exe
1284	Hobkfd32.exe
1208	Hbpgbo32.exe
2784	Heocnk32.exe
5092	Hkikkeeo.exe
3668	Hcpclbfa.exe
3324	Heapdjlp.exe
1804	Hmhhehlb.exe
3888	Hbeqmoji.exe
1368	Hmjdjgjo.exe
2036	Hoiafcic.exe
1592	Hbgmcnhf.exe
3260	Hfcicmqp.exe
1204	Immapg32.exe
3112	Ipknlb32.exe
904	Ifefimom.exe
1696	Imoneg32.exe
2052	Icifbang.exe
1864	Ifgbnlmj.exe
1836	Iifokh32.exe
636	Ildkgc32.exe
3780	Ippggbck.exe
2528	Ibnccmbo.exe
4804	Iemppiab.exe
4224	Ilghlc32.exe
3360	Icnpmp32.exe
2368	Ieolehop.exe
4092	Imfdff32.exe
5072	Icplcpgo.exe
3848	Jfoiokfb.exe
3008	Jimekgff.exe
3052	Jmhale32.exe
4724	Jpgmha32.exe
3092	Jbeidl32.exe
3000	Jfaedkdp.exe
3764	Jioaqfcc.exe
4960	Jlnnmb32.exe
764	Jcefno32.exe
4940	Jefbfgig.exe
4284	Jianff32.exe
2312	Jplfcpin.exe
4732	Jbjcolha.exe
400	Jfeopj32.exe
4836	Jmpgldhg.exe
4888	Jpnchp32.exe
4244	Jcioiood.exe
2044	Jfhlejnh.exe
1568	Jlednamo.exe
680	Jcllonma.exe
2864	Kfjhkjle.exe
1940	Kemhff32.exe
1936	Kmdqgd32.exe
3952	Kdnidn32.exe
4328	Kfmepi32.exe
4712	Kikame32.exe
1564	Klimip32.exe
2248	Kbceejpf.exe
3608	Kebbafoj.exe
2012	Kmijbcpl.exe
3332	Kpgfooop.exe
1760	Kbfbkj32.exe
4544	Kfankifm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Glccbn32.dll	Ifefimom.exe
File created	C:\Windows\SysWOW64\Dpmdoo32.dll	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Qddina32.dll	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Icplcpgo.exe	Imfdff32.exe
File opened for modification	C:\Windows\SysWOW64\Jianff32.exe	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Hckjacjg.exe	451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe
File opened for modification	C:\Windows\SysWOW64\Ippggbck.exe	Ildkgc32.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jianff32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File opened for modification	C:\Windows\SysWOW64\Heapdjlp.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Hnmacdaj.dll	Ipknlb32.exe
File opened for modification	C:\Windows\SysWOW64\Mlefklpj.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Ncianepl.exe	Npjebj32.exe
File opened for modification	C:\Windows\SysWOW64\Pqmjog32.exe	Pjcbbmif.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Efmolq32.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Ipnjafgo.dll	451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe
File opened for modification	C:\Windows\SysWOW64\Hobkfd32.exe	Hmcojh32.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kbceejpf.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qjoankoi.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Bmbplc32.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Imoneg32.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Ipdejo32.dll	Imoneg32.exe
File created	C:\Windows\SysWOW64\Kcdgpfak.dll	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Hkikkeeo.exe	Heocnk32.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Iifokh32.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Llemdo32.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Ldleel32.exe
File created	C:\Windows\SysWOW64\Mplhql32.exe	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Aoohalad.dll	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Nniadn32.dll	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Opdghh32.exe	Ofnckp32.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Dejacond.exe
File created	C:\Windows\SysWOW64\Imoneg32.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Jcefno32.exe	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Kmdqgd32.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Daekdooc.exe
File created	C:\Windows\SysWOW64\Fbnkjc32.dll	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Mgagbf32.exe	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Fqqlehck.dll	Hfifmnij.exe
File created	C:\Windows\SysWOW64\Bagplp32.dll	Jcioiood.exe
File opened for modification	C:\Windows\SysWOW64\Jlednamo.exe	Jfhlejnh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6820	6348	WerFault.exe	294

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbjcolha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hckjacjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jplfcpin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcfkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfjhkjle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpccdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jianff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmnldp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmcojh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfoiokfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kplpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Heapdjlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbgmcnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibnccmbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgmha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfcicmqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgagbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhmhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjcbbmif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnebeogl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdghh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dejacond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pclgkb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ildkgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlcifmbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlaegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbpgbo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmjdjgjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcefno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbceejpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbeqmoji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llemdo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmkfhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfifmnij.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgngca32.dll"	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikkokgea.dll"	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjac32.dll"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kikame32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjebj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qciaajej.dll"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljodkeij.dll"	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfgefhai.dll"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpnaemnl.dll"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifgbnlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnecbhin.dll"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnkhmbin.dll"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ickfifmb.dll"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabqkgan.dll"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kemhff32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5096	3616	451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe	85
PID 3616 wrote to memory of 5096	3616	451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe	85
PID 3616 wrote to memory of 5096	3616	451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe	85
PID 5096 wrote to memory of 3628	5096	Hckjacjg.exe	86
PID 5096 wrote to memory of 3628	5096	Hckjacjg.exe	86
PID 5096 wrote to memory of 3628	5096	Hckjacjg.exe	86
PID 3628 wrote to memory of 4276	3628	Hfifmnij.exe	87
PID 3628 wrote to memory of 4276	3628	Hfifmnij.exe	87
PID 3628 wrote to memory of 4276	3628	Hfifmnij.exe	87
PID 4276 wrote to memory of 1284	4276	Hmcojh32.exe	88
PID 4276 wrote to memory of 1284	4276	Hmcojh32.exe	88
PID 4276 wrote to memory of 1284	4276	Hmcojh32.exe	88
PID 1284 wrote to memory of 1208	1284	Hobkfd32.exe	89
PID 1284 wrote to memory of 1208	1284	Hobkfd32.exe	89
PID 1284 wrote to memory of 1208	1284	Hobkfd32.exe	89
PID 1208 wrote to memory of 2784	1208	Hbpgbo32.exe	91
PID 1208 wrote to memory of 2784	1208	Hbpgbo32.exe	91
PID 1208 wrote to memory of 2784	1208	Hbpgbo32.exe	91
PID 2784 wrote to memory of 5092	2784	Heocnk32.exe	92
PID 2784 wrote to memory of 5092	2784	Heocnk32.exe	92
PID 2784 wrote to memory of 5092	2784	Heocnk32.exe	92
PID 5092 wrote to memory of 3668	5092	Hkikkeeo.exe	93
PID 5092 wrote to memory of 3668	5092	Hkikkeeo.exe	93
PID 5092 wrote to memory of 3668	5092	Hkikkeeo.exe	93
PID 3668 wrote to memory of 3324	3668	Hcpclbfa.exe	94
PID 3668 wrote to memory of 3324	3668	Hcpclbfa.exe	94
PID 3668 wrote to memory of 3324	3668	Hcpclbfa.exe	94
PID 3324 wrote to memory of 1804	3324	Heapdjlp.exe	95
PID 3324 wrote to memory of 1804	3324	Heapdjlp.exe	95
PID 3324 wrote to memory of 1804	3324	Heapdjlp.exe	95
PID 1804 wrote to memory of 3888	1804	Hmhhehlb.exe	96
PID 1804 wrote to memory of 3888	1804	Hmhhehlb.exe	96
PID 1804 wrote to memory of 3888	1804	Hmhhehlb.exe	96
PID 3888 wrote to memory of 1368	3888	Hbeqmoji.exe	97
PID 3888 wrote to memory of 1368	3888	Hbeqmoji.exe	97
PID 3888 wrote to memory of 1368	3888	Hbeqmoji.exe	97
PID 1368 wrote to memory of 2036	1368	Hmjdjgjo.exe	99
PID 1368 wrote to memory of 2036	1368	Hmjdjgjo.exe	99
PID 1368 wrote to memory of 2036	1368	Hmjdjgjo.exe	99
PID 2036 wrote to memory of 1592	2036	Hoiafcic.exe	100
PID 2036 wrote to memory of 1592	2036	Hoiafcic.exe	100
PID 2036 wrote to memory of 1592	2036	Hoiafcic.exe	100
PID 1592 wrote to memory of 3260	1592	Hbgmcnhf.exe	101
PID 1592 wrote to memory of 3260	1592	Hbgmcnhf.exe	101
PID 1592 wrote to memory of 3260	1592	Hbgmcnhf.exe	101
PID 3260 wrote to memory of 1204	3260	Hfcicmqp.exe	102
PID 3260 wrote to memory of 1204	3260	Hfcicmqp.exe	102
PID 3260 wrote to memory of 1204	3260	Hfcicmqp.exe	102
PID 1204 wrote to memory of 3112	1204	Immapg32.exe	103
PID 1204 wrote to memory of 3112	1204	Immapg32.exe	103
PID 1204 wrote to memory of 3112	1204	Immapg32.exe	103
PID 3112 wrote to memory of 904	3112	Ipknlb32.exe	105
PID 3112 wrote to memory of 904	3112	Ipknlb32.exe	105
PID 3112 wrote to memory of 904	3112	Ipknlb32.exe	105
PID 904 wrote to memory of 1696	904	Ifefimom.exe	106
PID 904 wrote to memory of 1696	904	Ifefimom.exe	106
PID 904 wrote to memory of 1696	904	Ifefimom.exe	106
PID 1696 wrote to memory of 2052	1696	Imoneg32.exe	107
PID 1696 wrote to memory of 2052	1696	Imoneg32.exe	107
PID 1696 wrote to memory of 2052	1696	Imoneg32.exe	107
PID 2052 wrote to memory of 1864	2052	Icifbang.exe	108
PID 2052 wrote to memory of 1864	2052	Icifbang.exe	108
PID 2052 wrote to memory of 1864	2052	Icifbang.exe	108
PID 1864 wrote to memory of 1836	1864	Ifgbnlmj.exe	109

C:\Users\Admin\AppData\Local\Temp\451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe
"C:\Users\Admin\AppData\Local\Temp\451b58a34ed4de3f0161f251463d21faa0a69a0fa1926b4afff7657a45853f7c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\Hckjacjg.exe
  C:\Windows\system32\Hckjacjg.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\Hfifmnij.exe
    C:\Windows\system32\Hfifmnij.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\SysWOW64\Hmcojh32.exe
      C:\Windows\system32\Hmcojh32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2784
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1864
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        25⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        27⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        28⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4092
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        32⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3848
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        34⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        35⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        37⤵
        Executes dropped EXE
        
        PID:3092
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        38⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        39⤵
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:764
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4940
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4284
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4732
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:400
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        47⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4888
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4244
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2044
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2864
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        55⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        61⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        62⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        63⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1760
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3100
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:548
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2304
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        71⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        72⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        73⤵
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4772
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        76⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        78⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:116
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        80⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3860
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        82⤵
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        83⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4112
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        85⤵
        Drops file in System32 directory
        
        PID:1264
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        87⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4780
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        89⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5112
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        91⤵
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        92⤵
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5108
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        96⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        98⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        101⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        102⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        103⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        106⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        107⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        108⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        113⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        114⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        120⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        121⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        122⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5600
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        125⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        126⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        127⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        129⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        132⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        136⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        137⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        139⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:5824
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        147⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        149⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        150⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        152⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6360
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        155⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        157⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        159⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        160⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        161⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        164⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        165⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        166⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        168⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        171⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        172⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        174⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:6384
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6460
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        180⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        182⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        184⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        186⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        187⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        189⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        191⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        193⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        194⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        196⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        197⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        198⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        201⤵
        Drops file in System32 directory
        
        PID:6212
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        204⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6348 -s 216
        205⤵
        Program crash
        
        PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6348 -ip 6348
1⤵
PID:6380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
79KB

MD5
d4ed9afa20540be91c64d6be6a534b45

SHA1
05c54b4a6f04fd1a39746f34ae5e36d9ac2007db

SHA256
192eab2ca6bef358ad1f66726d7d243cf7327bd5f116d498e434b302268d33e9

SHA512
72bb2a22e3455dd5d16078e33c05d59d346d51b149a1f236903c875795f14a5f3655c142f902304ae1eaccf23b89b1d244568cdb7cb22bc851329609168082b0

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
79KB

MD5
e098f23d733f099143fbbf2970f93c30

SHA1
b9fd9f021338c9b48bab9f8c03d822ad7c1a8fc8

SHA256
cab5144e9e444fd008fde49acb003be0d0ea4a73d07447f00da932a7fcf44c90

SHA512
a87fb4bc7db764c3c60ac2f318e6c961ae397725a80713146201581d7b3f87627c2fabab53420b03d511950d6a80e717e09388971039566b8781857449ccc152

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
79KB

MD5
34cbdf58e54b024cf038ce2c7a02a838

SHA1
21b91619ae9f0606bb8d7f9eae42b8f4fb5525ac

SHA256
cba108edd25f105f8cc3c2db08ec950e955452bf6f2ce77f9757ab700f91e017

SHA512
c2fb79dec608620ad52cb3602b89609ce5098b8da1463e8d456144ec708d4c30dba34c1273a8008c63374daf7cab311a02afb75149c353420076b9c7b8e78f8d

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
79KB

MD5
d6dec000a6e14851c74545b385c19000

SHA1
79277e60cc2f847a92919bd13fd7432b599e08dc

SHA256
f9a5451684833e516894ac85a0a698474efd2853aba31a96a674d209d5de4661

SHA512
6a088978ea0c0e8dcd789475cf57a848b7dbf702343863ad76ead36a5bd7919b4d639ebd05b8e7a535d330e5e10be6304c31ed7ba6125837ea877de96bf3fc5e

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
79KB

MD5
1ae270c31698c07218850aea7bb88a29

SHA1
a4e457493e9521cc969721773a7c0d9d60f468cc

SHA256
4fcac928797ca691c2001881dbfc1c956f5ac065a6bb6b2b4822310c434a2dab

SHA512
5fe5389225548a0a1f27debe04db20458bc3771626a971287f6fdff19cc932b1c93d1db4c4e3e9312939b4b22828624dbc265df0988ed32a45ff10e43c8c07e6

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
79KB

MD5
a5c729f8f636e1e66f6ffe8e06ce0f21

SHA1
f63ff8ea565840abf8e550c124ecfbcf1389e99b

SHA256
81658faffb9b4424f57b5e7a5a2c0144447254285dd24c2f5caddaad668a0543

SHA512
93e8e0ab5c384d375dd2758b6854069cb570192a2e438eef7e51b7cef9e7f2bcc658f0265d16eb2de085d75368eba935465a655b2f315e37f89b2cec69bdf8af

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
79KB

MD5
b19dd088aa9d3ac00bba5c055642b20a

SHA1
ddf1b34e75c0771d5e0ad6022186872c8add9d77

SHA256
db908379c3b4faf22d643c0a8cf3354817eca1e708a383572c306fa934a361bd

SHA512
96070eacb6c41c6584547166c6664b206f61bde62d3dffad67402bb4a8337edd006a8d3e261bbae983d23262dc475d2444c3f9d844f3a5766ccdcb0f4d124cb8

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
79KB

MD5
61e94183b1612a10ede676374e6ae495

SHA1
811f7fa44b5d54f09bb3aa390df8a443e2ea2e09

SHA256
7e093c526aa3301de65fd3b015dce065595ac75a66ede079521adb428357d7e4

SHA512
df9aad01d905d50234abc29e551e4e8b59b638bc1fc7c2b2772563ad8bb619ac04193a17913efc19a5af0fd829d0bbb9e3cbdd25e3f5e6d59d995826f0c30b2c

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
79KB

MD5
da721bd417043f7ec2d217fac0cfc537

SHA1
123888e05831ea3adf8fbbafe7758f082d01ede1

SHA256
d79582ca840f1132ff7268f6976382257d2c38e9b03d3daf5ab604bacbd8eac9

SHA512
9ad7284148e835aa4bc29e0bb2103b1530562c2cc1d72cf9a70dc8c2ec52d0be259f4e4752ccef7be10833b58b33a091df0bf10b561efd0e20d014e6f783545f

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
79KB

MD5
43cbee994921d6a99520587123809435

SHA1
08603b3729c7c540e82a7a8e89c2ff3f35fb5ab7

SHA256
7718141be8cfcd86620ec35106bc8ff531b340e3bf0fd18feef8e9af132d4a86

SHA512
eeeabfabb96b8517ad7d0388a2988a663b919bcfa3603c40f8653e377b740eb36a38d9c9ddfec642024b562d388f6ecad5f90729db27193f84663376748bd27b

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
79KB

MD5
fa5df0be861ad0e08f6f7545dae94e37

SHA1
5c530f0f1fc596e9e953e44f20dfcefe116f7e57

SHA256
e9aaf465b779f7f11420a9439e4c34a3433ae84467509be993d041f6085b141f

SHA512
f079f810df8c90526161f9ce30a642e80c4b84966e08088099a6e589d5a88ef5f9ff8aa077a6c7193d43f944fa86f3bfa4017b74cff6dc894e1c964d087cb316

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
79KB

MD5
59c39f431cdccdecb38a17786dab27ba

SHA1
b0500b8828640c0e7ec54e44cdeb4453dc6a15d9

SHA256
95a7a254ea8d098f471cb06748dad50d55ba46d93b9ab010577b0767602a8998

SHA512
b8ab28b9b5289359717c4b0b2b239fed437e807e8bab6cd5c5fddcf518dae9dbbbf007f540cde1eea2a311ce3daeaf7d44afa1b4510826a4f6c9dee713731a5a

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
79KB

MD5
7f0580db8dadbb0bbea7999dd73426c8

SHA1
b4e40d405cd76e4401b02af1d3f30826ec559b77

SHA256
feda6e23ad91ea0c8db881df2eb9476c470947248f4ae9b53c5aa50fab8516b8

SHA512
565009f93fbce7baaba4dc972340aedf6345ef594af608027f9c4de5cebdd09a978359765e6ec3bf6fa023b5c5757d3c8cc0116ffcc5d0e64602d916ceaf4f0d

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
79KB

MD5
db25ffe41b3981cdb445eec3433796c2

SHA1
1b40181c891ab11cb3355c03356b03ad18e9b196

SHA256
50a4dd1897140a6ac7dae2f35e957a8b0b74ad36852fa8f5a899c9debdeeaf55

SHA512
95c072d692c96a05082bf2513103053a163d56e8cdd6c96e5ac8779291d1a65b7514c9de1ffbe0d8b53f93e544fbaa0f96bffe284ba3f4acf84155ffcaaace10

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
79KB

MD5
93fc379f5c4e71ab6eefe4cf0a0cadf8

SHA1
43fab0fe38cca3ce8a82a745b4d39e4ed47fd96e

SHA256
89d5b55540135aa4e3087124fb9b66299215519e76b6835440a564d70dcab90d

SHA512
08899f312adb13bd835c97cc36b0a7ee0c01fcaf4fb794f4ab5a3c97ade0507c41902a9fd6341b74684d6df9c1a4120d31b61160b2d092562638c7cdcc5f91d7

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
79KB

MD5
03c5697319f22b36a4940fc4cee3c03b

SHA1
51d516f6532943d5f28a58aa379349783e060709

SHA256
55e485f6bee924597ed03a271f7dcc941b23205ac71440918586d46f8b6cf29a

SHA512
b77e8aac824f0d66ef4e0bbdb21f67e93a3231d35e629ee382667642a2a31c8a6ab79576be0c132dbf2da248f9d6054b31bf6e0bd474c33d5349c6fb5559b81b

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
79KB

MD5
21658c178c2a9fc0a144728b3705bea5

SHA1
6976f70c3b91e0dca61cfbfdc58a3af2beb087dd

SHA256
2bcfec51a0a7c6353819a9f9f7eb4260a83b2ca2d60270ab0e138f3b69efe009

SHA512
30cf5b07fac4625687b1e29cc4acb1c08c657ca27e09aa3f848a001a69e8abaa5482c01eff8b8d9194511eeff9624e6cdb3f019d9ddf2eb3be5e02437a987696

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
79KB

MD5
b0965529c7afceb6251cfb1656c1928a

SHA1
8cd5570cae1be2d21992a767b5305031c40cdbd7

SHA256
1443a9f03b97e615b4cf3e8215808a6504506fc52bd316c2107fcf6b4106cf22

SHA512
1963f47d17ecac4b27c9fb5089506ba6fc2517efac9a5cc80f20afd247badee4f42982058cbc6783728d92ead4269d749afb9dea2f3dec9fbdc19d85b350782c

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
79KB

MD5
cace95f780fbda9db0a49336c305f833

SHA1
25fca6ba2051e3cbba4d1c7b994cb90592e99c2c

SHA256
c0d18028743ecca469e0ab1f6284985f781afbe7e0a7f3c785d257a2f48b1419

SHA512
2e25bf3e85cc8cdd827f9bd9ec3ce86e4578154365a6f9d2e496c31a00007f079554d5086b311936c50cf1e356e66c038313a1cf5cc565296084f13c02064b57

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
79KB

MD5
dd1db8705ecb246d70956d7cca98cd2f

SHA1
f13e7bc9b259bd45e1c9897c8d10ede189a417ba

SHA256
9e0964efe945f4e33c57372602dca7a5193bc80fe8b134155d6ad374d147953e

SHA512
f6652ba9c8e372c4a95f6b83b1f5a72338b35fdcea44a07f8f8fe18851ffae0e9f680a0829c47e11fdce26dcbb87b557da3b855005d1a665a8c16dc0e81f201e

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
79KB

MD5
3e50626c9a197186bf2237a0710f2f56

SHA1
d30c57b51857c6c4596d72260963fe0f2f338233

SHA256
3c67bf5f34b2c05e6c4496b0e38d0effa0e0809830f39fe5d442cb4328492b62

SHA512
d134fdfa78f4eb90be0b78adc855a23161c42da6995406f952cde481ead02c072747b8b5b8e4bc0ebc8f81c1dd029600bd8cced5d314599885c476eaa5009493

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
79KB

MD5
be0ec7c4a3908373a8ab6c6b776f96d7

SHA1
d26c75541feb1b12e87393cfb15f2e55338080e6

SHA256
803e41069ecb4c79efcf81de2513ab791ddc2b555fc15d8ce5dd530676cfe6bd

SHA512
e5ec9d2d71dc3b82420cfeba9d4619eebc01ed887141f3706ce16216eefca4cb43cf7351730f86838e913272ab2c2b9eb1f05e86a24000ed04b46ceafab10ba7

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
79KB

MD5
f68cf0ab203aec63c0b5ab24a7ef37ac

SHA1
9d437fa5a4f33ddb3c62a72b1ef5a17517876ea0

SHA256
a99ca3b3c37dce924c561c2cd9cd7d85785faf5057e2c9cb1a73e6c9c9d8eaae

SHA512
45bc5df716810520e0134e0a4c6374e23321daa9f3c74d58e8a3008021719a7fefd7640342d33253315d22f70af8e40c5a62646d4b07ae244eaa280eb2d7668d

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
79KB

MD5
c48f32d4a78e8960f1b724f10178b928

SHA1
4bddc6459160964ed72dd2b71887cf137b5f98a0

SHA256
e32645c881e737d9fc87e50b2824977d8a65fa038ae5bf3c6baa521cba991e7d

SHA512
4d56069b52f37ddb7ecdcf845f704720c496ff2d99f3faf17ea600c804d698421773bc77c9c3bec329e3b3a0baba020d52382238ff69844d2c5ba9a908424505

Download Submit
C:\Windows\SysWOW64\Hoiafcic.exe

Filesize
79KB

MD5
4360e2487c209ee360b1450c65816e88

SHA1
846d35ae5e3076cf0790d139249f1517df1ba206

SHA256
20f66222dba9d6bd14284da5d398b55909ae0da98767dfd83225bc9e85976722

SHA512
aa96abab28dcc2e9363df903db38b756252f966cba903323c8d7351a1b3a683ad157492c3c6a60f1b97e1787efdd120e21820a8f13c177f55a4f11c0aab4ded6

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
79KB

MD5
775ad256d5d7393abeb3f68f997701d4

SHA1
6b217f2a51bdb8105c5040d00347a2e82fb61ca4

SHA256
b8fba1da3ad86e250ba425d9d55ef71614e8ce8c76ca7eed22f64181911b18fc

SHA512
2ae6e44113663bbab76e2b7251a7f597b20e5f2f11b1caa9323f6d66cd47f73192512ff74722b6f21efd626ec31af292eef6927e050b2c18f812186b7bd200df

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
79KB

MD5
3b55ad33fa3d39341fcd1a56666ab7ee

SHA1
270539cda357580b3b629800ab362f5a1e239289

SHA256
053aaafe9993566223c97b140b43b54aaafc47bd8de17f0bfeffe24296f4f276

SHA512
e226cc706af4f623a9488d838fa59daac5216ea99d1544d75bc2c3497ac809987e635fa676dabf3e0e0aa064e2c9c136eb498643cccdc46660addd1eff124d2c

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
79KB

MD5
fa3ae33a5e8441ead3a12668e4f2b125

SHA1
89b3bfdfadbdf8e0576ba0031926920e40f9db61

SHA256
d83273471f70bc7184682256374e88f44a598e35e221845b475da50d138fb9cd

SHA512
dbd9d2314a7acba384e39dbff5c63cafe99ff26e07582f34e3e5d6bdd25b7782a86b7dc367cc45f0c768dfcadac5a255108fd205db3b4a31e9d81c0c65924af1

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
79KB

MD5
270c82519786cb0a1f6ed77455a7be9e

SHA1
7ad12ec5b8d68bef7261a24666fed98985a58ca7

SHA256
1bac32a9a1e41bdd4a491d3960352f24e31b3bebc4c7b5efb58b571ab1c23068

SHA512
1350d7ebf3dd3401fdebca294097213510b8de5496257a47a7da9d1b4d1f22d8e748b1aa2953577945d84cedd750127784f89ef6358a91faed4c26f5bca095d6

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
79KB

MD5
efc9a8d47c047c450db0f74fdabc6100

SHA1
75fa1a1a39415ab7c96f6f451d90c13c09fb4a96

SHA256
04898999988770ca6a9fe0bb175fb0adc58163496ce7b116f79ebf97e1544124

SHA512
d614c85a57f424218a0f6382767db0db6cd3f5627edcfbe7f1ff50b5e65a000d52b1fd3950a2522d2d522b31914e49421a59eeb2d06a9e344f33a400d47506f3

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
79KB

MD5
4a1915a57b43134263abceccb1819c3b

SHA1
e01c849f40761df6adc4ce4b53f9edf4a39db821

SHA256
34318d413b6319cbfa55bc24ee706de2157edc58fc2634c079b571bd0e0b9136

SHA512
1bb02704e55eaad89ea598dc4ab913b13500dc3eb3212c1c8dbeaf6fc1796c0f0cba8f08b5478d61ab83941c2e26e6dec5ebfb4bd774ca998470a3dee32fcef6

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
79KB

MD5
87a34b7c5a36246a8f05123721ed36d6

SHA1
2045fa33ec96ffa60f9cabc129b24a941b1678bc

SHA256
295ea373ae1f5aa85e9e82df311a5e7b26d32f3d9958a19cacb62f17939f6ae4

SHA512
9761952184e7dc7799aa4d0088ed88801a9ab35a547d511024238ee83ee57fe6a2a171f1dad393b64e20215afe237e57a663ab244bee83f58d9ad2111c64f57a

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
79KB

MD5
3a594ec2753ad47fe7795988d1ef8ef6

SHA1
4c2159990f59a42e79e874b34385a060c2c4e402

SHA256
8e24cd5446e940f4629c77e040854f9c1d94a2db2fcac16e146f86d2be350aa3

SHA512
e9e6f3b95a25387cefcc9cee579aa6981ae72507538ea124813b21d3c4d98f310a46be31108e1d4ce36e8a5c28732a7b53980ce025764a0f4d1ebdc1af8b7f13

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
79KB

MD5
dee7e896ec40f9e382a7e1e9760bb72a

SHA1
7a070ca4573a4f6224f687eb2f01c39a560763f7

SHA256
2b9f1e852de0a4aec87f5d26207faf64adb3156775d532b93f276bac25e9c875

SHA512
14c754ae11b5adc8b283259ff4abb6d038304f2875e917933b9b3e67974ff2afb49888a0fc293992a163436c1d39fa249d78003a32379b179a1f3aa1c6949e8e

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
79KB

MD5
5a2ae5d3573c39de4a64306439e47f63

SHA1
36404013153d1ad81c99403d5f6c329570fce255

SHA256
bc1d9daf7aa9dc0723c85fd2a5365f1988d849ece1e6fe53ad4e7843490383c8

SHA512
30c61ebe48d6873aeb31730803e94b11ee0b1e71349e03e5810e2c75e48d65fce601e6b03dfa07f6bf067f60718cd82d6d15d3a35410fce8aa69c2563082f4ed

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
79KB

MD5
2acd407ad22573fac8806df570d86950

SHA1
4dc2ecffc5fb73506eab680686f4a43ccc81349d

SHA256
e59ff7b0b5d8681ee1a228714949810f152c6230d58fb8d972459b41b80f5c9d

SHA512
aa27b7c71f4d975fd49b6492f16e4b9e486090e13d9b2983a6e44cd69ef9b161e3e1c02c991a2aa3732809df654ad014eaf155f890be3562842eac8e0f85de0f

Download Submit
C:\Windows\SysWOW64\Imfdff32.exe

Filesize
79KB

MD5
e55d046a3a9d4cc07ca6a27aa847ffef

SHA1
e2c1631e9cd739f88f3cb0f4b2e38d837e23f4c4

SHA256
549f524a2d3440919dd6ab5092e8623ccf1a94d7be1348b81d99745e4136e36a

SHA512
2c963c6fc61702abaceb88e1fc53aa16968308153f9523ab7219665933e6ff1f6b581a085d2dd401e6f2998069f6f07c882de840e90aff1b51316d94d540192e

Download Submit
C:\Windows\SysWOW64\Immapg32.exe

Filesize
79KB

MD5
b624aded1fdeeabacd88063f10512dd7

SHA1
1314bb54cf836a97a9b7d95aaf168e2cbec74d44

SHA256
0fefd2b4ad1b7d9d02f2f04a4262a77c8532f835b090ee60effe7726da10eaa7

SHA512
c2bb4c8d35f7c51f30cb8df0306fd83898af370a52cc3d4aa99c699cc81fde1086b9fea27a7250ef1006c1bf476234e5fbe059338d04c0727af7618750b042a9

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
79KB

MD5
868b37abfd8b764fb45e566eec8d6e78

SHA1
a22e4670a97d76354661e398026eae885ed3c349

SHA256
cf2bf6df58330317735a0272cb46f45efd17c1afaab56f4d6b509146d81c3c1e

SHA512
f3a13402749f3b50f6df4d9d7dbaa51099ee7f0dc39823b884bbd34b1043367963cfd855dcdbceeec27de54be0d08dc89fa8b977a05aac846b5ff9619b144982

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
79KB

MD5
08b785beda7d27b211306d3bae8601ff

SHA1
f037c55795ca823616962f2df9b964e47321d5a7

SHA256
0be0437e3851644bbdc3545153f4bfbeae7f138f8f14c9d0a17bc440fce205ba

SHA512
d5d6c41fcad1b692f8ae6c94b09381c1a1a6da1f6e8def17e2463d5a932d3e3e238684033f602b1cc01f2e18aaf55724da2213f376e7f754ebe64458f9ad73fc

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
79KB

MD5
d70133604641ca9d681b4a5aa0cb700b

SHA1
ebdab150cf026e7be047b8bd3cb29de6d335acf9

SHA256
094345412a1a4cb95ed9dc24c91d0babd48019babf8d7a5630656a7c42d8f89c

SHA512
b51e9341bce0e980fcd5f9f82a2b34bda18f8462343f6c2b079ee834a697b354eed05c6ec4c9deb3e959f5dec113ea12be906cb1cae8a55b46412dc72abacc22

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
79KB

MD5
906c5cf096efa711344efca7d80ddf6f

SHA1
fc1f77ab25c146feb9fc7db1b8d1f5bbc655be35

SHA256
b14ee4bc6b790208435dcaa6e53330a40e9aeaa01d8a16692daab2bd440100c6

SHA512
3c9cd98ac4551bee0b1b42cf29a6f8510160ee64339f3d902b88450c3d0da1bf301fc03e19874d0cbce11dd5fada3b0963ee419dec075910d28c01efba503a41

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
79KB

MD5
dbd5cc0074d13e2c42f4db54ba838883

SHA1
1123cd130ae14ed1a069e3be55c922d67046c0a2

SHA256
e630746508580381762ecc78dd4ec0c958cc61a91bf08b564d90358824875556

SHA512
cad425db0080172277d668da4a7f84d5716029ff8bd5c9739c04f107ae4fd7badb6158866ced2ace67f0aaf3db564e211b64a8eae752a290961befcfdd04b301

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
79KB

MD5
f4ddcea1ce67628df18aae2e75ef6f2a

SHA1
34086c19f8dce689697c3396f771174fb0109c77

SHA256
64b105992cabcef9730f78d1c36971cc0fa81247226d2ff34da0253f97b8747e

SHA512
efdb90f0a404ed8c95dbbcb4e4c38219fabfa34ec75d09f203705f4ed6fa853a15ad0025d6b5d713941d417f2c709e44fd649f35b55316e6b99630687e67cf62

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
79KB

MD5
d43d144c14effeab482c62e6afd2e0d0

SHA1
8be8ee8c9cfd5c3f33c825b1bef608568b419cae

SHA256
7a1e1d02b3ecfbe732e6f6a1bc3991d6ffe6018d718b653c23621daefbbc3696

SHA512
393ce77349cd15629aa4a72ead35c254b06870adbaa28b1c0fc36b142c0c22c8a1d06c21f3d17fc702132a223a2fd8c0066861e645a5e80dd32ca2f1f452b14d

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
79KB

MD5
24cf0ce1150ea53c0f45d1f4816de7b1

SHA1
34b172f19c062b5abaae05105c22fb8957330f01

SHA256
a2ad3e66c5af288aa83727ad0f8c1cd788d0e3f732f82fddc3cb33baedb9da86

SHA512
3f69e72524f292075862de6e7d8ae6dc3f6bf7f1c331bfde6898acce437610ea17a6a45a3e753389a56653e4401b0b3ed363ed606d9a5d99c704e10ecf8be599

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
79KB

MD5
0c0a367fd8ab84f2d45540b62f6bde97

SHA1
684d6a753c0021759f7c09a6d51dccae2f46b3ba

SHA256
bb12d14634407e7fc506f1da550b588a33ca7277183c79c78dc273a4551766bc

SHA512
ed84b7144c9afd771cb0b7251efa1f362943e49528a91f656609ae06661df741a7df6b79594bc1bf8c199b2da4d211c462bba0cb6ac580a1abf89f5bc683f119

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
79KB

MD5
108f6cf2385e6b66223862cb1d68bee1

SHA1
cabfeb58bc52c9e787e707d0b579a32d24b00d87

SHA256
7db841d1d78cd6ce57ab088bd51272c1377dbd09cad79fd19c71a324634b4546

SHA512
6c357a092f2eeef6485c557ca47da03bdc50daf9502079cfeb1123513356ae9b3ee6588926a94a336bf44fe40c4fd717b8cb1584386298b4a08bd5fb81ff03f5

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
79KB

MD5
8c6f475f7d0dbb611ea722686b96cfd1

SHA1
cdd984c797e64b8afeda85b0c96b92c316b2ad3a

SHA256
21cf1e4c8b567e45a154282b1d170c5260bab8d368ae2f6ebcd5ce6d5c9e1b80

SHA512
5ded4a46e9fe4323d0377a8682ee89a0298ee8ec5e7eb55abb58d94832c8c9bccb5e8acc30c724186ba900bd529b94688acc4d23d66494db77b0bf9eb272f82b

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
79KB

MD5
c205b12ae786278fe10d7a3d9c062717

SHA1
fb305e07654f6d179a4d5c4dcb64bb669b0fe4eb

SHA256
fc9b075c1aca959efaf78c24a47608c0e1bd47d8ba28ae74a870c1d1c9c5e29b

SHA512
343f4125896c18493ca4b75fb8423b8f2a96326b308468f7f02afb06c63b2a71680d59c5e1aa67f043535ac35ee79ac0a021fe08e183e8edb0095d3a3b4db9e1

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
79KB

MD5
d4e1cc838a31409b62ca0d76ad01abf1

SHA1
489209941f8e38df623d3626d597ebac71c8c404

SHA256
99fd9388323d94d0d19d9f093351f5ef710d9fbfacb5e1e0378edad261b903bf

SHA512
bef4381059407f007822b899e076ffd3c1466186d8ac3258c57c2c38b6ffc1dbe9749fb73180bde5e225e33377683a2e475a3f9aef164df4b921ce420cc2c308

Download Submit
memory/116-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/228-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/400-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/548-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/636-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/680-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/684-588-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/764-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/904-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1188-560-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1204-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1264-574-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1284-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1284-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1340-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1368-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1564-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1568-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1592-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1648-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1688-581-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1696-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1760-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1804-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1836-180-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1864-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1936-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1940-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-431-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2036-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2044-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2128-553-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2248-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2304-482-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2312-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2528-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2784-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2784-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2796-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2864-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3000-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-267-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3052-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3092-285-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3100-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3112-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3244-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3260-120-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3324-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3332-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3360-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3444-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3608-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3616-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3616-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3616-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3628-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3628-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-527-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3668-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3764-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3780-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3848-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3860-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3888-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4092-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4112-567-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4224-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4276-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4276-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-513-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4544-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4712-411-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4724-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4732-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4772-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4804-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4836-344-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4888-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4960-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5072-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5092-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5092-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads