3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578

Analysis

max time kernel
115s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe
Size

93KB
MD5

7185b1ffca82b78499653e8f5dc75990
SHA1

f548ae77cf1fd2d8d99a620ef27ac97407e2b9d5
SHA256

3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578
SHA512

3b6f2cc6d4e69e4744cb106edcbcb042e568c3823877d41b67f74afb4fd12710af83097ef7d4e4cd25e098342ed9729351a548cff0e922f759537f5df2fbff42
SSDEEP

1536:BwG6c3e8KJE3/9p2xzPyEYm7UpZobN76Rj7kqJHsRQMqRkRLJzeLD9N0iQGRNQR5:Ci3e8mE3/9IhPyMtbYRjseMqSJdEN0si

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcabej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlcidopb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfnjbdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecpknke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qmanljfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpgjpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlemcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Moefdljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncjdki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Namegfql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncmaai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbbgicnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qejfkmem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Abpcja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Maaekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mhnjna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfonnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abgjkpll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bflham32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkocol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nhjjip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pomncfge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdnebc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcoepkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nakhaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nefdbekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofdqcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piceflpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mcfkpjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nchhfild.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dipgpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmhkflnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aioebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odbgdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohhfknjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pokanf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bikeni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mddkbbfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Namegfql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfakcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmkcpdao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bfoegm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cehlcikj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mahklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbbnbemf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ohcmpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbljoafi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcncodki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdpagc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleqfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mebkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndnnianm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oomelheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bliajd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bedbhi32.exe

Executes dropped EXE 64 IoCs

pid	Process
4364	Kbnlim32.exe
3096	Kdpiqehp.exe
4028	Lkiamp32.exe
1664	Lacijjgi.exe
804	Lhmafcnf.exe
2032	Logicn32.exe
2140	Leabphmp.exe
404	Lhpnlclc.exe
932	Lknjhokg.exe
64	Lahbei32.exe
4424	Lhbkac32.exe
1792	Lkqgno32.exe
2620	Lefkkg32.exe
3036	Lkcccn32.exe
3672	Lcjldk32.exe
2264	Ldkhlcnb.exe
1124	Mkepineo.exe
4496	Mclhjkfa.exe
2116	Maoifh32.exe
2440	Mdnebc32.exe
1632	Mhiabbdi.exe
3048	Mlemcq32.exe
856	Mkgmoncl.exe
4500	Mociol32.exe
4964	Mcoepkdo.exe
1608	Maaekg32.exe
3936	Memalfcb.exe
4152	Mdpagc32.exe
4280	Mhknhabf.exe
4212	Mkjjdmaj.exe
1036	Moefdljc.exe
4476	Mcabej32.exe
2328	Madbagif.exe
3000	Mepnaf32.exe
2852	Mhnjna32.exe
3584	Mlifnphl.exe
700	Mklfjm32.exe
4172	Mohbjkgp.exe
4244	Mafofggd.exe
2460	Mebkge32.exe
1496	Mddkbbfg.exe
1308	Mhpgca32.exe
3900	Mkocol32.exe
692	Mojopk32.exe
1232	Mcfkpjng.exe
3924	Mahklf32.exe
3964	Mdghhb32.exe
3152	Nhbciqln.exe
1680	Nlnpio32.exe
3468	Nkapelka.exe
4932	Nchhfild.exe
4148	Nakhaf32.exe
1588	Nefdbekh.exe
2344	Ndidna32.exe
2932	Nlqloo32.exe
1968	Nkcmjlio.exe
1584	Nooikj32.exe
2160	Ncjdki32.exe
4340	Namegfql.exe
1880	Ndlacapp.exe
2376	Nhgmcp32.exe
3428	Nkeipk32.exe
2836	Ncmaai32.exe
3068	Napameoi.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mklfjm32.exe	Mlifnphl.exe
File created	C:\Windows\SysWOW64\Cifiamoa.dll	Mebkge32.exe
File created	C:\Windows\SysWOW64\Bhejfl32.dll	Mkocol32.exe
File created	C:\Windows\SysWOW64\Ndpjnq32.exe	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Boipkd32.dll	Bihhhi32.exe
File opened for modification	C:\Windows\SysWOW64\Bpgjpb32.exe	Bmimdg32.exe
File opened for modification	C:\Windows\SysWOW64\Ldkhlcnb.exe	Lcjldk32.exe
File created	C:\Windows\SysWOW64\Cieonn32.dll	Pkklbh32.exe
File opened for modification	C:\Windows\SysWOW64\Qckfid32.exe	Qppkhfec.exe
File created	C:\Windows\SysWOW64\Bcicjbal.exe	Albkieqj.exe
File created	C:\Windows\SysWOW64\Bbalaoda.exe	Bcnleb32.exe
File opened for modification	C:\Windows\SysWOW64\Lhbkac32.exe	Lahbei32.exe
File created	C:\Windows\SysWOW64\Ndlacapp.exe	Namegfql.exe
File created	C:\Windows\SysWOW64\Pkklbh32.exe	Pmhkflnj.exe
File created	C:\Windows\SysWOW64\Bfabmmhe.exe	Bbefln32.exe
File opened for modification	C:\Windows\SysWOW64\Cleqfb32.exe	Cifdjg32.exe
File created	C:\Windows\SysWOW64\Dcmlbk32.dll	Mkepineo.exe
File created	C:\Windows\SysWOW64\Mdpagc32.exe	Memalfcb.exe
File created	C:\Windows\SysWOW64\Flekgd32.dll	Nfnjbdep.exe
File created	C:\Windows\SysWOW64\Oljoen32.exe	Odbgdp32.exe
File created	C:\Windows\SysWOW64\Fogpoiia.dll	Lefkkg32.exe
File created	C:\Windows\SysWOW64\Bhalpn32.dll	Mkgmoncl.exe
File created	C:\Windows\SysWOW64\Jbkeki32.dll	Mlifnphl.exe
File created	C:\Windows\SysWOW64\Ndidna32.exe	Nefdbekh.exe
File created	C:\Windows\SysWOW64\Kpdejagg.dll	Nlqloo32.exe
File opened for modification	C:\Windows\SysWOW64\Nkjckkcg.exe	Nhlfoodc.exe
File created	C:\Windows\SysWOW64\Mdnebc32.exe	Maoifh32.exe
File created	C:\Windows\SysWOW64\Mcfkpjng.exe	Mojopk32.exe
File created	C:\Windows\SysWOW64\Oohkai32.exe	Okmpqjad.exe
File created	C:\Windows\SysWOW64\Fldqdebb.dll	Qkfkng32.exe
File opened for modification	C:\Windows\SysWOW64\Oomelheh.exe	Ohcmpn32.exe
File created	C:\Windows\SysWOW64\Mohbjkgp.exe	Mklfjm32.exe
File created	C:\Windows\SysWOW64\Kefjdppe.dll	Mohbjkgp.exe
File created	C:\Windows\SysWOW64\Nakhaf32.exe	Nchhfild.exe
File created	C:\Windows\SysWOW64\Ldkhlcnb.exe	Lcjldk32.exe
File created	C:\Windows\SysWOW64\Mcoepkdo.exe	Mociol32.exe
File opened for modification	C:\Windows\SysWOW64\Mdghhb32.exe	Mahklf32.exe
File created	C:\Windows\SysWOW64\Ohpcjnil.dll	Omaeem32.exe
File created	C:\Windows\SysWOW64\Cimhefgb.dll	Qmanljfo.exe
File created	C:\Windows\SysWOW64\Lknjhokg.exe	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Lcjldk32.exe	Lkcccn32.exe
File created	C:\Windows\SysWOW64\Oahmla32.dll	Aioebj32.exe
File created	C:\Windows\SysWOW64\Bpgjpb32.exe	Bmimdg32.exe
File opened for modification	C:\Windows\SysWOW64\Lhpnlclc.exe	Leabphmp.exe
File opened for modification	C:\Windows\SysWOW64\Pomncfge.exe	Pmoagk32.exe
File created	C:\Windows\SysWOW64\Jknmpb32.dll	Pomncfge.exe
File created	C:\Windows\SysWOW64\Iojghflb.dll	Cepadh32.exe
File created	C:\Windows\SysWOW64\Mepnaf32.exe	Madbagif.exe
File opened for modification	C:\Windows\SysWOW64\Obpkcc32.exe	Ocmjhfjl.exe
File opened for modification	C:\Windows\SysWOW64\Aioebj32.exe	Afqifo32.exe
File created	C:\Windows\SysWOW64\Nfcnnnil.dll	Cpnpqakp.exe
File created	C:\Windows\SysWOW64\Dpjompqc.exe	Dmkcpdao.exe
File created	C:\Windows\SysWOW64\Pbddobla.exe	Pcbdcf32.exe
File created	C:\Windows\SysWOW64\Edkamckh.dll	Pbgqdb32.exe
File opened for modification	C:\Windows\SysWOW64\Bikeni32.exe	Bflham32.exe
File opened for modification	C:\Windows\SysWOW64\Logicn32.exe	Lhmafcnf.exe
File opened for modification	C:\Windows\SysWOW64\Leabphmp.exe	Logicn32.exe
File created	C:\Windows\SysWOW64\Nngihj32.dll	Mcabej32.exe
File created	C:\Windows\SysWOW64\Nlqloo32.exe	Ndidna32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhfknjf.exe	Oooaah32.exe
File created	C:\Windows\SysWOW64\Pndjmkng.dll	Bpemkcck.exe
File opened for modification	C:\Windows\SysWOW64\Dbfoclai.exe	Dpgbgpbe.exe
File created	C:\Windows\SysWOW64\Idcdeb32.dll	Bcnleb32.exe
File opened for modification	C:\Windows\SysWOW64\Dbcbnlcl.exe	Dpefaq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7316	7224	WerFault.exe	295

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcoepkdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Memalfcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcfkpjng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlnpio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oljoen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmckbjdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhmafcnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logicn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Abjfqpji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemlhj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdgahag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpgbgpbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofdqcc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bliajd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clpgkcdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgdgijhp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dibdeegc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbdkhe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocfdgg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apimodmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bbefln32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bipnihgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmmgof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbcbnlcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbnlim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlifnphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nchhfild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afnlpohj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cemeoh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfakcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddekmo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Madbagif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhnjna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpllbp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leabphmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndnnianm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmmeak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfjcep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkgmoncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mepnaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoagk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cefoni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdnelpod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dbfoclai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lacijjgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mkepineo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Podkmgop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfeijqqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bihhhi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcabej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndidna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nconfh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aimhmkgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpnpqakp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lknjhokg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkcccn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akihcfid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acppddig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blgddd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfoegm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cifdjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maaekg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pokanf32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdpiqehp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nchhfild.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ohcmpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bihhhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfqgoo32.dll"	Qcncodki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bpemkcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdghhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecdleo32.dll"	Ndidna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Codncb32.dll"	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pbgqdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcjldk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mepnaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfmidc32.dll"	Blnjecfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qecnjaee.dll"	Cpqlfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mclhjkfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcoepkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbjogmlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iagpbgig.dll"	Moefdljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nkapelka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndpjnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dbfoclai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfeijqqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll"	Ddekmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpllbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lefkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfhegp32.dll"	Ocdgahag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blnjecfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bboplo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mojopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnggfhnm.dll"	Nlcidopb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmppdij.dll"	Abpcja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bbalaoda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aahgec32.dll"	Bikeni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bpgjpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mociol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlifnphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clpgkcdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncjdki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohpcjnil.dll"	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aimhmkgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbjogmlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mcfkpjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nefdbekh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omaeem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khhmbdka.dll"	Pmoagk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dipgpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpllbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Daphho32.dll"	Nkeipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdfnq32.dll"	Odedipge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aknmjgje.dll"	Acppddig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pimdleea.dll"	Bemlhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Omaeem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qejfkmem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qfjcep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ciknefmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Madbagif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nakhaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oljoen32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4364	3844	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe	86
PID 3844 wrote to memory of 4364	3844	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe	86
PID 3844 wrote to memory of 4364	3844	3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe	86
PID 4364 wrote to memory of 3096	4364	Kbnlim32.exe	87
PID 4364 wrote to memory of 3096	4364	Kbnlim32.exe	87
PID 4364 wrote to memory of 3096	4364	Kbnlim32.exe	87
PID 3096 wrote to memory of 4028	3096	Kdpiqehp.exe	88
PID 3096 wrote to memory of 4028	3096	Kdpiqehp.exe	88
PID 3096 wrote to memory of 4028	3096	Kdpiqehp.exe	88
PID 4028 wrote to memory of 1664	4028	Lkiamp32.exe	89
PID 4028 wrote to memory of 1664	4028	Lkiamp32.exe	89
PID 4028 wrote to memory of 1664	4028	Lkiamp32.exe	89
PID 1664 wrote to memory of 804	1664	Lacijjgi.exe	90
PID 1664 wrote to memory of 804	1664	Lacijjgi.exe	90
PID 1664 wrote to memory of 804	1664	Lacijjgi.exe	90
PID 804 wrote to memory of 2032	804	Lhmafcnf.exe	91
PID 804 wrote to memory of 2032	804	Lhmafcnf.exe	91
PID 804 wrote to memory of 2032	804	Lhmafcnf.exe	91
PID 2032 wrote to memory of 2140	2032	Logicn32.exe	92
PID 2032 wrote to memory of 2140	2032	Logicn32.exe	92
PID 2032 wrote to memory of 2140	2032	Logicn32.exe	92
PID 2140 wrote to memory of 404	2140	Leabphmp.exe	93
PID 2140 wrote to memory of 404	2140	Leabphmp.exe	93
PID 2140 wrote to memory of 404	2140	Leabphmp.exe	93
PID 404 wrote to memory of 932	404	Lhpnlclc.exe	94
PID 404 wrote to memory of 932	404	Lhpnlclc.exe	94
PID 404 wrote to memory of 932	404	Lhpnlclc.exe	94
PID 932 wrote to memory of 64	932	Lknjhokg.exe	95
PID 932 wrote to memory of 64	932	Lknjhokg.exe	95
PID 932 wrote to memory of 64	932	Lknjhokg.exe	95
PID 64 wrote to memory of 4424	64	Lahbei32.exe	96
PID 64 wrote to memory of 4424	64	Lahbei32.exe	96
PID 64 wrote to memory of 4424	64	Lahbei32.exe	96
PID 4424 wrote to memory of 1792	4424	Lhbkac32.exe	98
PID 4424 wrote to memory of 1792	4424	Lhbkac32.exe	98
PID 4424 wrote to memory of 1792	4424	Lhbkac32.exe	98
PID 1792 wrote to memory of 2620	1792	Lkqgno32.exe	99
PID 1792 wrote to memory of 2620	1792	Lkqgno32.exe	99
PID 1792 wrote to memory of 2620	1792	Lkqgno32.exe	99
PID 2620 wrote to memory of 3036	2620	Lefkkg32.exe	101
PID 2620 wrote to memory of 3036	2620	Lefkkg32.exe	101
PID 2620 wrote to memory of 3036	2620	Lefkkg32.exe	101
PID 3036 wrote to memory of 3672	3036	Lkcccn32.exe	102
PID 3036 wrote to memory of 3672	3036	Lkcccn32.exe	102
PID 3036 wrote to memory of 3672	3036	Lkcccn32.exe	102
PID 3672 wrote to memory of 2264	3672	Lcjldk32.exe	103
PID 3672 wrote to memory of 2264	3672	Lcjldk32.exe	103
PID 3672 wrote to memory of 2264	3672	Lcjldk32.exe	103
PID 2264 wrote to memory of 1124	2264	Ldkhlcnb.exe	105
PID 2264 wrote to memory of 1124	2264	Ldkhlcnb.exe	105
PID 2264 wrote to memory of 1124	2264	Ldkhlcnb.exe	105
PID 1124 wrote to memory of 4496	1124	Mkepineo.exe	106
PID 1124 wrote to memory of 4496	1124	Mkepineo.exe	106
PID 1124 wrote to memory of 4496	1124	Mkepineo.exe	106
PID 4496 wrote to memory of 2116	4496	Mclhjkfa.exe	107
PID 4496 wrote to memory of 2116	4496	Mclhjkfa.exe	107
PID 4496 wrote to memory of 2116	4496	Mclhjkfa.exe	107
PID 2116 wrote to memory of 2440	2116	Maoifh32.exe	108
PID 2116 wrote to memory of 2440	2116	Maoifh32.exe	108
PID 2116 wrote to memory of 2440	2116	Maoifh32.exe	108
PID 2440 wrote to memory of 1632	2440	Mdnebc32.exe	109
PID 2440 wrote to memory of 1632	2440	Mdnebc32.exe	109
PID 2440 wrote to memory of 1632	2440	Mdnebc32.exe	109
PID 1632 wrote to memory of 3048	1632	Mhiabbdi.exe	110

C:\Users\Admin\AppData\Local\Temp\3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe
"C:\Users\Admin\AppData\Local\Temp\3df790340546d000c598efdacc47d0b0d6ae5d7c7f00ef6f6224bc4360ee0578N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\Kbnlim32.exe
  C:\Windows\system32\Kbnlim32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\Kdpiqehp.exe
    C:\Windows\system32\Kdpiqehp.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\Lkiamp32.exe
      C:\Windows\system32\Lkiamp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1664
      - C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:804
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Lkcccn32.exe
        
        C:\Windows\system32\Lkcccn32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:856
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Mcoepkdo.exe
        
        C:\Windows\system32\Mcoepkdo.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4964
        
        C:\Windows\SysWOW64\Maaekg32.exe
        
        C:\Windows\system32\Maaekg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        30⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Mkjjdmaj.exe
        
        C:\Windows\system32\Mkjjdmaj.exe
        31⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4476
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Mepnaf32.exe
        
        C:\Windows\system32\Mepnaf32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:700
        
        C:\Windows\SysWOW64\Mohbjkgp.exe
        
        C:\Windows\system32\Mohbjkgp.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        40⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1496
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        43⤵
        Executes dropped EXE
        
        PID:1308
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:692
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3924
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3964
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        49⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1680
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Nakhaf32.exe
        
        C:\Windows\system32\Nakhaf32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1588
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        57⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        58⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4340
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        61⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        62⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3428
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        66⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3004
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        69⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        70⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        71⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2780
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        74⤵
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        75⤵
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        76⤵
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        78⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4740
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        80⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4004
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        81⤵
        Drops file in System32 directory
        
        PID:2672
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        82⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Odedipge.exe
        
        C:\Windows\system32\Odedipge.exe
        84⤵
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        85⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        86⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:744
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1960
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5088
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1660
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        94⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        95⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        96⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        97⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        98⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        101⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pmhkflnj.exe
        
        C:\Windows\system32\Pmhkflnj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        105⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        107⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Pkmhgh32.exe
        
        C:\Windows\system32\Pkmhgh32.exe
        108⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        110⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        113⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Pomncfge.exe
        
        C:\Windows\system32\Pomncfge.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        119⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5552
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        123⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        124⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        125⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Windows\SysWOW64\Qkfkng32.exe
        
        C:\Windows\system32\Qkfkng32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        130⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        132⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        137⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1132
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        140⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        143⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        144⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        145⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        146⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        147⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Bclppboi.exe
        
        C:\Windows\system32\Bclppboi.exe
        148⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        149⤵
        Modifies registry class
        
        PID:3620
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        150⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        151⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        154⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Bikeni32.exe
        
        C:\Windows\system32\Bikeni32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        158⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Bcpika32.exe
        
        C:\Windows\system32\Bcpika32.exe
        159⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6516
        
        C:\Windows\SysWOW64\Bimach32.exe
        
        C:\Windows\system32\Bimach32.exe
        161⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        165⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6784
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6828
        
        C:\Windows\SysWOW64\Blnjecfl.exe
        
        C:\Windows\system32\Blnjecfl.exe
        168⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Cdebfago.exe
        
        C:\Windows\system32\Cdebfago.exe
        169⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Clpgkcdj.exe
        
        C:\Windows\system32\Clpgkcdj.exe
        172⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        173⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Cpnpqakp.exe
        
        C:\Windows\system32\Cpnpqakp.exe
        175⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6184
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        176⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        177⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6548
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        182⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        183⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Windows\SysWOW64\Cbaehl32.exe
        
        C:\Windows\system32\Cbaehl32.exe
        185⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Ciknefmk.exe
        
        C:\Windows\system32\Ciknefmk.exe
        187⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        188⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        192⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        193⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6888
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        194⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7048
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Windows\SysWOW64\Dipgpf32.exe
        
        C:\Windows\system32\Dipgpf32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        198⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        199⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        200⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        202⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        203⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        204⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7224 -s 420
        205⤵
        Program crash
        
        PID:7316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7224 -ip 7224
1⤵
PID:7292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aidomjaf.exe

Filesize
93KB

MD5
0f1cb3cd3f0b0ebfd2579f1d3c5f0a7d

SHA1
4762416adec07eb15d6f90a176391eb8d38b36d9

SHA256
18c9aa20561422f911a134c200b0657f693d644ecdb2c4649a49f50af9bc38f6

SHA512
46a991f9b048e6c458a53be00da50f56154ada9c6e1dd29c955a7029681e68a2bcefaf0984fc9300901293efcf2b74876ab3356b24b0c047a953d0386213a7d1

Download Submit
C:\Windows\SysWOW64\Bmagch32.exe

Filesize
93KB

MD5
d8272b6942842b29716419703e7a7131

SHA1
3f7bd84070cfeefc69bd140afd6fc56484bca56a

SHA256
b8249bed6c596c1f263e2b449f8f3acddb2dcc21ef025a00ff277af5b89a33f1

SHA512
d39a19768080b440d08d17d9f2f0724e5fcb694fd8f0cfb2100fa682a0968dc9cb4f5e54abd3147a6d4a3b9300b9509adb8eba54399d2f93350ab480488dbb46

Download Submit
C:\Windows\SysWOW64\Cbaehl32.exe

Filesize
93KB

MD5
bfbdaf17095dc38249bd7adb5e07f5f7

SHA1
3f6a5991f404dd3d3d68d912b6fcfacd94f608da

SHA256
7dbcf5ea1d0509f6f8957e04bdd272065336238d2037cf17fc6ecda0ff68004e

SHA512
889899bf7a311024a22d80c953e1f88ce0374c764e368d83b384642afbc6d063c8a15de3dda9169bc7ff1918675084fec4a33fdd7ae29c018caeaa561a1c91d0

Download Submit
C:\Windows\SysWOW64\Gqhomdeb.dll

Filesize
7KB

MD5
914bb7eb005c9d940720eab646ed9b70

SHA1
b17b6cee07b44a87ff614af1de152d92cec44e75

SHA256
da5b6dfba9444f89ba38781510b4646415a71b86c3a80368338643d8db94e9f0

SHA512
14ad468cade57e394802a5f815aa045a7ea2220d4b75fcc0c6da41ab73974da2496f14008afc721abca87d7c92b2195d6b8ddc711ef4e4e73aba0faf18acd3df

Download Submit
C:\Windows\SysWOW64\Kbnlim32.exe

Filesize
93KB

MD5
ee20a32e0f7a230100414ef0b9289ead

SHA1
45f819c92758d7f36cdbd99f7382d3406f600fb2

SHA256
1031cbb8ef69b9bc8339e32a2d6d9db7dc8839ab3b440e0dfa4f9548e02f9be6

SHA512
f5cd1aa767d9986f806d78f3795ca2f2311d0faa709d24b3d9b6ed4c78249da7fb6ff14956ed3d61ef09e11a187f77e6f467e37f9fdf22d1ec9069acaba819b5

Download Submit
C:\Windows\SysWOW64\Kdpiqehp.exe

Filesize
93KB

MD5
3424634090b43c80a8833f98c868208f

SHA1
4e33457d7202c2a4eb3ec77af82df0bfcf2a83ce

SHA256
3f7f477332baa508bdf0c719edc8f840811ca82edb92320f039a120486399de0

SHA512
29f2e31f4e4850bb97da3859e00f3bbf72937278439f3bca6d041ed73f44619b778a4e40cb5a6f3f2a6fb3ee269977e6484259314d48e4af2ddc666731d17004

Download Submit
C:\Windows\SysWOW64\Lacijjgi.exe

Filesize
93KB

MD5
ef1efe0c06090f7d7063a47f5b89a705

SHA1
df054fc746fe24217691ac52f7a5a687343a45eb

SHA256
e659872faf248c4bd3307429ddffc515bb4332268b12775e1df3c7d81e6fdf8d

SHA512
065bf236971537df749b6e237d0639198697913346396974c57038a83a710ee5dbd1e0be4501fee9fd811358b8c5d0a6b4ca9bd01b4cb409d7f46b414a5bfa59

Download Submit
C:\Windows\SysWOW64\Lahbei32.exe

Filesize
93KB

MD5
c39d0b786335cfc9ce6ee7860a7e23c6

SHA1
cfb4bc8673344014bda610e1847bb53a8c00a8d0

SHA256
eccf59baa86c979feedbb9bfcbace700b4dbc71b019a7295245cec9fb2541751

SHA512
088714c312bc487c37e31dbf50b6a19f746c3163fe6ea9ef6de295667da0f89bbb17917bbd79d01ace290aed35d615de370dedc563782bd6f7d34761f4cc7c51

Download Submit
C:\Windows\SysWOW64\Lcjldk32.exe

Filesize
93KB

MD5
fa00b6ba15255a1a8ec79009cbfc152e

SHA1
647297933ae3f76f6a35119bb3215c62da830323

SHA256
e1efccd304d2f32e25c29805407e915c63ad2495bcbeb51a89dbd2eb10db41b4

SHA512
7e10dc13ce83f6bf9e0eacde1e1dedf71bc8584c558d6ffeb2fec2fd3c088f83fc70c8765069de177ac56747177535a7566bfe609083f8995ba1247e0dd35b2c

Download Submit
C:\Windows\SysWOW64\Ldkhlcnb.exe

Filesize
93KB

MD5
af8728f5f69c4d1cb5a1e6a7dcddeb6d

SHA1
c8d12f9720641b29f7bd68e937cf3e31896bc283

SHA256
a84c320b0bd7ccf3a0cdbad4fe5706cce0951b3ecb8d93926f97b262d1675163

SHA512
5ddda1cb17a8ac2a172e710ddef10a388873a240255365157aaaa4bf4c1fd36e57b42fde5d829a4f22e622ad17e201ccd2643f944944aedd5140686a674cd845

Download Submit
C:\Windows\SysWOW64\Leabphmp.exe

Filesize
93KB

MD5
59ca47ca21dd398b57dca7e4ab72a6c7

SHA1
9d27a587feb74af146f6e7b0340346d73ac6bba3

SHA256
815665c8f77080115eed5da640a0b07abdf7b894a7373a78abec2af6309ce5ec

SHA512
e3cf85393bcb1242717fbf4d5861c0408e4655d72b5f139e65217e7595a05caa82be37da083b162e166fcc991be56805ec274e27f8efd756f5074c0950c4de63

Download Submit
C:\Windows\SysWOW64\Lefkkg32.exe

Filesize
93KB

MD5
ce827d768f1ec5e72a5adddcf843969a

SHA1
bbb97a794108f39d97c2e8c05758deb4703c54cf

SHA256
937e0afd22ec05389c4fcd0e591721bf8a361403c1367ecd1eb2c479df58e614

SHA512
33a81fe1e91a654564580f6fea9f66086bc9f125f86ed234d5a4b707dcecc60a0ad095b2a78e2387ca5b7725839c36485dcc4b49c626ce07dd67cc8828a5a17b

Download Submit
C:\Windows\SysWOW64\Lhbkac32.exe

Filesize
93KB

MD5
17f91aba32c624d54e31444a42f1fef0

SHA1
bc8685427f0071c7915a670cd32a8a25ec8667a0

SHA256
a743f1663cbba5baac7151a0bec8aaf8df85b285c7fa9e64ea970e61489ac659

SHA512
ce30c756d5b23f1a2589bc7c1e2000d7ecd2a828e6ab890dc15c8ad8b68856bec58ba4103978dd57f2484580c683259d4c78f4875665d5fa172df999d04ff685

Download Submit
C:\Windows\SysWOW64\Lhmafcnf.exe

Filesize
93KB

MD5
f1929651553822aeac99d6a06794b8e4

SHA1
b1ae050b369064528a1be059560a4933d7bba56d

SHA256
ce1c7942423a7f414fba6250f0f04f72c20e64715d8de6ad26a84bf0cd64407b

SHA512
f7dd71bf197e87d5cff1be52a13a7bb934ead78b0ed1cab704b16c454e77aa0e8bd5d29cc94fd74c6b4b6127f6ff5b2ccfe5202ce1684d7e47d210bc60a4e0ab

Download Submit
C:\Windows\SysWOW64\Lhpnlclc.exe

Filesize
93KB

MD5
57608f65bafb16369e4f3b63f1b397c5

SHA1
d7539b7a97f2d4c73dd72b85e67ed7ec4f5a3729

SHA256
40a99bfbe396a03aa7873eb5ae185cd416fe01496fa43b74e813fb2d3fb9df0b

SHA512
e1f005b67230e8cf8e730cadeaefe15579e6f3c312e3abc2808269aa12ba77fdf5e12e8591cf38f1a75c411c476feebdfbb082acabb61a2abffb315e862b81cf

Download Submit
C:\Windows\SysWOW64\Lkcccn32.exe

Filesize
93KB

MD5
5c91051bf0ebf67b20d56c24c5b2e1fd

SHA1
daecefe5795a79e18f96077e5c3eb4770e5195ff

SHA256
1f3a21a81b1092ba3bdd1153e38e02fddcaaaf5ee6204ff478660ab11fec8bcd

SHA512
d0b897364ed88fde0a4a62d7a5f6d14e367564cfd241a9c5b5424987b0264d4dadbcae925dcb8a0383b427d0ec9dc9adb26cf71b88ba063e7f9ddb44c4803518

Download Submit
C:\Windows\SysWOW64\Lkiamp32.exe

Filesize
93KB

MD5
e49c93b920e0b26daeafe5bce3de0357

SHA1
7282f27ceed911c0317117aa4f6d8f6889cf3020

SHA256
26c84625aee667e683e7c1b87f35980d7aa2d48be1d3767701e1fe0eb0f4a469

SHA512
b191b2963fa438d7fed9c2a567e161358aedbefd69dad94f370ea74f6cc4f03178022d8ba44b03d674ed2f0c48b5e58ba266e85665b45c48aa7eda0a73e488b0

Download Submit
C:\Windows\SysWOW64\Lknjhokg.exe

Filesize
93KB

MD5
8cee6dc3a4d2751d59773cb766bf06c9

SHA1
03ecdfd627a3fa403bbb38671c67043406aac602

SHA256
1add41cc16da5fd8a58f39fbe76e7b0232da2a439f055f2b8e793284d5f618c9

SHA512
283b74d7c51793051ff10fa1c5901f39b52a65356b7e5a74eb1ff935a7ba3f8d01473a5cf8361ff86eae5ebed2ff79e91b24734978753b36d97dd5f1fbf8f033

Download Submit
C:\Windows\SysWOW64\Lkqgno32.exe

Filesize
93KB

MD5
b46e2e575295fe3302e53450df5ed3ed

SHA1
c720de640c134f566ad278dc55cbe41782141b2c

SHA256
c7acacfa84a54e306afaf8d3c7c0286aec905fdeb2130ee4156b57af739a502d

SHA512
1281473d240bb1aae4a68a0801aff9ee261e14b9d007d59b4ffe48e7ea2e12bb318b9412e25b5b6911904c590ac111f5d44681409030e7d3a2f451296f9f5a36

Download Submit
C:\Windows\SysWOW64\Logicn32.exe

Filesize
93KB

MD5
2e15f6bc6ea6ffdd4d8febc43d22ea16

SHA1
0e2801330a134bcc8677bac5dc56f21239ceea29

SHA256
c78fdd068f4e4cd079ab709ddb6dd3e393076e2f02be053db001a1d6f4d999ab

SHA512
eb57f92aa987699521579e124d1bb59d95e41401967e0a865cf56e0a9b453dcba660b255e1f23fbcf44df7f52c374bf47fd7518e79c75755c307738a94a759c9

Download Submit
C:\Windows\SysWOW64\Maaekg32.exe

Filesize
93KB

MD5
6dd147b1f5fb6f7db5051446bc69199e

SHA1
8db9c1f0030d52bc67c6da6884b705473f99ced8

SHA256
27e00634eb5d3886cfa9019b64407537d54d6475020cf8eb4cbad9edc60381f3

SHA512
fbe78025138ec4e5986deec8fb73528e360516e8b30b39ec77ba84d069977c434808a30c107415d6b25544ec0103a8f3c6d8777fc374fde613fac6050dfb70d8

Download Submit
C:\Windows\SysWOW64\Maoifh32.exe

Filesize
93KB

MD5
eec0576c9b9a43dfedd0845dfb8e42f6

SHA1
f4ee3c711b5f8379a95d49c13bd19702dddaaf7f

SHA256
f499b6e969c4419b94c2c112a29b50e275e9fdca78b7a8c6d8583aa43c0a1019

SHA512
156044efb2675b7655c412ee105ebfa2482f300e4a6a96d0989778e486690ddb434542c102405bb519a989093ec5fa223a78e24dec4dc7a48d193b488c768260

Download Submit
C:\Windows\SysWOW64\Mcabej32.exe

Filesize
93KB

MD5
1c5062faa1b5e2da6300f673d77a9a11

SHA1
1e7e9bd73296de2eedaf1226f100e28acc1cbb88

SHA256
1d0c66e5bac6f93d8c481d786ad7465052eeace3e03ee54a21c6489c56a95f18

SHA512
8247c41423b60ea211bb80fc4992ddb78d69dd2d3e7b469f42e178d5e3a4c226d0b6f26745761bc0b4a44dcd0fa4386f81c0065aabd19609cd03cd8cc94e15a8

Download Submit
C:\Windows\SysWOW64\Mclhjkfa.exe

Filesize
93KB

MD5
5e1609d552ab881719ef981268ab5d96

SHA1
f1fe16004348bf2272dc9dbf9d599ecddef95bc8

SHA256
3a23eb15a01a28668017aec3f7b7d365229b2279de57f309d00ce50ae57d3d03

SHA512
bc48db8b0795fe54a63ad1213cc3c1306300bb3e88ecbec85b6d46690e0acec16e70ca7390896a4ff815fc03a89582b8ff8878aa0512de2688ce8e575ed438c8

Download Submit
C:\Windows\SysWOW64\Mcoepkdo.exe

Filesize
93KB

MD5
92e77e2d8a3612786c6bdd37547db148

SHA1
048f129e9dfcc45dfaba9eaca84743d2bf0aef06

SHA256
e9d26e728460fea80945a0b75455e49abe0ac06daf7aa2aecd3006b5de15414b

SHA512
7a09706c75a6228be5778c4b8e4794cb8b37d8f18dd26a16daa748493bd907c9fd2e4f2e453146ae28ba681efc3478c5e385e565b8cdee834687c2e022dacf93

Download Submit
C:\Windows\SysWOW64\Mdnebc32.exe

Filesize
93KB

MD5
08c35174bb80b37dad1adea423531275

SHA1
0832d9964e036482322efc2b4f1156f6a6c6b920

SHA256
cfa77901439a5876e55c8e45ed60cc2e4286ebf84bbd003de8b24504b90ef293

SHA512
84ea5540c43b9b0a961c69b74ffacb0557ad50afe3052631e1e306b2ea36c43b9f70641094b1306bcaa981a583f2290c416b36adad9128c4aea2fcca593e4e49

Download Submit
C:\Windows\SysWOW64\Mdpagc32.exe

Filesize
93KB

MD5
178b9f51957b876728daede662fb0dc7

SHA1
a1b4b0e8501a66fb4e834ff52d870d111167c255

SHA256
bec1c482f47b416e8ccbcd6024c530f48926225287bcc333132bf9e3ad7b5b19

SHA512
a7a64b5201db92e39c874299752c18b06f526aaae69328768d58ac10110236f376befd05709276dbfed98862c67e8e22c341c2f29b366232c3fd121973f2e1f5

Download Submit
C:\Windows\SysWOW64\Memalfcb.exe

Filesize
93KB

MD5
0105f2d657520a57062388903bb7bf38

SHA1
b3bf541a1167966d5ff3ca1e3064784a673a764c

SHA256
feb564a140ee7b37ede6c7b7a5fdf97887cdb4ea6a6ea1e34504bb00101f19a3

SHA512
2425b0f03c888a7d5a27034d8070b587b314c28ea36a9ce1feccf2540cd77a88a33d90a41aff642bc672518a682ce6ece24df2aa1ad22551b2de3a3b06f49563

Download Submit
C:\Windows\SysWOW64\Mhiabbdi.exe

Filesize
93KB

MD5
6768a2d5f69bec15d02696afd6e365cc

SHA1
235c8851cca0f15696fb938aa2210f0bc3a5c675

SHA256
d9ae246a11da7a561528b5c4d637ae069a3af4573c57deaf5f1220c71c42accd

SHA512
869e27ba974463c8c047eece31c066fb45a7b831e3bcb9f2941ec96dca5e523edc97b382c3a568b4453f75d136d69b2cf7772696199138beb3ef25863780f6db

Download Submit
C:\Windows\SysWOW64\Mhknhabf.exe

Filesize
93KB

MD5
73af0a84fa70c87a4fee42f3faf02ae3

SHA1
4dce4ec6b2bce43a84bb52827bfd1f1e046cdf3f

SHA256
09091cfa26bf50c0094c372e64d15f588cc6742c7734bcd4e0329635972df4ef

SHA512
0f03e3fb87bf56acd1099152e1ef56a4ac48b7d096b0e7a02f384b979c03df61bf89fe31860e703949ff88e07c606478434ff99cae4a8a1d6f4a5e865e10a2fb

Download Submit
C:\Windows\SysWOW64\Mkepineo.exe

Filesize
93KB

MD5
cd0bc2400ffa2ec78891ad3c6dcee95c

SHA1
16557cb6ae19e0486b90d5bb5caf947e84ba3535

SHA256
46d7e0d48a3697ba276cb2905db1be34016275ab7ce5afa191fb6ffbd6576181

SHA512
0f4c8d2200bffc35c32562c0285fc4eee2a1fc8a5589908c8b60dec25b44d034932febc489833cbed0e434ee25ad9464c7f54308172689d824f1bdc6c6517849

Download Submit
C:\Windows\SysWOW64\Mkgmoncl.exe

Filesize
93KB

MD5
6ece6fcc383356d754803e9b86477cb1

SHA1
5004b2d07034ade3b87b94ee82a12705f1152730

SHA256
cf8efa4056c68eb98893029a31496e9d4240af81d77e916ccb63b64a605e199f

SHA512
c187852bbdb6940f4abe98b1d27ce584146e7ccff1fe30ca205e5eab139618cf573efbcf5054dbf7504ec0f836ce8b1b3ad2d010b331c543bd4e7cc30a00ab01

Download Submit
C:\Windows\SysWOW64\Mkjjdmaj.exe

Filesize
93KB

MD5
d6e6391ae58226e1bcda80dd983a14dd

SHA1
093f65491d99202a1911f2c04f795a0bd5b674fb

SHA256
4255de00280650330ee0cc95064421ff1a4808fe4b3450694a095efb7b4ee617

SHA512
999b5323f9da7384a5cb9b2c414df7aa08a5373f8b40cec34abed64e729a7c948228fbf9293924bfce8856f301edde50ef6ca28668aa6d048412171b23caca34

Download Submit
C:\Windows\SysWOW64\Mlemcq32.exe

Filesize
93KB

MD5
42bc9a0aceae9b7bbf210e7bf2d3eaa8

SHA1
68b2d54e8ee74241f4a05a570af8a64b2734fe5a

SHA256
da89fa1607fc55308c8ada5d4f5e3fdc8e7672a579c73c60517c63c3fa467111

SHA512
55411b1d4e41101424efbfd4858f8664abbe23b8ba4ed140bc645aca1c5577d263da9f03e6af9359052d57e9e4f468c9599dc4c712e1cc911364a1b378048635

Download Submit
C:\Windows\SysWOW64\Mociol32.exe

Filesize
93KB

MD5
26101343baf570a173c86f50d24b15a9

SHA1
6f752ecfb81412a05af139defe88a2f540f8d2c7

SHA256
e2c087ac449dbd5f19fad2255f6408c036f00a274ed3363c97fd6209fb3b7926

SHA512
741ca099018b1fd92c3328d6ecb6a9294b42051ae734b8840027bae300137e76392de091433836575e2e8d60337e5d839a9ce0b286d3b7570663f3c204aae8e1

Download Submit
C:\Windows\SysWOW64\Moefdljc.exe

Filesize
93KB

MD5
6eb3de28c2e7b9b350a2d34f97aebb16

SHA1
2e89ad528fcd6367ad575f6f9edf089ce9a56f79

SHA256
eeab190e4d6f80057af0231db3e8e390463800742194486fe4abd077e96ca462

SHA512
e2da8c49e4597975d9ce6a4c2d5f1a68df4b35cfec1b9574cb96bad3800566ceb45ba0e136cba19c21ab2936acd5349960c9ddb36c98a0b5c31eedc70f10ef24

Download Submit
C:\Windows\SysWOW64\Odedipge.exe

Filesize
93KB

MD5
f854d7fa68c4cc65fc90e16ff1b1e049

SHA1
6a0c1fce13dc3ce5d18884636b5bc568ed3a339e

SHA256
7cc95647cd73ff5f2ee1efeae94f4aedbada126b6f31e2f2ae4cd92707a3786a

SHA512
693267cc07d802ce88cc3adb65dbcdb43a936267ea394b322dcc4e2b8942b7dd3c9cd54034a6b5e47a861fe1dd961b5a0e1128e3d038ba01670c7c7a8130eb3b

Download Submit
C:\Windows\SysWOW64\Pbimjb32.exe

Filesize
93KB

MD5
7faf69561aafa8caab5d68013bf5e1fc

SHA1
c67bb4cf2100e0639a255dff5b91377f24776960

SHA256
7bd13c7308b6e06b1685f304991834c1c7f5809fd94028e75a1b17d51e1c0263

SHA512
f5ee27a91edbd53e04eab74cbb2af9ba9524055d7822a44fcd2290e9d1b1c04db72e70a94fd43465fce78f6fb9f941b2e935bcb83e7a94b16b68aa19defc21a4

Download Submit
C:\Windows\SysWOW64\Peempn32.exe

Filesize
93KB

MD5
ae9e1ae3ff492570dc73d43ab87b98cf

SHA1
accd0df86ac6d37fb58a049904f6ac7c04ba58a1

SHA256
42fc31c1fbbfcdac7de6a6f9969552bebd89d5add38b9f0f95f5b1bb0b77e6ac

SHA512
b88bc316ad9a81113f1ffe0655ceaa9166bb5b640aeb79f2dca194df4a49ede6275af960c48a1f6cae4a8155c5ea06238af567744dab1879ee643fd06170af7c

Download Submit
C:\Windows\SysWOW64\Pmeoqlpl.exe

Filesize
93KB

MD5
a5928551835d91fe765ffa69060dee6e

SHA1
dd3dadfeaba1feded745b7fa1d66a546fa4fc065

SHA256
f81d9ef8f8914b40bef009872a13c21e486b905c07b0941ba4327e99a45d5733

SHA512
202c0e76353456c868ecdad068894041e9df25619bb887c37812403878b2ee6cb3be4cbc9e9a2591a717c0bd780ca94ea99f292b52ff306c93131b4501eef97e

Download Submit
memory/64-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/64-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/404-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/404-156-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/692-352-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/700-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/804-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/804-124-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/856-202-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/932-71-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/932-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1036-272-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1124-237-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1124-143-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1232-358-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1308-340-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1496-334-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1584-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1588-406-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-229-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1632-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1664-115-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1680-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1772-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1792-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1792-99-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1880-448-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1952-527-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1968-424-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1996-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-47-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2116-254-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2116-162-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2140-142-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2160-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2264-228-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2264-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2328-286-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2344-412-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-450-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2440-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2440-171-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2460-328-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2620-107-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2620-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2836-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-298-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2916-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2932-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3000-292-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3036-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3036-116-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3048-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3068-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3092-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3152-376-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3428-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3468-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3580-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-304-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3672-125-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3672-219-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3768-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3844-79-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3844-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3900-346-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3924-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3936-238-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3964-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4028-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4028-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4148-400-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4152-246-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4172-316-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4212-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-322-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4280-255-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4340-442-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4364-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4364-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4424-183-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4424-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4476-280-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4496-157-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-211-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4764-497-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4932-394-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4964-220-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads