fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2025 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Size

125KB
MD5

ef355b5f45d32410d652248a27fb8e9e
SHA1

693c8e1954ec26568af2e3b9cad95d6d17fbd67d
SHA256

fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e
SHA512

aadeaa218807ac7f9d33460a5af8fe37e65cad10506d810e382de79095cf3e2321eefe07eb15045b45e5515264d0ffa06c5b6dd8e01cd49c4ce2d9309753c516
SSDEEP

3072:/TvmheePJj6xGAcvx1WdTCn93OGey/ZhJakrPF:/yhJAcCTCndOGeKTaG

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe

Executes dropped EXE 33 IoCs

pid	Process
3644	Ambgef32.exe
4912	Afjlnk32.exe
1380	Ajfhnjhq.exe
3204	Amddjegd.exe
2100	Ajhddjfn.exe
2372	Aeniabfd.exe
4304	Ajkaii32.exe
224	Aadifclh.exe
1440	Bfabnjjp.exe
3172	Bmkjkd32.exe
5048	Bcebhoii.exe
2576	Bnkgeg32.exe
3664	Baicac32.exe
1788	Bffkij32.exe
4264	Bfhhoi32.exe
1888	Banllbdn.exe
1980	Bhhdil32.exe
1648	Bmemac32.exe
3008	Cfmajipb.exe
2316	Cmgjgcgo.exe
1240	Cdabcm32.exe
5088	Cmiflbel.exe
2960	Chokikeb.exe
3948	Cmlcbbcj.exe
2168	Cfdhkhjj.exe
5072	Cajlhqjp.exe
2632	Cjbpaf32.exe
4344	Cegdnopg.exe
4672	Dhfajjoj.exe
1536	Djgjlelk.exe
4924	Dfnjafap.exe
2308	Dogogcpo.exe
3296	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ickfifmb.dll	Afjlnk32.exe
File opened for modification	C:\Windows\SysWOW64\Aeniabfd.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Aeniabfd.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Beeppfin.dll	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Baicac32.exe
File created	C:\Windows\SysWOW64\Ambgef32.exe	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
File opened for modification	C:\Windows\SysWOW64\Amddjegd.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Mbpfgbfp.dll	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bcebhoii.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Poahbe32.dll	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Ajkaii32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Amddjegd.exe
File created	C:\Windows\SysWOW64\Oicmfmok.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Ajkaii32.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Cajlhqjp.exe
File created	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	Bffkij32.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Chokikeb.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Djgjlelk.exe
File opened for modification	C:\Windows\SysWOW64\Afjlnk32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Ajfhnjhq.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cmgjgcgo.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	3296	WerFault.exe	117

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afjlnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcebhoii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbpfgbfp.dll"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ickfifmb.dll"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbodfcj.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhicommo.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bffkij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmemac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Ajkaii32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3644	4180	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe	83
PID 4180 wrote to memory of 3644	4180	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe	83
PID 4180 wrote to memory of 3644	4180	fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe	83
PID 3644 wrote to memory of 4912	3644	Ambgef32.exe	85
PID 3644 wrote to memory of 4912	3644	Ambgef32.exe	85
PID 3644 wrote to memory of 4912	3644	Ambgef32.exe	85
PID 4912 wrote to memory of 1380	4912	Afjlnk32.exe	86
PID 4912 wrote to memory of 1380	4912	Afjlnk32.exe	86
PID 4912 wrote to memory of 1380	4912	Afjlnk32.exe	86
PID 1380 wrote to memory of 3204	1380	Ajfhnjhq.exe	87
PID 1380 wrote to memory of 3204	1380	Ajfhnjhq.exe	87
PID 1380 wrote to memory of 3204	1380	Ajfhnjhq.exe	87
PID 3204 wrote to memory of 2100	3204	Amddjegd.exe	89
PID 3204 wrote to memory of 2100	3204	Amddjegd.exe	89
PID 3204 wrote to memory of 2100	3204	Amddjegd.exe	89
PID 2100 wrote to memory of 2372	2100	Ajhddjfn.exe	90
PID 2100 wrote to memory of 2372	2100	Ajhddjfn.exe	90
PID 2100 wrote to memory of 2372	2100	Ajhddjfn.exe	90
PID 2372 wrote to memory of 4304	2372	Aeniabfd.exe	91
PID 2372 wrote to memory of 4304	2372	Aeniabfd.exe	91
PID 2372 wrote to memory of 4304	2372	Aeniabfd.exe	91
PID 4304 wrote to memory of 224	4304	Ajkaii32.exe	92
PID 4304 wrote to memory of 224	4304	Ajkaii32.exe	92
PID 4304 wrote to memory of 224	4304	Ajkaii32.exe	92
PID 224 wrote to memory of 1440	224	Aadifclh.exe	93
PID 224 wrote to memory of 1440	224	Aadifclh.exe	93
PID 224 wrote to memory of 1440	224	Aadifclh.exe	93
PID 1440 wrote to memory of 3172	1440	Bfabnjjp.exe	94
PID 1440 wrote to memory of 3172	1440	Bfabnjjp.exe	94
PID 1440 wrote to memory of 3172	1440	Bfabnjjp.exe	94
PID 3172 wrote to memory of 5048	3172	Bmkjkd32.exe	95
PID 3172 wrote to memory of 5048	3172	Bmkjkd32.exe	95
PID 3172 wrote to memory of 5048	3172	Bmkjkd32.exe	95
PID 5048 wrote to memory of 2576	5048	Bcebhoii.exe	96
PID 5048 wrote to memory of 2576	5048	Bcebhoii.exe	96
PID 5048 wrote to memory of 2576	5048	Bcebhoii.exe	96
PID 2576 wrote to memory of 3664	2576	Bnkgeg32.exe	97
PID 2576 wrote to memory of 3664	2576	Bnkgeg32.exe	97
PID 2576 wrote to memory of 3664	2576	Bnkgeg32.exe	97
PID 3664 wrote to memory of 1788	3664	Baicac32.exe	98
PID 3664 wrote to memory of 1788	3664	Baicac32.exe	98
PID 3664 wrote to memory of 1788	3664	Baicac32.exe	98
PID 1788 wrote to memory of 4264	1788	Bffkij32.exe	99
PID 1788 wrote to memory of 4264	1788	Bffkij32.exe	99
PID 1788 wrote to memory of 4264	1788	Bffkij32.exe	99
PID 4264 wrote to memory of 1888	4264	Bfhhoi32.exe	100
PID 4264 wrote to memory of 1888	4264	Bfhhoi32.exe	100
PID 4264 wrote to memory of 1888	4264	Bfhhoi32.exe	100
PID 1888 wrote to memory of 1980	1888	Banllbdn.exe	101
PID 1888 wrote to memory of 1980	1888	Banllbdn.exe	101
PID 1888 wrote to memory of 1980	1888	Banllbdn.exe	101
PID 1980 wrote to memory of 1648	1980	Bhhdil32.exe	102
PID 1980 wrote to memory of 1648	1980	Bhhdil32.exe	102
PID 1980 wrote to memory of 1648	1980	Bhhdil32.exe	102
PID 1648 wrote to memory of 3008	1648	Bmemac32.exe	103
PID 1648 wrote to memory of 3008	1648	Bmemac32.exe	103
PID 1648 wrote to memory of 3008	1648	Bmemac32.exe	103
PID 3008 wrote to memory of 2316	3008	Cfmajipb.exe	104
PID 3008 wrote to memory of 2316	3008	Cfmajipb.exe	104
PID 3008 wrote to memory of 2316	3008	Cfmajipb.exe	104
PID 2316 wrote to memory of 1240	2316	Cmgjgcgo.exe	105
PID 2316 wrote to memory of 1240	2316	Cmgjgcgo.exe	105
PID 2316 wrote to memory of 1240	2316	Cmgjgcgo.exe	105
PID 1240 wrote to memory of 5088	1240	Cdabcm32.exe	106

C:\Users\Admin\AppData\Local\Temp\fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe
"C:\Users\Admin\AppData\Local\Temp\fd9a11902b68b3939049c446ae7da436339716ac154e1cf12a5b6c7e99f3e49e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\SysWOW64\Ambgef32.exe
  C:\Windows\system32\Ambgef32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\Afjlnk32.exe
    C:\Windows\system32\Afjlnk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\SysWOW64\Ajfhnjhq.exe
      C:\Windows\system32\Ajfhnjhq.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3204
      - C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5072
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1536
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 416
        35⤵
        Program crash
        
        PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3296 -ip 3296
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
125KB

MD5
0d09a4089314bdb2e03ae2af9d042e14

SHA1
640fad8ad3d00089bedbc31c97a18fe0e0bfafc7

SHA256
920fa51e130bc30a797e6928e85df7a9418d16739577c5efeb99e3ddb0069f93

SHA512
96abce0b6940bdfb0a57974dcee79e3c57a6b92a714311e58c624867410f5b0d1f131491a4a4aa1ff59d37832cdbb32306ea3c8db7ffa1d182eeaba02f893d48

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
125KB

MD5
5908e0efc6ebef155616b40c7c085b7b

SHA1
57cc674df599f9fc79ea8ecf3f8b3c0581ed10e5

SHA256
1af63d976b2be185c1e1d9c59fe6fa1a07b9ada1c2ac929519feb88a2173cae2

SHA512
5dd68455489e05827bb44d99e1f74c609e107ab0795565779a78a5b44ca03554c930a269a20f15fce36f25f9668e86971f5ad43e3f77acdc91fe3c7348c0422b

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
125KB

MD5
28023049f1e89573a7a6a0323db2a7ce

SHA1
0ad5df8dff75e11c136eb16982a501b60e76f659

SHA256
f13ecc38f2b2fd3eb662b17509703dbab8fdd6c199e7d86b21f6ffef9301eeb3

SHA512
1fbd32781153c77630b6f1ba06f9face7dfeaa5e3e100ba996b222600bd5ffd748c0f6b5836f0402ab223ca12d6edc7378b3179f3e9f7a410410ce721af34019

Download Submit
C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
125KB

MD5
a7fe5fd2eb4765cdcc0e3fb3bdfe1b0c

SHA1
42b0100102ba33cd0e9e3aa8495e1bf7410909f6

SHA256
2e7b4dac03831f8ae88f931bb62887c2debef3fa9cfe7c21c69b010a30eda9e3

SHA512
15792adeea2aee26993b782f672fe0ca46e93dfde02e0a2478e225691555f97a7e5343b9bf90027dea2122e597d99d9fa6efd97355c6d48664e363a8d6e75fae

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
125KB

MD5
2ac9a0b54f32d5a5a9dd2de945d595ec

SHA1
adb77ade4d91cfcf1b2022b705a9a59b199ac52b

SHA256
82f0a73bbe5104bb4a5b25f5a32b4c6cb0c628669afeea7009b66c6b223fc31c

SHA512
c9ec9c2c1819a0dd48f63ee25f3d80646597e88665c425da213bcb7ebfd9222f8b1c888885a485b2ee945d007f2154e65237a10dc0666fe4b2f2383c4e5c76a1

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
125KB

MD5
1861fe9300bf7a6efb5efeffe2a2882f

SHA1
1d2cfe267265da3484592bf4447e196802c82d2f

SHA256
10dc6f1b840b8905c52957f24123b9d9770ab7946696ec34509a1849a75c03ac

SHA512
8282c92ca45dae7a0d29ff749dc260a84abdb36e5b61719c299d4402f9a690fe75522708e9ea2fcdb55b72f2a358775d9d65925d5cd51648ecc538762a54ad30

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
125KB

MD5
e35883de71a706a40fc3ef05693a1205

SHA1
e10b0b623f1175c2f8642dbdd26bfaa2756c4308

SHA256
12cf746c3cb3d1967c8b1020171ef5a0f987be9b2cd2ee461dba9aa91add686a

SHA512
6a423ee6fa198652524013e23f0e6ca96acaca57097031bf5b6d7fb525f6117791f921d70074a623f6cbaa234e471ff1dd6eb52ff6a2896e723ef4abccf281f5

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
125KB

MD5
26190431c3befe7d42000b1db0df1bcf

SHA1
1bea53492ca56ac946f7bec1499b996ee71ca297

SHA256
6eb56b725f305d540b6d5ddd6b25bbc5e087fe7dae16505e18702ace72512b77

SHA512
f00bde4f01dd04f39878871e564810628cca804b69decb58c8604ea24f63b4a7fefb90f21b7ab18c2e731aaa36bc964301d437bf80bbc99315f2c5389d0b9ee9

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
125KB

MD5
329e4cc57cd3a74062aa5700be486ff5

SHA1
d89643a440820a68120e075c09437308fd14fb0b

SHA256
eeb2764f67c18cfe6619c19b6bcfc5a4c62e688d1cd7e8ad9b5f1f1e1e1b0cd9

SHA512
a2e11457d28e165127df00a6f6b4b9da2e1c3f60df30973d9d2232af6eb1c661c5b35727d4f0000c3c702c81cb9deea65d461992beee73b3ee9dbe6a269cf85c

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
125KB

MD5
363a90fb0f452b479b34fd5167b14b50

SHA1
054a0743fac6ec1cb48e15b32d704dbc9a4cd3db

SHA256
777161bfc3a461236fa3138a99b0ccc47e802076c552725bb753650e9c714cfe

SHA512
cc44f2ab2accb00c2f16c68d30e796e74aa9aaa5f719464e69b953efdd022ab7762fb79e22bb7094ebdd7df8f05be94fe9a036b7149f4532c2e7b5f8c83b7c3a

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
125KB

MD5
2c27340366dae56b5d0e2b4f537d9b6e

SHA1
a3151babaeffaac714a0ff2e7e7474140a8dfc47

SHA256
3eaae06f30e7c00a0c8dc01faaf83cb40a2814533f22c5d9b460cc72fe8ce612

SHA512
e9501216d7e4166aa47dbf2765e6bd84250a75d0cea8d59556c8b2020c170ff2b61b317554a5f1cf8d4326455b15159c3934c482efa04cb0578abcc016a41f90

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
125KB

MD5
4e47225bbb74a9a894e24a4d4768b40f

SHA1
75bf3122f09038e6faa0d07772fca0bd1bf2ddbc

SHA256
45dc5ba913d771d9d0bb62d4b31d69cf48a8796a2e45071b677f843202aae046

SHA512
7986b94c3e32b3adde80581487c92f36b7c06c6c1f934164dc12768a1c117ac24214d0323bd71d6aac08d468f883018870152aaa92f4e458fea118e0281fe3a2

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
125KB

MD5
20da3ee3d1d94f7c50baf448b8525f67

SHA1
2833c9bd8eb2d03f7f4dee12a66bf8b916566bd8

SHA256
f3d462544f38dbef469663a2848223ad66dca39ac3a8ffa63f9fa69397ff0d00

SHA512
edf3a802a1b52ef1f003054a910155b89871de7219514a6963354304ca305e588f6337beeb486efe187a29c4f710e981d6922607b3b9d22e0c7aab784d9726d3

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
125KB

MD5
f77275650e9d9688aafc119fa81f71dc

SHA1
e383480062da52906826ca6004f48a63770d05aa

SHA256
daa5bc362423c96f85de056a340a910fb0c5fba9c5e4d561dd1b4156c8a925ca

SHA512
b91935919ea0c343f7b29ee68864b7e5d7e5860fe1e34d0d42f82cb3094a326e5873488d471883b0eabaa14f1af2e6fd8dd9b9255e1f27e6e4efedf829b4c664

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
125KB

MD5
c52e32202023618e44b64289f12a8430

SHA1
1f1b5b2c4eae3d3078d42c34b907df86073c9db1

SHA256
a027eb05fa9650e035ac65790f5b392dcbbf79db73a13d47bafcd5c84d573f92

SHA512
cc76124fcb3e7e11f4089e6b7329f13d912603d7399eaa84fc93a63722a8846aa9c22376ea72d01f5eda7571ea72fd75a56f10de2d9ff82c0bae290243ce8ec2

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
125KB

MD5
8ad38ecb0144baead54be8de390ff8bc

SHA1
6de2a7c1b3da5c4c4e5c365e0abc1fdadac70859

SHA256
ff1c927d9a4f4a3031ba750253a662dc7ccb6888caaa9b999fba4ff9498fe24c

SHA512
f8b8b79ec102079a677d62934605fabf16a8c3ae710873d105cb751be0bc1cc9c40bf33684aad00c380ebb224c53c3ed345a1b4bdcd1a0cc387168bde1bf20a3

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
125KB

MD5
732aaa143cee7e0b3e4196861b96fe56

SHA1
1b441ba4d3a76533a39e4d681a31322515f8e567

SHA256
579f4d645ac60fc40334600ca5967e5e8ab1d2f52a5b69d335e6695ba94c6606

SHA512
8f44133892c120ac7c327d5eff439cb7933d378dbf21686ed4b2e1cc882540df63a642acbf5700225097af21bbbcd6a30914c07df8803b5eeca8d9769847f4f3

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
125KB

MD5
d0f5ee5ed949a44b0fbfdb10d190aaaa

SHA1
f8992d876deffc0fb4769d792e8ba6c2241b8fc1

SHA256
734a9a0b1f02cb98d2ad6d67638dacc26d9cac04c7999cb4038d5fe3d1e80a47

SHA512
b1759b868c9007e45c048c149b0bb461e5778c19962d59c9fb4611baff6da8b06aa834ede6b069269b0a9f10229be38378326a63bc77c168c905a85d21c9eacc

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
125KB

MD5
3c50f2a9306e570d8ea82969e20d83ad

SHA1
67648604183d734397a1bb80dd1ee79f543d45b4

SHA256
524e437fffc927042bcb31701d7813f9e5d85318b6ce4819e2edf647aab86205

SHA512
13afdc58b304f21f20b079526d1ae2beb708eb35656f57f73bdb2ea1916dcc0e5ed89a8fa15af645508ac29a65ad3771c12a850cc6275dac5b3118784d6dc48d

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
125KB

MD5
51adf24364a36cca0fee6fae8e441b1d

SHA1
11ae7d54564d81ff7e584757c09bd109e203159e

SHA256
6600299d7329bf277bb880c4e8e2e4a7b40fe8dc7a0fc120a6dbfcee85b67db5

SHA512
2590191ef5dd7bcf7bf0a3661e2a6d063a768470e600122ad471353b68eac64114e03f7cb629cdb0f5d1f514002286239561f6f288f2cf983d9abaaf26bf56d5

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
125KB

MD5
3ca8d544616e5ea2c04669bda8e0bd9c

SHA1
74e54b66ab3f2513af5d41e810e17671aba95afd

SHA256
b13db777bd9270459fac896b5f3001de9dd9eb58fcac2997dbb7038998de2ca9

SHA512
2abe584d7fe1f4b2c2e99cad1e743c6eca0f0a99cfb01ab797e6f8ce2f97d7aedcdea973007a198ed92f131ede86f18c7ceb15b22e1a271d2e7db4d154722bc7

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
125KB

MD5
28935352b45ae4b680d1831171059a86

SHA1
7e2f9753f79569d02c59684647cbf48b571faa7c

SHA256
efbfe1dde83f3bb39b84841f5bed9446ff3743797d4ca6d11ef55dbea588ba72

SHA512
bdd2074fbc80d3be91be9c55cf24dc8d18b4da13249e1183dee494e2ceca30c25a270af6933056aae17d96597318b9cf641a0b317ce205e80b11a64ad377a220

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
125KB

MD5
9ea99d54afb459ffbe8a311181a621b4

SHA1
a9f0c80d939c2c388e766965de392b3acbed9511

SHA256
b1c4479be828460ef078041f28e6d2f9994556f6fe158866cb37e027e6dbd1cf

SHA512
aace87421a44c6ed7935fdddd8fc4c38f022c6e1c6b16054ed7ccdd5bb1b084ef24d6d6f8658c4c34a7acc16a66e913c0724a01ad1da585b84241d76f15cd962

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
125KB

MD5
b7ba015338ef6d3d5c8931ba6bcf3b41

SHA1
0a5713cb926a0c96b06b99aa92f3e41b9c4604e7

SHA256
99ff517c8c9cd2c31b756c6ce9ff9602356f698fc5f5867e66556ae0e2470a42

SHA512
06a28a3eb1cbb0de15cebc7cc3a85e9a71140f5c3de2075c4dbbee7c4cf5ec59b9fc949c84a83856f5c7354589c9e971620b94af3cdfdade425d82264f9bf7c5

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
125KB

MD5
bd917b7c754b7c4b223bb39198ff3bbf

SHA1
80cf9c9cab2d98a84f5ae4e962124f20d213b2a0

SHA256
11b19882a8f32cd88def7f11c3d1121d9e203a5ec4d40e442a4bf3608da68e52

SHA512
e962d8d794ebab392bdbb3ab931d9c0eb90b6f2e60220656b64c9ace4c4f3a2c2bd01f9b0843d98115dab99cf721b4f3ac7dfbb62c66184cb2f00b8b2305d816

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
125KB

MD5
8860779053a12afccd1e374cbce38926

SHA1
42e5ed1f4ebf53c6254dc95936c6b564a4055c1e

SHA256
799b353f004fd2a5f17743ec4a8c5d10fb61db2734e302795e9af3efb7b7651c

SHA512
bbe5e5243ce7e68bcde201e5c0ed8267d1c59700be6e22f46c25333089451e992723f7d515571621bd96f69d6102cf7f27a203621eadc75387a72e785f82fd41

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
125KB

MD5
1fb06cba27c2d48be101dd2f23a56df0

SHA1
0c464a2377ac247a561e4c36c96e7e6733220711

SHA256
cc92bfa1afd21da39bd98bc3f5c2de1004575b0a6c1b3524bc7c653b569bfdb9

SHA512
7a925d679ed922caf5be9bb19eded380e3dd3b2bf40796d36dd35e9e85c2825f478558747cb48ce2a0e1aeab580a64aef46ec6d82e8a11258d984e90a00db4e4

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
125KB

MD5
5274c4048a474953a4fbb4dd68dab086

SHA1
0746ed978e3ae5e8388552132cc3d70d7c2dc4c2

SHA256
d2d8577f7f467e2b029f622427515796006bb7a3dc06c2e60a8c604ceeb24aa5

SHA512
10b4e1eb1b19c383ae1cec4301960ecc41e6434e56709943a7d5a7a3af2cf9e8f2b832508c0abbec7fa14de24b8ff1f93f7b73a0a7b4676c330d66f0736782b5

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
125KB

MD5
5cb21192b1ca1d9643d278a47107e181

SHA1
52bf8da7148f5e45deedba79e1e00ff0acebd004

SHA256
09a920497a264225485766369dcca3f704b9e1b2e55ff2ceeb48726f66447515

SHA512
a7766485ed3dca27af678c712a7a093b70165da50185b558a86d3924ec2340bf4658275096909d783b38271acac6854a797e215aeb84c83caf147741f81580c3

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
125KB

MD5
98c3f5f020ab97c9e2f7282af5edb85e

SHA1
cb8551e31ccaba0c6feb363bd73d80c5b96b5e6b

SHA256
86497982ba090901f5ad2ff5268be4283da1714e03f4da71447ba6f2e4f98413

SHA512
1cf578110d6cd8d1ae4edf4ce73af173df9b57319543c2831aadf91c8d8ad820b86d2b27a93e9f6c7361bb89b36abca6802bbf29705d46078c07537216dfaeb6

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
125KB

MD5
7f108a5dba35bdaad55273a1f16032bd

SHA1
e0a797c298432be67efc541dda2c931faf153791

SHA256
dd636fcba077ef4ceac53e5f38baca192d2f66731259ef06dca17ec685903f10

SHA512
b84283458bd06adcedee20139be2bc9fa7c8a9d27945406b70b6cad6986c2d648f0c2db965b6c64a06b870cdc7ec651d088e4aaff27082a13c5565c01b8d0162

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
125KB

MD5
d4e30444ff09d4a0ea34c7a533bef2e7

SHA1
8ab17c41eb34285662e3673fa0dd7cca32178556

SHA256
91160e23064ffcd3317098d861b555c9d131a6dff4a74b8e1dcabe569c207f70

SHA512
7519ca0d33fab4dfe128db35eb82eca78622656abb4bb6bcb974c926caf033fdef58c036af4ba5bd7ba8677af5c33fc4640542a0f99b7233c1cd7de7ae828011

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
125KB

MD5
7ef9ff9117ecf374066e7a8ab8e32f55

SHA1
ce8bffee42500cbf478b8c5bab2f4b492aacd312

SHA256
1bd8425062954bbf111c57926ef8b223c9f9ba2b5bae448275e5d5864130801c

SHA512
a00d6fdcbb76dba8600c2a4b0f13cde58c809ae47ab1fb907996afe9c52acd596b70173b7fc1fdbef35d2b70a9fc84ce3941e8f8ebd3b8b6b478beb9a3475b04

Download Submit
C:\Windows\SysWOW64\Oicmfmok.dll

Filesize
7KB

MD5
24d72cab4e0e729e0c5a1e3d0d9dbf87

SHA1
e097b827b3b64cef486df6dad0158c4362e2d332

SHA256
bd89fe72626a6339bc09c8731eb0e1d24eb891704a93350f9225a60dff8addc9

SHA512
6e1afa3ad7b99ff7614c3dd28ebfaa6cae8590827b898a5da14b27dd81977748869cae1fdc4472f8618bfc69f12e520e0b6b1653ff9d7a8795823aff189083da

Download Submit
memory/224-288-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/224-63-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1240-168-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1240-275-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1380-293-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1380-31-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1440-71-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1440-287-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1536-266-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1536-240-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1648-144-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1648-278-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1788-111-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1788-282-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1888-127-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1888-280-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1980-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1980-279-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2100-291-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2100-39-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2168-199-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2168-271-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-264-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2308-256-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2316-276-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2316-159-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2372-290-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2372-48-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2576-95-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2576-284-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2632-269-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2632-215-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2960-184-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2960-273-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3008-152-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3008-277-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3172-80-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3172-286-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3204-292-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3204-32-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3296-263-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3296-262-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3644-295-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3644-7-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3664-104-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3664-283-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3948-191-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3948-272-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4180-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4180-296-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4264-281-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4264-119-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4304-55-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4304-289-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4344-224-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4344-268-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4672-267-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4672-231-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4912-294-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4912-20-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4924-265-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4924-247-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5048-87-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5048-285-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5072-207-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5072-270-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5088-175-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5088-274-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads