berbew | c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
Size

163KB
MD5

7cc92c428a494761e3b849230e40fef0
SHA1

382aff974acee9ea75cdfa3901f31240af8b321d
SHA256

c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785
SHA512

d72b41d84a0770d474ca553f15aea7800ef3821bec61e242ed52097b81423dfb9949087e2e89f7ca513f7f74230b535ac5bd80c434076898c3e8941a21d13772
SSDEEP

1536:PqZQ80PjP+OjtTXPH0nqRlZLVQlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:x8YxV/0g9QltOrWKDBr+yJb

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liddbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnlgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfhlejnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimnbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1708	Jfcbjk32.exe
3600	Jianff32.exe
3048	Jmmjgejj.exe
4888	Jlpkba32.exe
1140	Jcgbco32.exe
1512	Jbjcolha.exe
1860	Jfeopj32.exe
436	Jehokgge.exe
3536	Jmpgldhg.exe
796	Jlbgha32.exe
2056	Jpnchp32.exe
3888	Jcioiood.exe
1036	Jblpek32.exe
4256	Jfhlejnh.exe
3064	Jeklag32.exe
3348	Jmbdbd32.exe
3676	Jlednamo.exe
2168	Jpppnp32.exe
4872	Jcllonma.exe
4484	Kboljk32.exe
3520	Kfjhkjle.exe
3112	Kemhff32.exe
3460	Kiidgeki.exe
904	Kmdqgd32.exe
3496	Klgqcqkl.exe
856	Kpbmco32.exe
5072	Kdnidn32.exe
1700	Kfmepi32.exe
4516	Kepelfam.exe
5116	Kikame32.exe
4240	Kmfmmcbo.exe
4932	Klimip32.exe
3008	Kdqejn32.exe
1484	Kbceejpf.exe
3824	Kfoafi32.exe
4924	Kimnbd32.exe
3028	Kmijbcpl.exe
4596	Klljnp32.exe
2140	Kpgfooop.exe
1320	Kbfbkj32.exe
1048	Kfankifm.exe
3444	Kipkhdeq.exe
1500	Kmkfhc32.exe
3544	Klngdpdd.exe
1576	Kdeoemeg.exe
4744	Kbhoqj32.exe
2988	Kfckahdj.exe
784	Kibgmdcn.exe
1820	Kmncnb32.exe
2840	Kplpjn32.exe
4372	Kdgljmcd.exe
4664	Lbjlfi32.exe
1584	Leihbeib.exe
4344	Liddbc32.exe
2612	Lmppcbjd.exe
1580	Lpnlpnih.exe
4284	Ldjhpl32.exe
1540	Lbmhlihl.exe
3608	Lekehdgp.exe
4208	Ligqhc32.exe
2440	Lmbmibhb.exe
2896	Lpqiemge.exe
2096	Ldleel32.exe
2000	Lfkaag32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Ocdfloja.dll	Kemhff32.exe
File created	C:\Windows\SysWOW64\Jlineehd.dll	Lpnlpnih.exe
File created	C:\Windows\SysWOW64\Mplhql32.exe	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Pnjknp32.dll	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Jfpbkoql.dll	Oqhacgdh.exe
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File opened for modification	C:\Windows\SysWOW64\Jlbgha32.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Llgjjnlj.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Ogibpb32.dll	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Ndaggimg.exe	Npfkgjdn.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Idodkeom.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Ejfenk32.dll	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Gallfmbn.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Ojaelm32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
File opened for modification	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kikame32.exe
File opened for modification	C:\Windows\SysWOW64\Kbceejpf.exe	Kdqejn32.exe
File created	C:\Windows\SysWOW64\Pkfcej32.dll	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Ecaobgnf.dll	Mmlpoqpg.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Ngmgne32.exe
File opened for modification	C:\Windows\SysWOW64\Lfkaag32.exe	Ldleel32.exe
File opened for modification	C:\Windows\SysWOW64\Oqhacgdh.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Djnkap32.dll	Qmkadgpo.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Olfobjbg.exe	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Ghngib32.dll	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Hledan32.dll	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Andqdh32.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Edgbbfnk.dll	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Dqfhilhd.dll	Aepefb32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Jjbedgde.dll	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Kboljk32.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Kmkfhc32.exe	Kipkhdeq.exe
File opened for modification	C:\Windows\SysWOW64\Llgjjnlj.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Lmgfda32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Acnlgp32.exe	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Oahicipe.dll	Afoeiklb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7920	7620	WerFault.exe	343

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlampmdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mplhql32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpnchp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcncpbmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kipkhdeq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbmibhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbceejpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbjlfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njciko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhmhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpbmco32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmpijp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neeqea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldoaklml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kimnbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmpcfdmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kemhff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnidn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndfqbhia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngdmod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kplpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likjcbkc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdckfk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmngqdpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmkfhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnpppkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdhdajea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmbfpp32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iihqganf.dll"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jeklag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaiann32.dll"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hledan32.dll"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfcbjk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfmccd32.dll"	Ngpccdlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgdelcpg.dll"	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogibpb32.dll"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfcej32.dll"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhbbhk32.dll"	Kdqejn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjknp32.dll"	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgbbfnk.dll"	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjiccacq.dll"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcjpfk32.dll"	Lgmngglp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 1708	3264	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe	84
PID 3264 wrote to memory of 1708	3264	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe	84
PID 3264 wrote to memory of 1708	3264	c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe	84
PID 1708 wrote to memory of 3600	1708	Jfcbjk32.exe	85
PID 1708 wrote to memory of 3600	1708	Jfcbjk32.exe	85
PID 1708 wrote to memory of 3600	1708	Jfcbjk32.exe	85
PID 3600 wrote to memory of 3048	3600	Jianff32.exe	86
PID 3600 wrote to memory of 3048	3600	Jianff32.exe	86
PID 3600 wrote to memory of 3048	3600	Jianff32.exe	86
PID 3048 wrote to memory of 4888	3048	Jmmjgejj.exe	87
PID 3048 wrote to memory of 4888	3048	Jmmjgejj.exe	87
PID 3048 wrote to memory of 4888	3048	Jmmjgejj.exe	87
PID 4888 wrote to memory of 1140	4888	Jlpkba32.exe	88
PID 4888 wrote to memory of 1140	4888	Jlpkba32.exe	88
PID 4888 wrote to memory of 1140	4888	Jlpkba32.exe	88
PID 1140 wrote to memory of 1512	1140	Jcgbco32.exe	89
PID 1140 wrote to memory of 1512	1140	Jcgbco32.exe	89
PID 1140 wrote to memory of 1512	1140	Jcgbco32.exe	89
PID 1512 wrote to memory of 1860	1512	Jbjcolha.exe	90
PID 1512 wrote to memory of 1860	1512	Jbjcolha.exe	90
PID 1512 wrote to memory of 1860	1512	Jbjcolha.exe	90
PID 1860 wrote to memory of 436	1860	Jfeopj32.exe	91
PID 1860 wrote to memory of 436	1860	Jfeopj32.exe	91
PID 1860 wrote to memory of 436	1860	Jfeopj32.exe	91
PID 436 wrote to memory of 3536	436	Jehokgge.exe	92
PID 436 wrote to memory of 3536	436	Jehokgge.exe	92
PID 436 wrote to memory of 3536	436	Jehokgge.exe	92
PID 3536 wrote to memory of 796	3536	Jmpgldhg.exe	93
PID 3536 wrote to memory of 796	3536	Jmpgldhg.exe	93
PID 3536 wrote to memory of 796	3536	Jmpgldhg.exe	93
PID 796 wrote to memory of 2056	796	Jlbgha32.exe	94
PID 796 wrote to memory of 2056	796	Jlbgha32.exe	94
PID 796 wrote to memory of 2056	796	Jlbgha32.exe	94
PID 2056 wrote to memory of 3888	2056	Jpnchp32.exe	95
PID 2056 wrote to memory of 3888	2056	Jpnchp32.exe	95
PID 2056 wrote to memory of 3888	2056	Jpnchp32.exe	95
PID 3888 wrote to memory of 1036	3888	Jcioiood.exe	96
PID 3888 wrote to memory of 1036	3888	Jcioiood.exe	96
PID 3888 wrote to memory of 1036	3888	Jcioiood.exe	96
PID 1036 wrote to memory of 4256	1036	Jblpek32.exe	98
PID 1036 wrote to memory of 4256	1036	Jblpek32.exe	98
PID 1036 wrote to memory of 4256	1036	Jblpek32.exe	98
PID 4256 wrote to memory of 3064	4256	Jfhlejnh.exe	99
PID 4256 wrote to memory of 3064	4256	Jfhlejnh.exe	99
PID 4256 wrote to memory of 3064	4256	Jfhlejnh.exe	99
PID 3064 wrote to memory of 3348	3064	Jeklag32.exe	100
PID 3064 wrote to memory of 3348	3064	Jeklag32.exe	100
PID 3064 wrote to memory of 3348	3064	Jeklag32.exe	100
PID 3348 wrote to memory of 3676	3348	Jmbdbd32.exe	101
PID 3348 wrote to memory of 3676	3348	Jmbdbd32.exe	101
PID 3348 wrote to memory of 3676	3348	Jmbdbd32.exe	101
PID 3676 wrote to memory of 2168	3676	Jlednamo.exe	102
PID 3676 wrote to memory of 2168	3676	Jlednamo.exe	102
PID 3676 wrote to memory of 2168	3676	Jlednamo.exe	102
PID 2168 wrote to memory of 4872	2168	Jpppnp32.exe	103
PID 2168 wrote to memory of 4872	2168	Jpppnp32.exe	103
PID 2168 wrote to memory of 4872	2168	Jpppnp32.exe	103
PID 4872 wrote to memory of 4484	4872	Jcllonma.exe	104
PID 4872 wrote to memory of 4484	4872	Jcllonma.exe	104
PID 4872 wrote to memory of 4484	4872	Jcllonma.exe	104
PID 4484 wrote to memory of 3520	4484	Kboljk32.exe	105
PID 4484 wrote to memory of 3520	4484	Kboljk32.exe	105
PID 4484 wrote to memory of 3520	4484	Kboljk32.exe	105
PID 3520 wrote to memory of 3112	3520	Kfjhkjle.exe	106

C:\Users\Admin\AppData\Local\Temp\c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe
"C:\Users\Admin\AppData\Local\Temp\c4fe0d215a850a8330e2985a2610dab60a0c4340d82e05b9f0eb6a174d260785N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\Jfcbjk32.exe
  C:\Windows\system32\Jfcbjk32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\Jianff32.exe
    C:\Windows\system32\Jianff32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\SysWOW64\Jmmjgejj.exe
      C:\Windows\system32\Jmmjgejj.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3112
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        25⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        26⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:856
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5072
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1700
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        30⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5116
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3008
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1484
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4924
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        39⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        41⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        42⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3444
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1500
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        45⤵
        Executes dropped EXE
        
        PID:3544
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:784
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2840
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        54⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4344
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        59⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        60⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        63⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2096
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        65⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3132
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        69⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        70⤵
        System Location Discovery: System Language Discovery
        
        PID:3012
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        71⤵
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        74⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        75⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        76⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2836
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        78⤵
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        79⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        80⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4568
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        83⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        84⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        85⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        86⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        87⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        89⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        90⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        91⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        94⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        95⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        98⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        99⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        100⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        103⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        104⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        105⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        106⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        107⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2520
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        111⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        112⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        114⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        115⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        118⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        119⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:3300
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        121⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        122⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        126⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        127⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        128⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2192
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        129⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        132⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        133⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        134⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        136⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4848
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        138⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        140⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        141⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        142⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        144⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        147⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        148⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        149⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        152⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        153⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        155⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        157⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        158⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        159⤵
        Modifies registry class
        
        PID:212
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        160⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2648
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2780
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        163⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        164⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        165⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        166⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        167⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        168⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        171⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        172⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        173⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        174⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        176⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        178⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        179⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        180⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        181⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        183⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        184⤵
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        186⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        188⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        189⤵
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        191⤵
        System Location Discovery: System Language Discovery
        
        PID:6596
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        192⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        193⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        195⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        196⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        198⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        199⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        200⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        201⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        202⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        203⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6872
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        206⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        207⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        208⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        209⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        212⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        213⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6580
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        217⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        219⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        221⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        223⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        225⤵
        System Location Discovery: System Language Discovery
        
        PID:7540
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        228⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        229⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        230⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        231⤵
        Drops file in System32 directory
        
        PID:7880
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        233⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        236⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        237⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        238⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        239⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        240⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        241⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        242⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        243⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        244⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        245⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        246⤵
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        247⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:7936
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        249⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        250⤵
        Modifies registry class
        
        PID:8068
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        251⤵
        Drops file in System32 directory
        
        PID:8144
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        252⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        254⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        255⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7620 -s 404
        256⤵
        Program crash
        
        PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7620 -ip 7620
1⤵
PID:7844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
64KB

MD5
0895dab1df6a845023bd05e9c59159ae

SHA1
449c511c0ac3a00c2ba5879b4c2169c2163e52a6

SHA256
b55c77c9f18afd41c749bbbc8b57e2bab733ab827a94d015eac928552ec5228e

SHA512
c504d850a35919906f5dfdd9c4da4fca19ab8616648efb4bd20eedc8bdbef9c8e25361a87e14ad81b5125df763b56b58c8efac0f5ec2beaee5fc2df4ece7681f

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
163KB

MD5
55c62b6213b9fc7c57bfa28c44db11be

SHA1
f0f14914145d14bd57f75c9e2e2dfa6b914781a7

SHA256
86fd1584245a957f80e6e0180b011d798bb09ceec8b5df537a8aff86645542d1

SHA512
f86b1594ecbaed636c4e9c257daef2589596f749af8bb0611044288cc0be79bac038d7918e3fabb1c29864dae54a908ebf5f4c48996a709ea9b102478d954557

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
163KB

MD5
4843a3ebb760b2a19bc49d4077ea254d

SHA1
1fce76776787889ade2984aad8abe06986c7605b

SHA256
f0182f8ed4a00450ee508fcca349fcd39bca42fb6751f872fe5b048c2ca48343

SHA512
c34b4b7ddf5f68b6f1f10dcabc4c937d7d0ec89db3334dc401df2acaab3c20cda1605b2cd67eb38b2e69b2a35eb8af46fed30e88a4f660e73762c72da955c107

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
163KB

MD5
820baabc60d7766cbada4b9a99e2f562

SHA1
84783a6c992ccb2c28877a9ff1b83aeb74bfa852

SHA256
d0f9d198170802794bbddb3c9a890f2eb8500844198f2d5c2823bfb97a7ea564

SHA512
b6c5f87cfa2e73000cfe4d436d4ea4f6050169dcadb500d2c17ee5afff2cc25203d48df814f3f4d45028468bf3e998431435c2f3753e6d08bc2e912567784b6b

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
163KB

MD5
687c0260c4345d1cab066e00ed1e8f0c

SHA1
ea2570719dc2cb88a180f1cb914957d301057d37

SHA256
58ca0421fdcf3480821b315ad6bd120fff868ca9ce418646ec42e08ef1b267d9

SHA512
feb4bb93b0c5386f0b121675768bbf8c67403e8b332c10056db5037d653979743a082b4921da5507b3d1c6fa68e26059c615577e311105a7589df5dc0267e52c

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
163KB

MD5
f4e4601bf12e1000c60ee5257b3535f2

SHA1
bdb2e8ad4cee3500704cebb2868bf5ec87a9c398

SHA256
0660c120a168cb185e1a2905477c6e8bb63e1591ce45d5c9f612acd67cde0c20

SHA512
36bf5c4ffd5398f56c8efac3db75d6afbba08bd64a1f0d43869b4f96ebaa35b86a6004d79ae44025afef816d1ca1c09926e2169f35c43c642586a64fb8c05e58

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
163KB

MD5
dd3ba581867a816df365351624917414

SHA1
d65b8999bf3a7acf3c1f4c339946c8b45cbce73f

SHA256
3ec45cd1287fe2a9e9a8861658d4c306f432257001ed16ce3a75f2cd6c9727be

SHA512
17d4de778f51d67eee3f98461b209ce414ad76e155c822660d1f6fb0c1bc8196a8f8d82bf81c111607d504d2cce178828e0d90abf3f15c0feafb5157f52fdcdc

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
163KB

MD5
dcd0804b0ba6cecd30c973f899c94946

SHA1
39bac84e8a4e9d012ba2d59f98a1266a95f33812

SHA256
35476043fbea1ce111a2a703b9628fc42ad5f4f3732435a38c350f9d3f9c4432

SHA512
89d0e60568c138f4bc4b478f5356229da56b8c2972e2b356508320d611cc2c992e48775f389edf9f47fbd49f59f19b10de88dd9024b074a46cd49b708a92d611

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
163KB

MD5
d4f617167927573320f3a2886bde6298

SHA1
480836ecb8a7c6213322a0ce7e3c780c3c9b8a41

SHA256
b3099cdbe2548fde46e4bbf087924214733a1855ecd5a5fb665ab6ccdc89f5d2

SHA512
a465b8a940785cccfb36cedb44948b52b347cea14f6e99316c742a42d623114b1ca2e5dbd4e7c59ac91290cdfacf28dc02f082d8604b8984e14175571204560d

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
163KB

MD5
f348e494faf754ba2fc90e5515c79eca

SHA1
2bbc380fef88accf5a704933b042b0a78f0da7fc

SHA256
6e339d959961407f07158102e1069c7b39f784450b5828ef02bee114007c370a

SHA512
ace635581348c6b95efcd2866f9008410a0ace9a75c69973cb0fbe87034787171db0235d6b95f128f97b954523e04c38a255bc067f3e29a79ea500d5b0bc70b9

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
163KB

MD5
edf72100841d521f26af5fa01f2a8de7

SHA1
b98fdb68666ef280cb863da9a5972b21a2063024

SHA256
70b631e13c10dccbc4406108a23b6aa346cd26478a81ece8c121afd7895a75f9

SHA512
53d0c33fdecbe319d5d352878991363cfca2f38d5639484ca6037d4e793b87e6f1f1891fcb6611f6a93ba4242e4331ad50c9224bd9b57591d7ec063e89116784

Download Submit
C:\Windows\SysWOW64\Jfcbjk32.exe

Filesize
163KB

MD5
fac6c8c5aea95cc3b0c1cc848ab26ba3

SHA1
935d5efbc59e28bd8841fa0b8dfb62bfb89953cc

SHA256
201e14cfd01c918a860ce796865b6e82ce35a1db0fe9f7b7bbdaddcf3513cec9

SHA512
44ed61c74feea81f2bb8b5a0d1029fbf6ee834759162b5db12838c35cb0ba8daf5d565afdb8044b622fb2c56881c0783e906648615f7b3e791ee48abd3ff1073

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
163KB

MD5
89bf53791796321af56e15d292d244ff

SHA1
fc65f731f3375440ffa3ef45a88ab9c48bf63f6f

SHA256
5d08f2cebaf3cec2fa8d1a5069fa04337c041324f808b05223c0a22c0f5e299e

SHA512
fe7dfc9d0e78ee0bfe4186d823fc8a70620aad544ea06fa4c22c9eaf4eaad6c9554afc4f6fda42d583593c3e4ad0b937c3c0b4f9ce867a1a5c6b35ffb8f24287

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
163KB

MD5
6a7827c0edcbd958f5550ed558fed3f6

SHA1
34481f5454caf2d383b0be618b500dbc4e2bab31

SHA256
4c5f6eec66d71f30baae7b71e9a0840ee3915b37780aa06be5763fa584a75cb2

SHA512
77af73d19ddb47c55c302b17f1d82157696ff4aade7e58477c66ddb8a747caf9385e5b928c9e648d4e6afa95c7fc39238e73169c8e7e44378c56e32fe7564e31

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
163KB

MD5
c69724210ee36b8c73cb181e03b471df

SHA1
e658d6c1dafa1c392789ed311396223103b810af

SHA256
89d0b47de3047c08794906939fdda23132e63850482f106647b2496dfe479abc

SHA512
eab97a6d8222adce06ab031e96189d1d301f172ce513bbeb4c60480f765d94cd4760dcdf7ddf7285d5dde405bc99d184ededc43ebcc15659f5e5119f18dfd188

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
163KB

MD5
5c6533ca3dd538e2603b1050cf1f9c12

SHA1
09f12bca4ffba9ddbf74119e5d5caa40ae764f13

SHA256
beaf8c41670d3519569c39136b9deec56b624b2bce0d14d5eb6f71fb77189242

SHA512
4564d581e5f8c6fed5e3fb477cd1de8e4140c754e4604979a8333086028a8ce5a053ce52c2ab7ad93581b3e24eacec8b280c9e87b89dd42e875d8da3aa19a450

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
163KB

MD5
72653b0d5f1e8aa2101396f2e99cd061

SHA1
7e957c277f733d49903c43d0697e8bd0ed34146e

SHA256
bedf4013a94281f54d7db8a0a11094b3ca2e788e7c9b094f6508d8de59170248

SHA512
b99f921743da0c418fc03cd2a9ab0da76f2e7fbb71b81757d0be920fde90a83dc5f5b7220813784ffae13e66a24b036e5de7aa79d2fb4b4be78fad51f75e548b

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
163KB

MD5
52160baa110857677833b7dc55cf16a6

SHA1
b757c614ae1d10564741fd2a9e2713d83f072baa

SHA256
0a5b6a925e8b90d878b5a89c1c9aa44c97389b54ecc77853206e2c7e769c8ffa

SHA512
522f61fcc311317f1df23f4e62a1552442fb756d4a65916dad7a211e28feb6cf4979a57cbe2e99e8de3f43bb296a85ee886bc1032ed058b73388027be9f4a2c5

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
163KB

MD5
1a13a5d398d76664d7ea83a856b4490e

SHA1
b6ef7cbb4be770b53954b7ed881eea9168fc8722

SHA256
9f0a1154167f033d16f530dcbc14ffc265a7dd6bdee230447355a92ade7e37b4

SHA512
92953963a3a7a79f15bd6d956b603b94e4f880aec8315f7b7cea61422448e260825842bb611136b1c77efc236cbfd46c076a261a81d10d5fcef778a91247f7da

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
163KB

MD5
ea09dde9a211b0417a1bf4f2d23892ec

SHA1
b92619fa8e4aa0f8f0c01ab30a0a65b9aeec3377

SHA256
78e3f8f0d09e54db2ea67b7ea969c34ee88a7e05db9d553d07dc250865e0c9e6

SHA512
a5b446accf5d9d4e94db09823e2b20c6ac9cfca484438bf3ba06d25331a4aea4e2dc7372d79b594df3ee401ebf9097319073f7c3cffc8e1f1d52247c4bb6d0d4

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
163KB

MD5
5b5a3522593ff2bcfc4cef7d40d11a39

SHA1
8be9c2be3026031447c01a94930512fa4071156d

SHA256
2ea26adafe2619caf33d5566c86c130fd2da6d1b439058ca3aaca71fdb206e01

SHA512
e9ae1ccc7a22add31ab986abe1ba2cd6c7e5fcc6ce05c6420684ae9a237f9d3ce9d54c8402175c370811b23ab61875d6816ff3f54fffa9dcfe610442b85df835

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
163KB

MD5
68cd2543769c0591b98dc4febcf375f6

SHA1
b2fa467dfd4a3a270d6adbe59a17c8616e666f21

SHA256
57533fccb54dd8481d601cb4ed087a436685553444fc9f0579ba2f6c194507ca

SHA512
b18ad55cd7f6afc69b0cd4b487b8a27ba785749579cd43590e45a25a342effb03bf026da1e8f3513459cb604d980e46b1820da543a83e9dcd70fb78daeba4ac3

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
163KB

MD5
6632c0b42f23e59792a0d135f56c3f71

SHA1
58c73bfbda7119a7633568b4ff7023574477d8e0

SHA256
8327ae461f029d691b9821bd5a5b3b74f2d800fe104309c59704b77cc50f706a

SHA512
260223b465b808c61b379d09c20da6833883134efaec43cbd7e9e657b456a10a77a75ef664aac232f1639800b2e23eb6896a4ffdf4e9cec898f0a9917b6559a2

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
163KB

MD5
7d289a5149825b6505f906eb7b7aa0b8

SHA1
3276730530767f921f10243fec881a29bce03890

SHA256
cad51a5a7b4d4cc8861f38b6ccdbebc9c0c696c1a93841bba9e3bef2d81293fa

SHA512
4134ea4024cc5a36fa0413c9c6ea1d4db7bb0cddbd029056e6d3c1988ba7f08e3a4d31afb4b3eb97540c269d9da5441a952e52a52a28c78f52f4e60dcc625d13

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
163KB

MD5
f91d1a57ce0de7768d2cfd42036c0eb5

SHA1
0acab1f9749b4d55ff75f7cf94b1400db751e588

SHA256
88ef2efb72675a1c07e619a8e7c001c991747b22e7edadff990241bc4b1299cf

SHA512
b9d492464038b2e4466c64dc642faed9c8bcb3fade4edec375af352eb1d490e82bb58c36017872ea33a62c6e9d4d94351c8a35220c4e7c637fe36dce5f2fbd09

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
163KB

MD5
a6550ae39d323d4835dc47c6c64a0bdb

SHA1
809107f03b9471acf3804cb27abbbba07e8109f9

SHA256
51a05cad8aa9e84bad2f2d0199b581317b964a503aa2551571b35cf7b6be4e16

SHA512
f671613362ed0ba6cf1298507145b0b1d38e1079e1edde8815edb5c9d780d54839608534b78a439cb2476c54a8d9422893ebd9aa4e3c150ec3ac5ac036a71ac8

Download Submit
C:\Windows\SysWOW64\Kepelfam.exe

Filesize
163KB

MD5
c8142229ff6ef26adce0bdc75e4facf9

SHA1
0ecefbcd43fe2bf6ddab0e2d1c9f880b7dcba6f1

SHA256
8cf52a9ce35e97484aa8fcd73643d8f9dd6261276df997eab135dcf0d6b8bf8f

SHA512
ca2027260a193df13677c275e57e21f02be05e000b3e65e4e44accdfd32c1517edd432cff3512cd5527d074d6bbb16d1ef07ce1c1443b7d7e6dc1b1193690313

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
163KB

MD5
f6632e7178f90eb916e53b982220beec

SHA1
7eca0a5ab1b178a5e9867cbaf1602bbf8e85d93e

SHA256
926ea156db8324d071a2ae152ea71662efcfe4f7074e9abcea9824ee609c1a5f

SHA512
1c3781a099de347f3e6a604a5dbeefce2ef713af0a51e5a119cc4994cc311d82ff53d67ba635f89c1f1e7da4029668e73d9502c7737c47925d76763471e0edf5

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
163KB

MD5
adffff1d9c4dd7591e136dab890d27b2

SHA1
cd0138a9d26bdfe11bcfae53e550aa6fc4170e63

SHA256
a7e1a4f1ed01960ff34902b40784c556fa338bc9bd529646b6c64fa85c07590f

SHA512
f4618fe03f81771277ee899bbf1ddfb81ad2dbdef2f8e01f71b56a8129cbb8228cfda9403b48c6213f6063ff7ade5a4ec5f44c227dba8740cb7198b817dcedb9

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
163KB

MD5
36ddcb82e6c2c8d228f37136dd159865

SHA1
5e61ec4b67b40754e59f79ebad85504867d753ee

SHA256
191c8da05b90ff81ec7adc01b43aa0281dc563ba218e54609a4512a6ad6443a2

SHA512
fecea7f5e72195878205f1b05aea986065b85d0c4c87835c169f43921f5d0f244f5b6643bd6dd0f27c3d2969a251d0e192dbbaba6db5781db0f3263577966ea0

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
163KB

MD5
c237f6236dcdee4b84da2b446e171710

SHA1
acd20344b2c980fbce48b7e9ab8e28ab5aa343b0

SHA256
b1772c52a10b7b1035072e28bd7c549f62d666e57320fa97da1456a036deb578

SHA512
d949696aa334a49380a54165b12dabc754f68d50090fb465662c7aa8571005a993ee035c6c0341e045c2fa47c851572c1b5dc64421aeb07982501e7ed3e38333

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
163KB

MD5
ecefdfc6a74cd10920514dd7e0461661

SHA1
c44808e38462c95610dd6b3f65183345d9d97594

SHA256
a18ed5e8732f5cbae051d739d3a111437626ae172e184d38270be4a318e8e73a

SHA512
bf7f5f7d6c5efd05811a147dd30dabe2b6f82b7a5e1a16c8fffa0b3e8b3bbfcbe3c208dc23edf34b81fed527ecf6e2df41f6f0b3a3a562d0838e469601dba15e

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
163KB

MD5
0a8f54e1afefbf897936f91b50b02017

SHA1
b7f3d4c3fd10220a71e2745da4dcd6f2d4513428

SHA256
fd2d77807937153ae6624cf3b2439ca59cbf24af3a9175ed46332d1733caff55

SHA512
47ff7ae51a5cf5424f9dedb27a0f84b10f2721f25d19182995faa88bcff5a8c47e9142b52bc64bb3680506549d28f080b3a3bd1368a5bae65ee276394f752c85

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
163KB

MD5
b3903b2dc076bf830cb7f16d2ebe51b2

SHA1
f8770c7f5337632d3bae230d7267f4adfa53d167

SHA256
361e04bebbf00396adf47be0a0d07d30de5b8172e7e677f5bf0a01299500e6ce

SHA512
4dc66c23faadef50291201828454c66026d7e2f9e92c1390cfb4dbdeae07dead08bd7ed047bb1b4fb9963675d71a2e45eb1c752b0fda765c15a57efea086bad1

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
163KB

MD5
65fadf8968df3ff34b5ae4025092d70c

SHA1
d4aa647be7e9a510d6ce775a51d064a043e1e150

SHA256
973c95101b7d836e8595481dd2b403d47a261e7540128835eb3ace485c3763e9

SHA512
f1449182d584ab417351853ee63b48d7ab5c586615c22cf4d9bbb6237235ab2bba7337b8992398533dbf0befd2b4aa3a037293039a31087c77f26371a44143c7

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
163KB

MD5
b38c6f63388f13f49da2f91b1e09ab36

SHA1
d00f4596b5d7f08cab67f3b8180c6eb5f95c9b30

SHA256
54a98e8c73e79688f5884971098add8ac5593704118f6a99586b56a7bcf5968f

SHA512
a90dde2b6d62c4ef45028a7c1f4e2d877ea94bbdd9e1316a9558940f9fccde86a7e02ccc38ef2a503684123a548a0f12ad0edcf22e8e7e5da9e362e6fe24829b

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
163KB

MD5
8f171e6930df21ca07e4c5108d7be106

SHA1
c9aad848d3265b671da651f5a28a09314a07b4f1

SHA256
43893dfc2f3933f6489556911bdcbc72ebd74873440de94cd5c41c5e799b046e

SHA512
34779cc31cef521e1ec4df798810f2cdd7d8d89b848b3ae8532fe4069d9e00031f3c2cea6ee4c0af6ba63b6c878de4e282d89fb643e64e71399f8554e244029a

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
163KB

MD5
6715cfc349d3e47e28cc97c5c6e2f9e0

SHA1
9803bbc94ec079dc292f6c4d94c4d4724e9e9b02

SHA256
91137b3f84289de9b95a52a7d36cf571d0d7e0f6489993e8db2a4619bc5675d3

SHA512
6117c9a3d217016c0e8ed0c351fa41066c431e65a785d221476db9a1d49f86f85429363222e55979a296c64abde0adbf20663f2e473e026ac7eab26e07f46ff0

Download Submit
memory/436-68-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/436-578-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/784-352-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/796-85-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/796-591-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/856-210-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/904-194-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/904-681-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-609-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1036-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1048-310-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1140-560-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1320-305-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-1859-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1484-269-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1500-322-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1512-52-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1512-566-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1540-410-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1576-334-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1584-381-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1700-704-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1700-226-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1708-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1708-535-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1820-358-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1860-572-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1860-60-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1952-487-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2056-93-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2096-439-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2140-298-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2168-147-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2168-644-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2276-493-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2440-427-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2612-394-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2896-433-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2988-346-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3008-263-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3028-288-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3048-547-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3048-29-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-623-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3112-179-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3112-669-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3132-456-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3264-524-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3264-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3264-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3280-1822-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3348-630-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3348-131-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3444-316-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3460-186-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3496-202-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3496-687-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3520-663-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3520-170-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3536-584-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3536-76-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3544-328-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3596-503-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3600-21-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3600-541-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3628-1995-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3676-139-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3676-636-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3824-275-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3888-603-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3888-100-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4208-420-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4240-249-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4256-116-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4256-617-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4344-387-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4372-369-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4484-655-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4516-234-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4664-376-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4744-340-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4872-155-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4872-649-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4888-37-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4888-553-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4924-281-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4932-257-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4960-1853-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5008-449-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5072-218-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5072-698-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5160-1973-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5240-555-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5484-592-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5568-604-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5600-611-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5648-618-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5736-631-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5772-638-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5904-657-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5944-664-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6108-1927-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6336-1725-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/6820-1785-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/7080-1745-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads