berbew | a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6dd

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
Size 136KB
Sample241109-211npsthjm
SHA256 a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6dd
MD5 ed886289c2f193dc373d6d3623866570
SHA1 7cd755d8e6bb11cd9487575ab26f0f442c163919
SHA512 a3407925d5388cac92aa36db54db76b81e224320f8414660576447d82cec003af1d705cf4572580d8216a6dd35aa25ae132ee1a8bd80eff4c5880688ca15c318
SSDEEP 3072:8d5TaacWx97MyzQ8nd+7LjxzdH13+EE+RaZ6r+GDZnBc:8PTPPdzXULjxzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbmhlihl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfoafi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpqiemge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmfmmcbo.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
3656	Kmfmmcbo.exe
1272	Kpeiioac.exe
1032	Kdqejn32.exe
3936	Kfoafi32.exe
3652	Kebbafoj.exe
2704	Kimnbd32.exe
4240	Kpgfooop.exe
2012	Kdcbom32.exe
2964	Kfankifm.exe
4964	Kedoge32.exe
3944	Kipkhdeq.exe
4276	Kmkfhc32.exe
2668	Klngdpdd.exe
632	Kdeoemeg.exe
4848	Kbhoqj32.exe
4296	Kfckahdj.exe
4588	Kibgmdcn.exe
4416	Kmncnb32.exe
5020	Kplpjn32.exe
4540	Kdgljmcd.exe
976	Lffhfh32.exe
3172	Leihbeib.exe
1412	Lmppcbjd.exe
2028	Llcpoo32.exe
1044	Ldjhpl32.exe
1916	Lbmhlihl.exe
3680	Lekehdgp.exe
4724	Ligqhc32.exe
4384	Lmbmibhb.exe
4372	Llemdo32.exe
2008	Lpqiemge.exe
5040	Lboeaifi.exe
2528	Lfkaag32.exe
4348	Lenamdem.exe
3444	Liimncmf.exe
2200	Lmdina32.exe
3312	Lpcfkm32.exe
1384	Ldoaklml.exe
4792	Lbabgh32.exe
5000	Lepncd32.exe
2116	Lmgfda32.exe
3504	Lpebpm32.exe
2760	Lbdolh32.exe
1176	Lgokmgjm.exe
1456	Lingibiq.exe
1956	Lmiciaaj.exe
2748	Lllcen32.exe
2888	Mdckfk32.exe
1004	Mbfkbhpa.exe
3676	Medgncoe.exe
2820	Mipcob32.exe
748	Mlopkm32.exe
2920	Mpjlklok.exe
1784	Mchhggno.exe
3824	Mgddhf32.exe
3984	Megdccmb.exe
3228	Mmnldp32.exe
2316	Mlampmdo.exe
5112	Mdhdajea.exe
2588	Mckemg32.exe
3624	Meiaib32.exe
3256	Miemjaci.exe
1832	Mmpijp32.exe
928	Mpoefk32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Cjpckf32.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Kmfmmcbo.exe	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
File created	C:\Windows\SysWOW64\Gilnhifk.dll	Lmbmibhb.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdina32.exe	Liimncmf.exe
File created	C:\Windows\SysWOW64\Mchhggno.exe	Mpjlklok.exe
File created	C:\Windows\SysWOW64\Mfilim32.dll	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Iihqganf.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Nlmllkja.exe	Ncdgcf32.exe
File opened for modification	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Ogbipa32.exe	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File opened for modification	C:\Windows\SysWOW64\Melnob32.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Lemphdgj.dll	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Ocdqjceo.exe	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Qcgffqei.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Aminee32.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Fhccdhqf.dll	Kedoge32.exe
File opened for modification	C:\Windows\SysWOW64\Mgkjhe32.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Oncofm32.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Hjlena32.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Pmdfog32.dll	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Onjegled.exe	Ojoign32.exe
File opened for modification	C:\Windows\SysWOW64\Pmannhhj.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Pmdkch32.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Pdkcde32.exe	Pmdkch32.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Leedqpci.dll	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Pjcbbmif.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Dpmdoo32.dll	Aclpap32.exe
File created	C:\Windows\SysWOW64\Kimnbd32.exe	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Lpebpm32.exe	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Aomaga32.dll	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Gqckln32.dll	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Mbfkbhpa.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Menjdbgj.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Ndfqbhia.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Eikdngcl.dll	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
File created	C:\Windows\SysWOW64\Lbabgh32.exe	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Jgefkimp.dll	Mpablkhc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7504	7292	WerFault.exe	304

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngmgne32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbdjfln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kplpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lenamdem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Megdccmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlampmdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kimnbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjagjco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkkcge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcbom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfankifm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmdina32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlhbal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmiciaaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mchhggno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdmnlj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpqiemge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miemjaci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdabcm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mckemg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kebbafoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nepgjaeg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafdhogo.dll"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfofiig.dll"	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Medgncoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odocigqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjbbkg32.dll"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdeflhhf.dll"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchdhnom.dll"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Oncofm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ambgef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmfmmcbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oolpjdob.dll"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfoeb32.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecaobgnf.dll"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amhpcomb.dll"	Lmdina32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3656	2392	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe	83
PID 2392 wrote to memory of 3656	2392	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe	83
PID 2392 wrote to memory of 3656	2392	a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe	83
PID 3656 wrote to memory of 1272	3656	Kmfmmcbo.exe	84
PID 3656 wrote to memory of 1272	3656	Kmfmmcbo.exe	84
PID 3656 wrote to memory of 1272	3656	Kmfmmcbo.exe	84
PID 1272 wrote to memory of 1032	1272	Kpeiioac.exe	85
PID 1272 wrote to memory of 1032	1272	Kpeiioac.exe	85
PID 1272 wrote to memory of 1032	1272	Kpeiioac.exe	85
PID 1032 wrote to memory of 3936	1032	Kdqejn32.exe	86
PID 1032 wrote to memory of 3936	1032	Kdqejn32.exe	86
PID 1032 wrote to memory of 3936	1032	Kdqejn32.exe	86
PID 3936 wrote to memory of 3652	3936	Kfoafi32.exe	87
PID 3936 wrote to memory of 3652	3936	Kfoafi32.exe	87
PID 3936 wrote to memory of 3652	3936	Kfoafi32.exe	87
PID 3652 wrote to memory of 2704	3652	Kebbafoj.exe	88
PID 3652 wrote to memory of 2704	3652	Kebbafoj.exe	88
PID 3652 wrote to memory of 2704	3652	Kebbafoj.exe	88
PID 2704 wrote to memory of 4240	2704	Kimnbd32.exe	89
PID 2704 wrote to memory of 4240	2704	Kimnbd32.exe	89
PID 2704 wrote to memory of 4240	2704	Kimnbd32.exe	89
PID 4240 wrote to memory of 2012	4240	Kpgfooop.exe	90
PID 4240 wrote to memory of 2012	4240	Kpgfooop.exe	90
PID 4240 wrote to memory of 2012	4240	Kpgfooop.exe	90
PID 2012 wrote to memory of 2964	2012	Kdcbom32.exe	91
PID 2012 wrote to memory of 2964	2012	Kdcbom32.exe	91
PID 2012 wrote to memory of 2964	2012	Kdcbom32.exe	91
PID 2964 wrote to memory of 4964	2964	Kfankifm.exe	92
PID 2964 wrote to memory of 4964	2964	Kfankifm.exe	92
PID 2964 wrote to memory of 4964	2964	Kfankifm.exe	92
PID 4964 wrote to memory of 3944	4964	Kedoge32.exe	93
PID 4964 wrote to memory of 3944	4964	Kedoge32.exe	93
PID 4964 wrote to memory of 3944	4964	Kedoge32.exe	93
PID 3944 wrote to memory of 4276	3944	Kipkhdeq.exe	94
PID 3944 wrote to memory of 4276	3944	Kipkhdeq.exe	94
PID 3944 wrote to memory of 4276	3944	Kipkhdeq.exe	94
PID 4276 wrote to memory of 2668	4276	Kmkfhc32.exe	95
PID 4276 wrote to memory of 2668	4276	Kmkfhc32.exe	95
PID 4276 wrote to memory of 2668	4276	Kmkfhc32.exe	95
PID 2668 wrote to memory of 632	2668	Klngdpdd.exe	96
PID 2668 wrote to memory of 632	2668	Klngdpdd.exe	96
PID 2668 wrote to memory of 632	2668	Klngdpdd.exe	96
PID 632 wrote to memory of 4848	632	Kdeoemeg.exe	97
PID 632 wrote to memory of 4848	632	Kdeoemeg.exe	97
PID 632 wrote to memory of 4848	632	Kdeoemeg.exe	97
PID 4848 wrote to memory of 4296	4848	Kbhoqj32.exe	98
PID 4848 wrote to memory of 4296	4848	Kbhoqj32.exe	98
PID 4848 wrote to memory of 4296	4848	Kbhoqj32.exe	98
PID 4296 wrote to memory of 4588	4296	Kfckahdj.exe	99
PID 4296 wrote to memory of 4588	4296	Kfckahdj.exe	99
PID 4296 wrote to memory of 4588	4296	Kfckahdj.exe	99
PID 4588 wrote to memory of 4416	4588	Kibgmdcn.exe	100
PID 4588 wrote to memory of 4416	4588	Kibgmdcn.exe	100
PID 4588 wrote to memory of 4416	4588	Kibgmdcn.exe	100
PID 4416 wrote to memory of 5020	4416	Kmncnb32.exe	101
PID 4416 wrote to memory of 5020	4416	Kmncnb32.exe	101
PID 4416 wrote to memory of 5020	4416	Kmncnb32.exe	101
PID 5020 wrote to memory of 4540	5020	Kplpjn32.exe	102
PID 5020 wrote to memory of 4540	5020	Kplpjn32.exe	102
PID 5020 wrote to memory of 4540	5020	Kplpjn32.exe	102
PID 4540 wrote to memory of 976	4540	Kdgljmcd.exe	103
PID 4540 wrote to memory of 976	4540	Kdgljmcd.exe	103
PID 4540 wrote to memory of 976	4540	Kdgljmcd.exe	103
PID 976 wrote to memory of 3172	976	Lffhfh32.exe	104

C:\Users\Admin\AppData\Local\Temp\a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe
"C:\Users\Admin\AppData\Local\Temp\a6d242403fcf768bea76aaf092501d6a9d7ea9ae5cfc045231cde9cc4948a6ddN.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\Kmfmmcbo.exe
  C:\Windows\system32\Kmfmmcbo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\Kpeiioac.exe
    C:\Windows\system32\Kpeiioac.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\Kdqejn32.exe
      C:\Windows\system32\Kdqejn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3936
      - C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3652
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3172
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        25⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1916
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        29⤵
        Executes dropped EXE
        
        PID:4724
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4384
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        31⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        34⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3444
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        38⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        41⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2116
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        44⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        46⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        50⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        52⤵
        Executes dropped EXE
        
        PID:2820
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2920
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1784
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3984
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        58⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        60⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        61⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3624
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3256
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        64⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        66⤵
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1532
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        69⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        70⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        72⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1344
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1440
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        75⤵
        Modifies registry class
        
        PID:1420
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        77⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:392
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1528
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        80⤵
        Modifies registry class
        
        PID:860
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1912
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2212
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        85⤵
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:660
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        87⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1476
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        89⤵
        Modifies registry class
        
        PID:856
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        90⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        91⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        94⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        96⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        99⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        100⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        101⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        103⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        105⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        106⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        107⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        109⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        110⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        111⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        112⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        113⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        114⤵
        Drops file in System32 directory
        
        PID:6104
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        115⤵
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        116⤵
        Drops file in System32 directory
        
        PID:4952
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:768
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        118⤵
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        121⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        125⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        127⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        128⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        130⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        132⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        133⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        134⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1472
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        137⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5536
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5692
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        141⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        142⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:952
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        145⤵
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        146⤵
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        149⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        150⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        153⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        155⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        156⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        157⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        159⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        160⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        161⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        163⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:6412
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        166⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        167⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        168⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        169⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        170⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        171⤵
        System Location Discovery: System Language Discovery
        
        PID:6696
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        174⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        175⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        177⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        178⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        182⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        184⤵
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        186⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        188⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        191⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        193⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        196⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        197⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        199⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        200⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        201⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6988
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        204⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        205⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        207⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        210⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        211⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        213⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        215⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        216⤵
        Drops file in System32 directory
        
        PID:7192
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        218⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7292 -s 212
        219⤵
        Program crash
        
        PID:7504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7292 -ip 7292
1⤵
PID:7404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bchomn32.exe

Path C:\Windows\SysWOW64\Bchomn32.exe
Size 136KB
SHA256 0be7bb2469f24aceb8841328ac815cea5a82c1d8807bfc9c41e187d89d8fb95d
MD5 c3fc010f8230f16e7af3619f508881b4
SHA1 28d415c4dbe88331fd3e70734c63d92a1f3be8fd
SHA512 7104481167fecb20ebe6d72ceed104e4ee98e551a37c17ecb91fd2afa31ef0905f50d0f49668e7d52b141c62cbfec000be26006d92edacec8adcb786291e7d73
SSDEEP 3072:wISNXtktbEotWXEVMgcJST2zdH13+EE+RaZ6r+GDZnBc:mNdlMwk2zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bclhhnca.exe

Path C:\Windows\SysWOW64\Bclhhnca.exe
Size 136KB
SHA256 b2dd8e1fdff1cf27aa10ad1c1d817a2d293b7377e506b52788141e24edd14b2b
MD5 785f44187578f0ab31b67bee3a6559c8
SHA1 73a9f9a96796358891a4172665cd1f428b2f0aa7
SHA512 8304d989e14bf96b204fbcf4e746cfc820336ad254baa7763e7f1d68e74ea632e4529ab5428f193ec874e1c942b0b308eccfd18c0821f43c9b89dd27f0470868
SSDEEP 3072:Aig/XIh11RSou5+duB0Hbo+vh0JExzdH13+EE+RaZ6r+GDZnBc:U/XouwduB0boemExzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjbpaf32.exe

Path C:\Windows\SysWOW64\Cjbpaf32.exe
Size 136KB
SHA256 62b18be8e17e4e3af458a37a75cf722ce76e31f16bc40e6e4d2a35552acbf672
MD5 585972f1bc84ea209cc60baa03df4686
SHA1 8a56785a02a9168f5ffc7342b0c0654c39514a50
SHA512 029ca90f08ccb894d919e3c2080b9c8dd1e3b3cf4a5a7891d18e406101598429116bd6fbd7337fab71697786bc2a5852c083e0f59e12005e1e61e22a94c2153e
SSDEEP 3072:HpDTGoUiI38R286MozdH13+EE+RaZ6r+GDZnBc:JDTGoVRx6Mozd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmgjgcgo.exe

Path C:\Windows\SysWOW64\Cmgjgcgo.exe
Size 136KB
SHA256 5cff02ee4074c15007af50b596bda7b16b1631871711d98cbeda9b9f40836d88
MD5 78499715d8181559b0811ae75d5312e6
SHA1 3b03732b309bd6d7a95897ad59df113a1c6188a0
SHA512 f0fc4d696921f2dfb1a839f8300b048b13a54a64257844d88904001640979a94d87a428b0851bdbf3172fe5743ce1c102b32b017737506eeef23bd084e13449f
SSDEEP 3072:3M1nEnO8uLmBg7V4/zdH13+EE+RaZ6r+GDZnBc:3cnEy5V4/zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhfajjoj.exe

Path C:\Windows\SysWOW64\Dhfajjoj.exe
Size 136KB
SHA256 ec1ef3ac9bcd692e8d40301ba57b2fd35a24c72080c556c3c359a7d166f77e5e
MD5 9011a77be8f32d220baf5ebc11461bce
SHA1 641a6a57bb52ceed39382eaab970fffd543b4265
SHA512 e97eeac68e9b859b44dd5f4328be148e61da1fc2c22ada6ed1c3a52c737796f1a06c50306a9a59245fbef79a6b014e5507137a15217276995e7beab0c0a8a80b
SSDEEP 3072:CTxJQpmONQ9fUyPMrACazdH13+EE+RaZ6r+GDZnBc:UDQsjUyksCazd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icpnnd32.dll

Path C:\Windows\SysWOW64\Icpnnd32.dll
Size 7KB
SHA256 a66bf315d1962e3991b6f2765223ab12bea0be2eb79a26e0ed70484b9b38446f
MD5 125d1a64423f6ed062febd3baf3ec5fd
SHA1 a25ac10928d6a2cf0cb267542c6d144473ca8326
SHA512 a15dc15f654ee658b5b223fe4feea8154d1a4c80b3c13d4477c3e13c6d320578139a4f3d1bfc430db1624e452894a904fb87f0ad44e55c9b105c80e25366cd92
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWabABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbP4q3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kbhoqj32.exe

Path C:\Windows\SysWOW64\Kbhoqj32.exe
Size 136KB
SHA256 928caaf56241fe699bef7f8704dc7c13992a7903632d2d921b07aa672f80f7f5
MD5 376d201193a20b63465534e3bad264cb
SHA1 f01886569fb9556728a9ad633da7ce6c86d0acae
SHA512 05f3cc3cbf8a65d6099664e605bb7d5764006e110b8c090c95ee0bb238f933f4171b864378c09cd12953a96585bd11b4ff6de41c609e4d66619ab1d8666ce2d4
SSDEEP 3072:0ePl5bXhZFX7deaW0Qqzm6l8nV6zdH13+EE+RaZ6r+GDZnBc:0ezXLp78aWSReV6zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdcbom32.exe

Path C:\Windows\SysWOW64\Kdcbom32.exe
Size 136KB
SHA256 b82f05f0d5d5180dc05fbc62ec5ae08adef1f4d3961238502f191991a373dfe5
MD5 437b0b168fd86b20f801cfd10ab71ddd
SHA1 59e7e5c06f7d7c62187d048f42c79bba548ce601
SHA512 67684ce3efc50b548ca243bc02280bc03ed6f06697ff52a42f732ef8998346d0c9562cb58c805828f008480dda9e29ecea4de96a3da6a6d4ee519d05f5d3f838
SSDEEP 3072:S+b764ZHRi02S+T8LYvZUmw37zdH13+EE+RaZ6r+GDZnBc:9cPS+uYvZn47zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdeoemeg.exe

Path C:\Windows\SysWOW64\Kdeoemeg.exe
Size 136KB
SHA256 8d19c462c1f42ba7f4e887d08acc64bee5bda0fb6d5e6e3f951a134ba4399c58
MD5 1bc2d59a4a9f2db50fe8418f1e1cc2cb
SHA1 884cc05e94b0d104532a8cacef67119d6d622772
SHA512 4d24dd634760cd7d44ce506761a95030404025ab05c33b2566b8f3852e86ee8aa1138f658af9aeef6f600b284816dd510caf36cf07e9ed7aa1e9ef2a9e5ef17f
SSDEEP 3072:lLLcnbczEYMqnZgEYzdH13+EE+RaZ6r+GDZnBc:lf2IzE06EYzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdgljmcd.exe

Path C:\Windows\SysWOW64\Kdgljmcd.exe
Size 136KB
SHA256 a811bc29305c7996710018cda5bfb505dfa2c75013f7508178b30d031bf1a1fd
MD5 38cf630cd98a9d0bdb4d4f34536054ec
SHA1 ab63c3062a1d53fbc5cac7890ca757915111b441
SHA512 fbcf88ce37e144506cafdf4ae9f87652f01664d0fac373a3f2ea682d39ec095fc9a32b14df24ffde02518d921a4a44b1a0978358e2745ab185ce1e5ef3f97a72
SSDEEP 3072:bK/kjKxPiO2IXIiwtzdH13+EE+RaZ6r+GDZnBc:bKMjoiOBstzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kdqejn32.exe

Path C:\Windows\SysWOW64\Kdqejn32.exe
Size 136KB
SHA256 d56662d2c32e9a289872277b8af8806d551c5bd681beddaa1e85e2c492a23efb
MD5 c7b0d632a3828851a6389bfdafb8b969
SHA1 2be21cbbd8ce1b9ded51472e00d9b565efe1f6a8
SHA512 e3d37eb56220b32daebc34570d7b9bfb8ac3ebe63fa8a14c90cdb1f963c652df6cbdf52de0d3504327bde2166c83ee94e9e6cec1121809c3fb23eea3337abb93
SSDEEP 3072:GuAU0GIp6NIABwd2zazdH13+EE+RaZ6r+GDZnBc:GuAU0GvIgc2azd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kebbafoj.exe

Path C:\Windows\SysWOW64\Kebbafoj.exe
Size 136KB
SHA256 e990ba0531fdfce34abbb5a0e4bc1756f41cb45eb50ed91d5fc3abc9387731c2
MD5 ce29b267f5c95fcd32c34b299e5e19e9
SHA1 230ca1d03190d4fd67ec48887147170f61707648
SHA512 4653435c801e1b6b79c59acdbe89ea9f3d5c8c15a366d12dff9a6d52d2c324a9f6a044c0ee6cebf2168c7780cd9e33558424f9588222765fc49f580ee29fe338
SSDEEP 3072:SY6jQ8jFfpEksGu9AtpvhDQAhzdH13+EE+RaZ6r+GDZnBc:yjQ8jFfpEPGuKX5EAhzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kedoge32.exe

Path C:\Windows\SysWOW64\Kedoge32.exe
Size 136KB
SHA256 67e72e3d2bd3e30020ac503d4388070a793995667952b7d18f430b9860798039
MD5 9200dbcbfc87c2dbc6eafc1a23100710
SHA1 570d2028d78c0efc43eb69f0b2c761071148cd03
SHA512 c8d25498b5c436f63a26c4dc3ac58b569e91ccb5ed0df3257027cebe8239eed1df03b0064dd2e2ae419becd90e76d3a6c646a98d9b58f8e35a390b97fc87933b
SSDEEP 3072:vNR0MepOXw2/SW4IVbzdH13+EE+RaZ6r+GDZnBc:laTGB/SyVbzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kfankifm.exe

Path C:\Windows\SysWOW64\Kfankifm.exe
Size 136KB
SHA256 2604326218e69bdacf7eacd2d4e21bcb0010cb9713cdd83102da0876daa028df
MD5 1f145a761b755fd52f3ad40bd380e579
SHA1 c5d6898e64e94293a4b81bbefc3d48cb5ab04b35
SHA512 4e42d1673a7d3fbb9557caf3816b1e7c25a0faa76e111444e7996a10a845952ab6bd8df5aef3304675c085200f461e14d9e411e95a68e0a12dcea4e9161b21ae
SSDEEP 3072:yLzQWf4WNDDoAkzdH13+EE+RaZ6r+GDZnBc:SwWNZkzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kfckahdj.exe

Path C:\Windows\SysWOW64\Kfckahdj.exe
Size 136KB
SHA256 d87cc6ae05c7a2def8cd4577e3d9fd71702939b9afb5d1648dc6104ce11a5f6d
MD5 25dbbd6ce49f80651d7fbfe03c285dbd
SHA1 57e12c556af0e61dc93efba869ffbdd8e3277089
SHA512 6cffa76a8d2c10349334ac980cbafd7d65fbcc5aa16a727b0e797f26e89cf2285881b6008cf1e27f4743e56071ffde4fd4c4573a3f968bc5f8c9fd49b6c225ee
SSDEEP 3072:NN41n2yb9clx+z38ALTy22xyo7vOWgizdH13+EE+RaZ6r+GDZnBc:xyb9clxW38ALTyddOWgizd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kfoafi32.exe

Path C:\Windows\SysWOW64\Kfoafi32.exe
Size 136KB
SHA256 eef577e966210bed29c0789c1741d814d04a8a85db8ffdb646793c4ba7a4e44e
MD5 8ed6fc01b08c9a785952ad27d59adbcc
SHA1 7cb3d7cb5d17ecc5384a4a5f3fd54dfe1ca1a3db
SHA512 2ae5853569e61befec385b568dd62a3c1aab0e2ce2e5bf2751eac4a824a34de9a4a6638ac534e74854fe542f71e35e80462548a3184e7cf570b96b7eb6742c5f
SSDEEP 3072:qdcSCRzrVRMwxBTjh7YDoc8zdH13+EE+RaZ6r+GDZnBc:qdcSCR3fMwzvRy8zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kibgmdcn.exe

Path C:\Windows\SysWOW64\Kibgmdcn.exe
Size 136KB
SHA256 37d06a4316e9ad8dae0c767f8de2841179ad5da1cdfa2185b473d3befe84a068
MD5 94054763c165ff6c073f5bcae3cb5242
SHA1 05480e41066804eccb75976918643b8f9c28e819
SHA512 b86051a9a5879ccf0af17b293589905332c92f223fb5df28659efea629cb787bf6f10395a95809b15d93b964d3362558cb78442278431e34a7c95c6c609c60ee
SSDEEP 3072:jouN4kdEa4PVOivOdooooOmBzdH13+EE+RaZ6r+GDZnBc:0uNqasTvOdooooDBzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kimnbd32.exe

Path C:\Windows\SysWOW64\Kimnbd32.exe
Size 136KB
SHA256 dde408256a96114bb028b4500fe3b654ecdb1fc406c0abb16183415fa248429d
MD5 59e34f1417f6496b4fb119ca2968322f
SHA1 7a3200abb9147023012fb2b7c33268e5f2e17029
SHA512 d73bee037d5b6ba6d2289729f4ab5c3726b82189d86eb2bf58460499665495c8fe432b0ce22d2bbea934782eb1d780f5234f4b6a74e2138d9a7c1c11d9de305f
SSDEEP 3072:O6a5Sa3d4458KSFHY4JzdH13+EE+RaZ6r+GDZnBc:K5i9VJzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kipkhdeq.exe

Path C:\Windows\SysWOW64\Kipkhdeq.exe
Size 136KB
SHA256 2122c517a53719653e0c7c328b07f214af47b5a2f1ee4ffde7f5ab6bbffba5e8
MD5 793e0a63a05fba2465ede8270610bcb6
SHA1 6a6e5d6f53106e17e16074f1f749bb1389f85c9c
SHA512 201362072fd557fa6c352a48973bb126048dd8832610a558bfb93efafe44c9492a1c1c013ad7a88293d8f531a5d89e1aaca1f3ba94eb4051c86f2565c3b7af76
SSDEEP 3072:tLxg7IzoD6PLPVuytni6VzdH13+EE+RaZ6r+GDZnBc:tLoIk6jPVuQi6Vzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Klngdpdd.exe

Path C:\Windows\SysWOW64\Klngdpdd.exe
Size 136KB
SHA256 7aed98ac9a74655fc28c5a560f70c8528dfc9b5e8a2d4c2c3de503a6e80bafae
MD5 d0ab656ceb4838a595f575c319d140be
SHA1 9f7bae9d0a335587d8f0091ed36872b40b0fa794
SHA512 91c70bf5407d7c41dd2abf857379891769815cefa4e47153930aa18ebfe4f9091942eb4f7b5092b70c9b605fa8adf8e19f2a69861347353009a1f88f3205d954
SSDEEP 3072:nF8/dJfZ+rtGdhYnzdH13+EE+RaZ6r+GDZnBc:+JfgpUYnzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmfmmcbo.exe

Path C:\Windows\SysWOW64\Kmfmmcbo.exe
Size 136KB
SHA256 43852a3ef001fde998d27a7d5083349a6432a8872afb2ea024cfc2cf1c730cc1
MD5 c8c9a1486a064991bf11fdee9f74f92f
SHA1 64ac4ebc03a508e6fc78297228bea667ca80c33e
SHA512 953dfefe3aaa5fe80380a2288e2b066be389a6d6c6f4ee22b73fe54adaa2cdd98120db60c68a592dd1b949c90027d3040bca8e09a2370f1e80fae718d17144bd
SSDEEP 3072:0iRDMe3AdkrkM3j5vTLxjZ6zdH13+EE+RaZ6r+GDZnBc:bRDqdGJj5vTLxjZ6zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmkfhc32.exe

Path C:\Windows\SysWOW64\Kmkfhc32.exe
Size 136KB
SHA256 bda266154bd38c87004ce129968ee5325b3d4668b2e33fb82a04ac0075ce6b28
MD5 152f4314d1978dcafc8872a860a392ec
SHA1 50b9fa78214745ad12a221b988ad1fe279eab2c1
SHA512 5e11b8b8b03990b7ea4326205ea39f69b7addb2861a2d10afdc93367797ea8151f70e0366c0af0dab6dee06d30699d348ce37511b96680b16a5a5be7bb975c25
SSDEEP 3072:qhGOCHvh7eJxdzdH13+EE+RaZ6r+GDZnBc:qTCHIHdzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmncnb32.exe

Path C:\Windows\SysWOW64\Kmncnb32.exe
Size 136KB
SHA256 65a8271fa24897e26363f6a4a860238770197e3f38926a89e52f5299fd8b562b
MD5 d2776907c61bb011b01a9b1701ffa99a
SHA1 33a5bb6e19803626797eba63f3ef694edf290354
SHA512 f7ff0e50b6b743a093caf88f1c2e3fe617800431c572c94e18d5f8b40199db505abc43fceb35b71be7f26c7b6229e7e08bffd91a0950b7872c98b9976e1a0cc5
SSDEEP 3072:yeH3eteq3Zpx+g8Hb/3i6BzdH13+EE+RaZ6r+GDZnBc:yeHNqXx+gQb/y6Bzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpeiioac.exe

Path C:\Windows\SysWOW64\Kpeiioac.exe
Size 136KB
SHA256 89ed19960a10ac681ee7f75de504fc22458f195170056554b918d621dcacaa41
MD5 42f6941875be6d20a0fba9f5c13545fe
SHA1 e24c75241e23d07ec1d172b7f47653bdd9fe95c7
SHA512 5c2b3207f203e23e3c94ac9bbda8e4e18bfe0c71c6588f90ec9bdf3026b55ade2d9b843b23b5a29e71aaa5549444010e0a8bf455a9e231715c7d1c7c2d1f4db0
SSDEEP 3072:0O9TYlm1aDi4zRGn74BPaaUkzdH13+EE+RaZ6r+GDZnBc:0+qm1arEsgNkzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kpgfooop.exe

Path C:\Windows\SysWOW64\Kpgfooop.exe
Size 136KB
SHA256 62a4768e4c4d705444e7100a756bf5d47132b83b3c1670c0342c5899f8663404
MD5 8798d4c27a1ea5f9697ab9e55170861e
SHA1 4bb1a3ee7ae51759b72ce1284c6d4882dcce3248
SHA512 e0e78affb153293744a8eeb4ad150ed327bf178005b9e4f870a819f28ce01ed914e51e4aac57965c5ead5617efd9aaab840a81f5daf2475d749c0003ad94cd8d
SSDEEP 3072:mawxeSZaLOizdH13+EE+RaZ6r+GDZnBc:m7RZPizd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kplpjn32.exe

Path C:\Windows\SysWOW64\Kplpjn32.exe
Size 136KB
SHA256 85eb7250efd1c0587d3bb2f44fddeee50d37e711bdaa6b2124184e3203f77744
MD5 f9bba2953ddc3544551a607219aa0d9a
SHA1 4e0f7db9f19130c8fb29ee523e6cfc465bc84382
SHA512 90ff7880f37f696921a1ee6d1a30078770f0b8fc2a7956a77577e96170b3ee8c41ae40a0a2b392dcc63bda085c920100b6c0bfa591845455c6643dcaea6d46cd
SSDEEP 3072:r0goEwW639Uh02tvOGVQogzdH13+EE+RaZ6r+GDZnBc:RB63WawWGNgzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lbmhlihl.exe

Path C:\Windows\SysWOW64\Lbmhlihl.exe
Size 136KB
SHA256 2a1a1ecd0d3d1209271921a4e7d7ad318d1bf389854290af4be550ccf98251e2
MD5 192d61895add1746ac08cd0b1b93777a
SHA1 8453bfba583e46b8e38576776d65a580094103ee
SHA512 dbd126f8ccca04281d8278137addd1dc57628e1239368e33e8251ae651da788e5c356a2eb5439daa5906bdb65a416fc9cd9dce66b2c2f0f1a3bc83ca7fc8c04c
SSDEEP 3072:AmJfwzrMzXGv+EBaE1/zdH13+EE+RaZ6r+GDZnBc:B6MzW5Br/zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lboeaifi.exe

Path C:\Windows\SysWOW64\Lboeaifi.exe
Size 136KB
SHA256 a6cd4d86d61b02a88fdcb6eeb32422da0943284dc6b71f127292649adee1e5c6
MD5 5acffbe3308fe61f2ea1dc30ac3a1561
SHA1 f906ce0eb0472e443f24599658751bc456d7e505
SHA512 320bda0bd3713559ce155e88ccf6331ade609975eabcbf151a7070c1464ae6c1701190f0ea9c1d816b3e725a9c4df290684419f6dbf2b7b87f71be31777bea38
SSDEEP 3072:E42JFt3bP46RdfAGbuYSMHRbzdH13+EE+RaZ6r+GDZnBc:EdJFRbJbunebzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ldjhpl32.exe

Path C:\Windows\SysWOW64\Ldjhpl32.exe
Size 136KB
SHA256 77a737bc0031ef833506613971b33f2dc82a0720a4a60b2984576d0198e0defe
MD5 b3d77c870b0e9514731cc941940fb129
SHA1 72fa901f4f03122d99f0ebb5c0e6c0ecb527dd42
SHA512 af0de91bd4bec79fbadde460dd02d94e45a045a62d6e47d51d6fda977b140504be8edf64ddfc2bd684878386bb954e43ba7a9bde40cf590c8c317471615d2ae2
SSDEEP 3072:ZDzo0Wg4tPBkSvanr31CpettPnzdH13+EE+RaZ6r+GDZnBc:ZHJ4PBkS4tPnzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Leihbeib.exe

Path C:\Windows\SysWOW64\Leihbeib.exe
Size 136KB
SHA256 f6fb3c5f57c661412b19ca88d21bd08c6cd20d01f6d125f22915ea43a89eaa1c
MD5 4f2e228339f856a5a4b8b92c6a6a8b38
SHA1 e93a9aa9badd08f254abe55896bbd6814efb668c
SHA512 2066f9f2b29291ca3253c1393fee67127faeb76c42d3f050383189edcb146c0db76c1531470e17c82495d2250779734bd1a29f8ee9945ab6a9f491f4e8ac4f19
SSDEEP 3072:oxO1c4STeEJsRqVXnRJ5PSKbzdH13+EE+RaZ6r+GDZnBc:FZSTpsRqVXfwKbzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lekehdgp.exe

Path C:\Windows\SysWOW64\Lekehdgp.exe
Size 136KB
SHA256 95c88e8aaaa85163a8d558c7707c6ed766eb242a5bb802a168d732e98471eb3e
MD5 9d841ff2a8d66908a9bedb77b0f2e3c7
SHA1 cea5be713574b9ae8ec31d98795d932b1fa059ae
SHA512 669ff94150c675ee32f711ed643d39b4a81a0d26dd0212a06c2f7c7d2a67888d54069cee6049caa51fde25272ba35dcb775a2438a9a37bbfef55d2a87d5857e2
SSDEEP 3072:2i9g09WgzfdZO7C+xPXNnEEzdH13+EE+RaZ6r+GDZnBc:2kWg5KB9nLzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lffhfh32.exe

Path C:\Windows\SysWOW64\Lffhfh32.exe
Size 136KB
SHA256 ad9cca549c2baf32a8ff5a042143a3f289e8e7d61801114cb2598909ddd80e2b
MD5 1b4c691868b602e12c4ac407aad1520e
SHA1 cc8271e137b3a1d4549c0083007dec28b4a8fb11
SHA512 2fb0c4209c0d4ea6c7ae1602834cb2cb83e20d04e0a96ae61f13b22cc46d0784721d0403c4ec806339de2a09855756ce5592ba66270e83778ee833a8751bbd5a
SSDEEP 3072:8Az/LekR5ZibtACjII0O7LcwsOzeTzkFzdH13+EE+RaZ6r+GDZnBc:Dz/voDsLkFzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ligqhc32.exe

Path C:\Windows\SysWOW64\Ligqhc32.exe
Size 136KB
SHA256 d56786e45bdc369db407b4642b319c6e1b7eed29c4f81394ea62430ac9dc60a5
MD5 f46eedba8e417ea59070d5d65a8d70a8
SHA1 350f61dc39aa855523fa9543719cda5768ad0771
SHA512 2c2de36dd78ef28169b41ed4ad633765d5c6433117cc90cb5c74d8e60607d48571b16f1c17d154d30163807bcf2df6a25618b8edb3a76a10d3f9657157041bc2
SSDEEP 3072:TqDuwJR/7SvljEmYzdH13+EE+RaZ6r+GDZnBc:2D1rUNLYzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Llcpoo32.exe

Path C:\Windows\SysWOW64\Llcpoo32.exe
Size 136KB
SHA256 033c2ce49ed126711151314cdbaed047015b450184f8de545c29d27c35cba2bd
MD5 48c5ed071937a291e5b7123f521e1168
SHA1 b32a27b71a41397da22d294cc0d2e5b6ec6ef12f
SHA512 2ee26a18fbd180465b78e1aee2eda10ff478293ec7c4cb61aca1bef005b8e87e76c9652cd538347bdc970e346b2001afeec5b77837cd225d8520bb2d23ebd106
SSDEEP 3072:jopoXWazPcPSjdE3C4bpyAezdH13+EE+RaZ6r+GDZnBc:cpCdd2HwAezd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Llemdo32.exe

Path C:\Windows\SysWOW64\Llemdo32.exe
Size 136KB
SHA256 bdb596a1bda435d264ec32555a3513013e888c832f1d36f2ea94287d09c47faa
MD5 90efc2a43693c2769fe39dd0609baa1c
SHA1 cd95c6f152c2405ec0008e1ce046d9817766f09c
SHA512 6a09534e5758673d4c7ecf6a281c9048e3a4da75cbedbcc6c4e68d6e98065d67e85608e02ed9f6a86616ff9b2f2759b0fa17b6fcedd011aa11ca75b6d57f60b2
SSDEEP 3072:AcGZOb5IK02hTXUE2/pMHgS5IiCzdH13+EE+RaZ6r+GDZnBc:sZOPhTXUE2/OASDCzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmbmibhb.exe

Path C:\Windows\SysWOW64\Lmbmibhb.exe
Size 136KB
SHA256 e7ec51616443eca77c386b7e9d7ca1ab0a5baea4f373245099848bb2017d7d3f
MD5 b6585d55adf9afda08e2b4d74a3c3493
SHA1 1af3df14ec575557b97d7c3346c25a475d6b604e
SHA512 af4f9a18f872b7a7bc80bae321f0ff0e807d2160e63805abd77aca3df27a2d844852d4f3c9eda608c9d601ca8652be4b88e19d9e48178916bfccbf6892cfcfa4
SSDEEP 3072:vx6mqUkC89/6irYAUzdH13+EE+RaZ6r+GDZnBc:ZRqUkC3irUzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmppcbjd.exe

Path C:\Windows\SysWOW64\Lmppcbjd.exe
Size 136KB
SHA256 76750826da51ae177bad564827f60f6ee00cce4fc918bb32e8ace6c6c97117e8
MD5 71ad3963a5b42db380580a7316548938
SHA1 c0ffbbe309ed543bf8c5bc8c5af76dd64b99e89c
SHA512 2cdb125d471f561e3b588781b7bfcdc283f050f4c96ef31d425a4f3d67e44a62d9525efc78584bdb6e0d866eb3a90380efa02ffaeec3c3503e2b455a3641b07b
SSDEEP 3072:9V+a3eRURTjkXXlb+rAhukAzdH13+EE+RaZ6r+GDZnBc:L+a3e2RTodAzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lpqiemge.exe

Path C:\Windows\SysWOW64\Lpqiemge.exe
Size 136KB
SHA256 b4a45135640720b6aa9e89af9d5135d07e22fdd6dd0ba60ac977dffada77eb3a
MD5 cde0bd89b239622095c193db32150314
SHA1 cfd5537926005dfc838f10e2ec9423a9c090877f
SHA512 2dd0ca890e256c14ade258cd1ef9ca15143060978d983190b17e41c298f4590457fbb0ed8eb9973f93709fb0a67a514518c3a73e9046cb29a183251660e65ef8
SSDEEP 3072:nsMPg9fgU0Y214Ks7vG6gIHqzdH13+EE+RaZ6r+GDZnBc:JPw4hjs7e6gIHqzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pmdkch32.exe

Path C:\Windows\SysWOW64\Pmdkch32.exe
Size 136KB
SHA256 9ee31b292831847f16053b8a3cf4ce01a5bf50d773f2cc0d99ad26fbc5d41726
MD5 d7a90752b2c0ceecca7bb07a3f66dbda
SHA1 f8350b69244597cb75674c8cbd8b8a8fefd7d3f4
SHA512 d9eb9a0d5628acd40105ad83bac3f3a0688c5aefcb8ca5cea3d48bd98262288df2e66baad1fe871536c072899993365a4c9d26b2bbfa048c9ade6b8c10f7216f
SSDEEP 3072:ntN51L/MgreXvymkNHohRcMkDdaPcO1LbKzdH13+EE+RaZ6r+GDZnBc:ntFjMgr2yHwAdaPcGbKzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pqbdjfln.exe

Path C:\Windows\SysWOW64\Pqbdjfln.exe
Size 136KB
SHA256 17957be8cfeb101283e2ef77d8023e754fd1110d5ec1008d7e092c0088cfb160
MD5 aafe23aa3393d43ad70d4f2dd74c5a04
SHA1 c9798b769bcbdacda4ebe6f0ca4b2b295d3d8d86
SHA512 0d083c98bea222e917e466d228ae6458e314b5d344d9f257c5c1de89f1a99c7ed172d680db67fc120035d6470739f6792a702c6abe906526da6c060a4bfc7df6
SSDEEP 3072:2GaJXKQtHuLXqhpnRVS/71d/zdH13+EE+RaZ6r+GDZnBc:2GVQtHuLG7S/77/zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qcgffqei.exe

Path C:\Windows\SysWOW64\Qcgffqei.exe
Size 136KB
SHA256 940f43cd27262a43321d7ab5414c0602665560b084b67a1361d9bca307091840
MD5 e242a93ec2c2ac3c419d85522cd21c4c
SHA1 31c90a670f6f33e5fd31f1391bafd6bc27a3b432
SHA512 c930b87b83345839e4bd231e2f627ed207899d75227146214d586b68926d5a992aaf791dd4cf8ce4900d427d28b8fb336853446d7ed9af08696b0de55810a8db
SSDEEP 3072:CcONf/GnaUxtnOYC7sekRwH7zdH13+EE+RaZ6r+GDZnBc:C32naUxtOYb87zd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qnjnnj32.exe

Path C:\Windows\SysWOW64\Qnjnnj32.exe
Size 136KB
SHA256 7b2a857fd75eeff8a136c0e38bde5e2ed07f13d032f729c64bbb40d95beffba4
MD5 c7069d7ae4f4215b0c22dd2766493f4c
SHA1 dfdb06de1338eca8d5ec1ed4f40c331489f20880
SHA512 78dcc76d6be9b095c37302688e33cf3c143822c060bf3045392c57a2bb337076893b6b103735d369ad14c461ab701bef5c244e0c66adaaab32f201d39aacf316
SSDEEP 3072:BSpO/uJnNXPaOoAGTsggfzdH13+EE+RaZ6r+GDZnBc:z4hgzTsggfzd5IF6rfBBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-613-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/392-531-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/632-117-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/660-582-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/748-381-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/856-601-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/860-543-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/928-453-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/976-172-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1004-363-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1032-569-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1032-24-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1044-204-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1176-333-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1272-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1344-501-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1384-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1412-189-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1420-513-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1440-507-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1456-339-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1476-595-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1528-537-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1532-471-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1544-557-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1652-495-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1784-393-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1832-447-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1912-563-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1916-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1948-576-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1952-525-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1956-345-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2008-252-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2012-68-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2028-197-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2116-315-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2200-284-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2212-570-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2232-489-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2272-477-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2316-417-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2392-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2392-548-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2528-267-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2548-459-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2588-429-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2668-108-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2704-588-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2704-47-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2748-351-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2760-326-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2820-375-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2888-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2920-387-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2964-76-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3172-180-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3228-411-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3256-441-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3312-291-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3444-279-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3504-321-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3624-435-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3652-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3656-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3656-556-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3676-369-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3680-220-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3824-399-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3936-44-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3944-92-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3984-405-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3996-589-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4240-60-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4276-100-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4296-132-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4348-272-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4356-549-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4372-244-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4384-236-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4416-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4432-519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4460-607-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4540-164-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4588-140-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4724-228-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4792-303-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4812-483-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4848-124-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4920-465-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4964-84-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5000-309-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5020-152-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5040-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5112-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5156-619-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6844-1452-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads