berbew | b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe
Size

314KB
MD5

7a74790167c1f8d2f110fb8174b65cb9
SHA1

8b742ee2b2eda8fbeb11cf7578717bc70f536bce
SHA256

b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822
SHA512

e0650c51224ec0a2788039e93c73d334440db5875af061e739088236cd23ee768b1aba1c2b01e1a8d14ccd9661c40992de6cf3eac69f2a8d5870e386a5b3781d
SSDEEP

6144:JklfQBsj6MB8MhjwszeXmr8SeNpgdyuH1lFDjC:+lfQc6Najb87gP3C

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogkcpbam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhlml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lepncd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnfdcjkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgmjqop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgcgbi.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4032	Leihbeib.exe
3312	Lmppcbjd.exe
2948	Lbmhlihl.exe
1892	Lekehdgp.exe
960	Lmbmibhb.exe
3424	Ldleel32.exe
1972	Lfkaag32.exe
212	Liimncmf.exe
2796	Lbabgh32.exe
1672	Lepncd32.exe
2240	Lmgfda32.exe
2832	Lbdolh32.exe
228	Lebkhc32.exe
4660	Lmiciaaj.exe
2276	Lphoelqn.exe
708	Mgagbf32.exe
2416	Mmlpoqpg.exe
2328	Mgddhf32.exe
1756	Mibpda32.exe
2088	Mmnldp32.exe
3240	Mdhdajea.exe
4572	Mgfqmfde.exe
4524	Mmpijp32.exe
1448	Mpoefk32.exe
1532	Mcmabg32.exe
5012	Melnob32.exe
3964	Mlefklpj.exe
2924	Mdmnlj32.exe
4444	Miifeq32.exe
4472	Ncbknfed.exe
1696	Nepgjaeg.exe
2244	Ncdgcf32.exe
3076	Nebdoa32.exe
4992	Nnjlpo32.exe
2324	Nlmllkja.exe
4368	Ndcdmikd.exe
224	Ngbpidjh.exe
4464	Nnlhfn32.exe
4768	Nloiakho.exe
2516	Ndfqbhia.exe
3556	Ncianepl.exe
1168	Nfgmjqop.exe
628	Njciko32.exe
4484	Nlaegk32.exe
3280	Ndhmhh32.exe
1632	Nggjdc32.exe
2072	Oponmilc.exe
816	Ocnjidkf.exe
3364	Ogifjcdp.exe
1480	Ojgbfocc.exe
1840	Oncofm32.exe
4800	Opakbi32.exe
2208	Odmgcgbi.exe
4656	Ogkcpbam.exe
3768	Ojjolnaq.exe
1440	Olhlhjpd.exe
4244	Odocigqg.exe
3740	Ognpebpj.exe
3716	Ojllan32.exe
3824	Olkhmi32.exe
5028	Oqfdnhfk.exe
4556	Ocdqjceo.exe
1668	Ofcmfodb.exe
4376	Ojoign32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Kjiccacq.dll	Melnob32.exe
File created	C:\Windows\SysWOW64\Gokgpogl.dll	Qceiaa32.exe
File created	C:\Windows\SysWOW64\Kboeke32.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Ncbknfed.exe	Miifeq32.exe
File created	C:\Windows\SysWOW64\Opakbi32.exe	Oncofm32.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Ocgmpccl.exe	Olmeci32.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Bfdodjhm.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe
File created	C:\Windows\SysWOW64\Eghpcp32.dll	Mcmabg32.exe
File opened for modification	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Deokon32.exe
File opened for modification	C:\Windows\SysWOW64\Mdhdajea.exe	Mmnldp32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Ndfqbhia.exe
File opened for modification	C:\Windows\SysWOW64\Lfkaag32.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Ngbpidjh.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Eiojlkkj.dll	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Lmppcbjd.exe	Leihbeib.exe
File created	C:\Windows\SysWOW64\Lfkaag32.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Nlaegk32.exe	Njciko32.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Pgllfp32.exe	Pdmpje32.exe
File opened for modification	C:\Windows\SysWOW64\Qceiaa32.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Bhicommo.dll	Cenahpha.exe
File created	C:\Windows\SysWOW64\Lphoelqn.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Ncianepl.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Blfiei32.dll	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Ljodkeij.dll	Ldleel32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bfdodjhm.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Ojllan32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Ojoign32.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dmefhako.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Ajkaii32.exe	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Maghgl32.dll	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Mdhdajea.exe	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Oncofm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6160	6940	WerFault.exe	298

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qmmnjfnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lekehdgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlaegk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lphoelqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogifjcdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adgbpc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lebkhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepncd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amgapeea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Melnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggjdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bchomn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qffbbldm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlmllkja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnhjohkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldleel32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgmjqop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpidjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhocqigp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhmhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnjidkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojjolnaq.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnecbhin.dll"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgefkimp.dll"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpggmhkg.dll"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aihbcp32.dll"	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Popodg32.dll"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaiann32.dll"	Mgfqmfde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deimfpda.dll"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocljjj32.dll"	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmidog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaekf32.dll"	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aminee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Aminee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonbk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4032	3980	b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe	82
PID 3980 wrote to memory of 4032	3980	b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe	82
PID 3980 wrote to memory of 4032	3980	b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe	82
PID 4032 wrote to memory of 3312	4032	Leihbeib.exe	83
PID 4032 wrote to memory of 3312	4032	Leihbeib.exe	83
PID 4032 wrote to memory of 3312	4032	Leihbeib.exe	83
PID 3312 wrote to memory of 2948	3312	Lmppcbjd.exe	84
PID 3312 wrote to memory of 2948	3312	Lmppcbjd.exe	84
PID 3312 wrote to memory of 2948	3312	Lmppcbjd.exe	84
PID 2948 wrote to memory of 1892	2948	Lbmhlihl.exe	85
PID 2948 wrote to memory of 1892	2948	Lbmhlihl.exe	85
PID 2948 wrote to memory of 1892	2948	Lbmhlihl.exe	85
PID 1892 wrote to memory of 960	1892	Lekehdgp.exe	86
PID 1892 wrote to memory of 960	1892	Lekehdgp.exe	86
PID 1892 wrote to memory of 960	1892	Lekehdgp.exe	86
PID 960 wrote to memory of 3424	960	Lmbmibhb.exe	87
PID 960 wrote to memory of 3424	960	Lmbmibhb.exe	87
PID 960 wrote to memory of 3424	960	Lmbmibhb.exe	87
PID 3424 wrote to memory of 1972	3424	Ldleel32.exe	88
PID 3424 wrote to memory of 1972	3424	Ldleel32.exe	88
PID 3424 wrote to memory of 1972	3424	Ldleel32.exe	88
PID 1972 wrote to memory of 212	1972	Lfkaag32.exe	89
PID 1972 wrote to memory of 212	1972	Lfkaag32.exe	89
PID 1972 wrote to memory of 212	1972	Lfkaag32.exe	89
PID 212 wrote to memory of 2796	212	Liimncmf.exe	90
PID 212 wrote to memory of 2796	212	Liimncmf.exe	90
PID 212 wrote to memory of 2796	212	Liimncmf.exe	90
PID 2796 wrote to memory of 1672	2796	Lbabgh32.exe	91
PID 2796 wrote to memory of 1672	2796	Lbabgh32.exe	91
PID 2796 wrote to memory of 1672	2796	Lbabgh32.exe	91
PID 1672 wrote to memory of 2240	1672	Lepncd32.exe	92
PID 1672 wrote to memory of 2240	1672	Lepncd32.exe	92
PID 1672 wrote to memory of 2240	1672	Lepncd32.exe	92
PID 2240 wrote to memory of 2832	2240	Lmgfda32.exe	93
PID 2240 wrote to memory of 2832	2240	Lmgfda32.exe	93
PID 2240 wrote to memory of 2832	2240	Lmgfda32.exe	93
PID 2832 wrote to memory of 228	2832	Lbdolh32.exe	94
PID 2832 wrote to memory of 228	2832	Lbdolh32.exe	94
PID 2832 wrote to memory of 228	2832	Lbdolh32.exe	94
PID 228 wrote to memory of 4660	228	Lebkhc32.exe	95
PID 228 wrote to memory of 4660	228	Lebkhc32.exe	95
PID 228 wrote to memory of 4660	228	Lebkhc32.exe	95
PID 4660 wrote to memory of 2276	4660	Lmiciaaj.exe	96
PID 4660 wrote to memory of 2276	4660	Lmiciaaj.exe	96
PID 4660 wrote to memory of 2276	4660	Lmiciaaj.exe	96
PID 2276 wrote to memory of 708	2276	Lphoelqn.exe	97
PID 2276 wrote to memory of 708	2276	Lphoelqn.exe	97
PID 2276 wrote to memory of 708	2276	Lphoelqn.exe	97
PID 708 wrote to memory of 2416	708	Mgagbf32.exe	98
PID 708 wrote to memory of 2416	708	Mgagbf32.exe	98
PID 708 wrote to memory of 2416	708	Mgagbf32.exe	98
PID 2416 wrote to memory of 2328	2416	Mmlpoqpg.exe	99
PID 2416 wrote to memory of 2328	2416	Mmlpoqpg.exe	99
PID 2416 wrote to memory of 2328	2416	Mmlpoqpg.exe	99
PID 2328 wrote to memory of 1756	2328	Mgddhf32.exe	100
PID 2328 wrote to memory of 1756	2328	Mgddhf32.exe	100
PID 2328 wrote to memory of 1756	2328	Mgddhf32.exe	100
PID 1756 wrote to memory of 2088	1756	Mibpda32.exe	101
PID 1756 wrote to memory of 2088	1756	Mibpda32.exe	101
PID 1756 wrote to memory of 2088	1756	Mibpda32.exe	101
PID 2088 wrote to memory of 3240	2088	Mmnldp32.exe	102
PID 2088 wrote to memory of 3240	2088	Mmnldp32.exe	102
PID 2088 wrote to memory of 3240	2088	Mmnldp32.exe	102
PID 3240 wrote to memory of 4572	3240	Mdhdajea.exe	103

C:\Users\Admin\AppData\Local\Temp\b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe
"C:\Users\Admin\AppData\Local\Temp\b1cf976053d31ee41dece56913d97bbabe4c3a0082a017f15597a613fdbfe822.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\Leihbeib.exe
  C:\Windows\system32\Leihbeib.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\Lmppcbjd.exe
    C:\Windows\system32\Lmppcbjd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\SysWOW64\Lbmhlihl.exe
      C:\Windows\system32\Lbmhlihl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1892
      - C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        24⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1532
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3964
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        29⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4472
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        32⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2324
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2516
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        42⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1168
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:628
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3280
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2072
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:816
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        50⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3364
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1480
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1440
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        58⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3740
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5028
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1668
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4376
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        67⤵
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        68⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        69⤵
        
        PID:516
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        70⤵
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        71⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        72⤵
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        73⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        76⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        77⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        78⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        82⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        83⤵
        Drops file in System32 directory
        
        PID:4520
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        84⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        86⤵
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        87⤵
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        88⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        89⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        90⤵
        Modifies registry class
        
        PID:2408
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        91⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        92⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        94⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        97⤵
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2496
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4108
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        100⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4912
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3436
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        103⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        104⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1152
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        106⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4744
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        107⤵
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1956
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        109⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5056
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        114⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        117⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        118⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        119⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        120⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        127⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        129⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        131⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        133⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        135⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        136⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        137⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        142⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        144⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        146⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        147⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        148⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        150⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        151⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        152⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        156⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        159⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        160⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        161⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        162⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        166⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        168⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        169⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5344
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        174⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        175⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        176⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        177⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        180⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        181⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        182⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6556
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        184⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        187⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        188⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        189⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6856
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        191⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        193⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        195⤵
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7136
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6164
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        198⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        201⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        202⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        203⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        204⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        205⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6800
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        207⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        208⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        209⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        210⤵
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        211⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        212⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        213⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        215⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        217⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        218⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6940 -s 408
        219⤵
        Program crash
        
        PID:6160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6940 -ip 6940
1⤵
PID:7108

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe ac92b3e28d6db628c25452a471264d68 ucSm8DQe9kW1oWwTYzVdBQ.0.1.0.0.0
1⤵
PID:6608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
314KB

MD5
6c6a9ed6f384cf6d6f1a3382c7c15816

SHA1
49814e62f9ec002935447345f8d2d77cc50addb0

SHA256
a7282a90c31a45152d6bd40ad35f12e36d275fe0082562ae898067c1963fa274

SHA512
d0c98a6f3eadb8517a86f9de058b9cc37916c10b80f343b22c6fd5ab31f9e56cd2b32bbe11f0fb88b82e045546d56c31f1feb29b495d6d967b9bc0aa54f0aa1e

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
314KB

MD5
2ff0b270ccbcda73a275589123702a18

SHA1
08ab1023b0ab745aff47ca77b449ce59aa151a31

SHA256
769060afadfa3cc809750f0062123a929c9bc4e8c23dc9371e5431acda436a3f

SHA512
9ed89667128dc0ed5e4750ec0285fe8b85b5b131a625279d17fa7986c22af58f0f5b554b8de00de0f2121901d5a6b80434d9d9ab40317098be7c18e7af963ae7

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
314KB

MD5
5c3a6137f1179c932d8366f73d41856c

SHA1
7cea8738084ee1767698455e5f3be10a82e80fff

SHA256
d9e04fef6a1a2ae8762396c863f475189102e8a505e755653a4eeae184584490

SHA512
0a1db3b3677ba2ec20f95e12f57f4b70c759e838aef442fa587e07e85ba928770ac17447db2ec37c56a90f558a2b2d8b08907b4c3918fa7f302ed98024275ec4

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
314KB

MD5
c449a99de127b26b13982dff5e8eb71d

SHA1
a320c4daacf006a795f7453c5e4ef3455e156aaa

SHA256
12a3472cf49601d59e30c3fbbe4fd22f71e12ceb2a41141946cada768c5ca049

SHA512
66a9962f442b29335b274ac52ff110e87e47a3321f11ccc474b0f60dee40555cb855559688811d75e7f16befc07525919081d7b6cd4a2e6f3158799e4aa6d75f

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
314KB

MD5
59b7c837dc7470f584e36dcc6d68c0e0

SHA1
ca092a3a48fd05b6ce858e4ffe120db2e6530e97

SHA256
931dfcaba6598c943091425dd822e113f4267176c882a25b241bc2faa36945bc

SHA512
4446d1b47a1487863a5408a5fb91cddd2253cc1ae2cce92add5e3b7b467edf1a517028f2672311dcca638c72e355563a02a581928ede880f24b075d90aaef7ab

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
314KB

MD5
44a9d88fc0811c7bcbcdf457148d5338

SHA1
6426824d36104f598a3d6e20d8b9080efd3b2cf2

SHA256
70901cc805e83e00667ea39e600240d456dcefb699d2f5fb87f13639a3e1fe04

SHA512
de842950d9cc72b84c32c594736cd14770061614445c41191cf898f56b206d233d81a748627c1abeeb792a0a1366b3e75b8fff932bfb556fd45137469697d748

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
314KB

MD5
d03e954bb9f3ebeadd90705dd45232d7

SHA1
b616437a689cb0f864bc6eb555a9215adfc8d52a

SHA256
345cc6f143416f59528a80c41ba7e9d6f5cea0e67cfe1f90b1889802f4a655f7

SHA512
5bc134addfe0203489bc86792526167d520064f509e624226e8931c97a2ac95ba91747027cf4cf1063816fd4fcd35f90e7adc78a3fc1805be3d65444ba7216f1

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
314KB

MD5
4fde6adfb48a35da38774c8f5a6f09a7

SHA1
09308131eb4233309d3b929def02ef1eecc12777

SHA256
429d10583efa855d57b8e7cdb296c9c7df5d2d1e66fbc5481c7b4de7928b2324

SHA512
c0034f8d38da8c46d5f879a24456b09e8a1f7856e8ffde1f9ad70a9a67974852102bcce259d336dc18a20258b9a66875739d017785f3767a0a63f467064c0a23

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
314KB

MD5
f46d9f5c4989dc9a5ae84fbef2a49b88

SHA1
4c3d4e8e1db67199876273e4359ee986e6dee1d2

SHA256
95035be37b218352fb5bc96a44785895f64a4b61b60689a305e5448bddc06b00

SHA512
a0ee6c125f12a6df0f6e6febb5587d3598c5027e6d397c010ed49cbcbf8d007be7d4bd81f0d7c21331fb4b0d86e8330f57e590305636e7ed0e818be9c3a81dbd

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
314KB

MD5
aea884797acdeafc53c8d1becfdd55aa

SHA1
86ce4a360fbde46d472b6f68aed74a84c1e3be0d

SHA256
b8e7a72b863574752493850082eaa4ddf15e7835c4931227be9f1fadfefcd335

SHA512
dcd75a4ba922fdc11ccd717f7058d760592894a6c0c88325f5702cd480b2ac685161ecf977b728311e71e579fbd9544fa7695f16f3a755b082ada5cec86b37c3

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
314KB

MD5
241233365a3de7cf43e29593abdfbf90

SHA1
24049821bdee08dd333412ac0e18155dfc870ea6

SHA256
ea055644d5ca26c1bc87c78374eefc0850e7013e89b39d3b680fb82445474336

SHA512
ff2515246e91009e301f20599884ed7970aa2da03aa9b7a3eafcfb7589297d04bca5428a4a3da7fc0c89d7b23b58216d26d64cdb6a09fbbc6275e81e0f9e000d

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
314KB

MD5
814520187970adaadda6da3f8e234089

SHA1
3c6d35bba81e0e7168da1459f5ba0e4889d321f0

SHA256
cb1ef057d5783b0a44eea45b65fb4a81ae09054e9a01f192142cf222433a19a8

SHA512
dcb87aa439b13344c7ef045a565a4d2adc65dc908b09efcea2bb467977e042433242eefd04833b4c4cf2c36f2548f0226fbf2f9b658009dca0cc785b3b6fb900

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
314KB

MD5
207f9062a3faa588217b79c15780ba19

SHA1
752747d24d81bd687cc348cb4daad76a5954f947

SHA256
8761300a796497d63249486bd79b50a1d3c7786e4f28ae07eaa072a417311192

SHA512
82980ce4adfda55b0c72010d2c8a981a5a0443acff57631e66ab55622da6e4511a2eea13fc3be83fbaff3af996fd7f17da135b6f18bd6f6f0236683d702f9ca2

Download Submit
C:\Windows\SysWOW64\Lebkhc32.exe

Filesize
314KB

MD5
7b7f694917d3b80af86d71d6f0552963

SHA1
7911ed9f228bc98121956acaf128cdb996d1ca59

SHA256
9d60f1225d7c8308154e21e8e027841d028f4baa0834095abddb854d9b5e7b93

SHA512
15f2a2dc6c632af5975f893ace37df01236c20c0225f4c8fd7330297f725d22caf61a8e5da23daf44f08b9d402fad1e369ce8f1f02da44935f864a2a99276724

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
314KB

MD5
0d8df679491f34fa1ce11a7140cd5938

SHA1
3668841a69a6bb547d53b09313b746a95318b0b2

SHA256
f0f3b5d9ab5d3a38a1c2f874c460e040d9d61eba50855c7706e8771269358f65

SHA512
1c12910ca6c8f9d1ec2215dc73ba9369ee419c74253e47d4aaf03d06eabb7094af92fe4f33e60a8df443f59880e24b1df44231d1d0fe420877c6cb3a972ccb2a

Download Submit
C:\Windows\SysWOW64\Lekehdgp.exe

Filesize
314KB

MD5
eac60517b9206bc5f64cd0e201780142

SHA1
35f85911d31f37f3740d9578afe2b9593457c338

SHA256
2885975996a9da8d5aaa1b65355a9c16a9cfda96bb66415c4c551baf5cfe5d3a

SHA512
67702da70a174eab3754ef3ae76787048253187e3ae440060c158f651bcad8ed7cd9e8721fb7c05b6c022f70f78fe8cea3a6ad46c34d6e3c0254f495ebb435e9

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
314KB

MD5
8b1fb4ad2d8d8aa7ff7e72b01ff19a7b

SHA1
778e6e278148b83e118cd1113d358f4c20aa31c5

SHA256
e2c6a8d5f82a0c0acd33ca437b80246dee0ca506980623c85083c46fad47504b

SHA512
785f38ca2609e29937c4550f3d9b1b668815423270d5848a3c58f6640e0f7642f8717731a0e222898a24e0ca196c94a4dc08880fe6b4500100cfadae4695f1be

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
314KB

MD5
604ddd750265e8926576ebb801b85b0d

SHA1
2bce58b54c7407ee658467f948e32debcce12f68

SHA256
b336b1df5280e5041774638bac966ae72bca85669857b4a6129648a38a0f22b2

SHA512
bf968532429a612a5409e2e6d8d2a9d21fc9bcc51b1c67d1fca20d46e0de6f3d446e1fd28fb871f86ade47f57c9e40682e506a6c05d2c1999706ad6a89f3a05d

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
314KB

MD5
87f4214a447d5a0689d4fdf215396556

SHA1
f859bcf6657802152e8cd06ed2b0a7987293c2f1

SHA256
14c1d54668a0c17b771f36084a35d8d19753c26e3de5064010e473c327bef49b

SHA512
a82e8a0ad4fe4bba7ec041f058b2d2c84f3766cd6337736d101622a8c18de881afcd54ffac2a50ee0bfe66d542d162b524997d0b7b5763ae99e0d13fb1272cbd

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
314KB

MD5
a9fdb5045dfb7cc08dc4d87ff8f34771

SHA1
25c52ea9c469038100495fd8f7680c0009a0136d

SHA256
95d17aa2dc23abdd5590d670a0b47351d21665ea6887f22e27cf5a4a6256f51e

SHA512
5830e9abf96e22c3fda590565bb5e225b164f4027c6d1cb796a834aa45bb4e508f3b06111c3cbc3761568f65c4f5eb6e7748377a33341ffd1a5ad9e695978414

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
314KB

MD5
3ba648c2109a99b1d34be36fb8d4d457

SHA1
5c0ce6785aacd9c0f0a5025445a777eae3659a4c

SHA256
cec28cfdbe2a27234abbee98e7bc556f41938f25bd37db0031d278006237d80f

SHA512
a94c41244ec8dc2ec82a2c739a885adee5ad71c803f0719c68d9471cecee5473c17a0c14895729e64e5a6c407d5ce4e35e3ea78f48dc6beb71aab5607bc204b1

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
314KB

MD5
da327c23a94add80ecd551aee0c60f2b

SHA1
033e9da389a60b45a4cd1212b2fb11bec20482d3

SHA256
54a6222d1b796f088d57e47e169584992868bdd0b1572734266fda5e080618ec

SHA512
281d8b51ea742e97ad82a0ecabd683359c25accdd8001baf52e76049b63d44588c0914288019ef79e8d224be1b6b4f5424ee4685f9f5aea903e086a3111765fc

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
314KB

MD5
038729b49c17bbfac310ab06cbaca95d

SHA1
986a10292a88d04ddd089cec04cf69ee729230cf

SHA256
59cd5743d3bb6de699491763c8d5b93a9bbdb08db0645b3ba334a02f9c0d850d

SHA512
2851bea64bc33a77663d3c9619e12f6ce4e4521d9fb19f628a7628403a32b5de0bf00fe684b21bbf7ad4f23458e926993ae9321d1c3e8dc43bb4467ad527d300

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
314KB

MD5
7d46579d2078431ae8f190c99203e258

SHA1
4f600f8a4d133462d82103f150c2b109c68ed12b

SHA256
f3bf226ec465637b8c1e50dff92954b816030c93c6130ccea78c49658a57c74c

SHA512
8264eb5bd0b15944037e6dc44cec834896923f3cee7f2fc48358cde28e8aa7624cb4960c33ed46efd8c46b32370c60e2f1b8c584ef8432ff128269b5a86765ff

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
314KB

MD5
25c6e42b27edee0518d47b1019bf1f4e

SHA1
b3bf52af8d03673b4c38cfd59191e355069cc305

SHA256
00a5be7b3fc748131fd3bf1d8c60b9dc3bea2259952a5c13e449402bc3f61bae

SHA512
4e36e341dbf71dfbd55ea056dab14b0701bb3a8c1eae95da32bbb59ce29ff30874970a4ac94647a0db134dc584f15cea7bf521e13b55e388d5617a70b7a609c1

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
314KB

MD5
db5764264837dc3c6297f717e7583bc9

SHA1
c7993083f8b39cea34cf448510c0e084e13e0cb9

SHA256
eb176425752bcd8590cd611275d0a0eeec3c0f8b8955b1d947c2c8130acd0a3c

SHA512
9cfecc42f16893bbf17f76d8bf0d745929ec124b2709eb803c8a061b417e42abcbef6d9a99a231b50981c2bcf57cd10a41ab3fedbd330d50e9ea5d317ce19de4

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
314KB

MD5
8a8844312cfa1b0fce352799f04bf048

SHA1
767fee0c897db90248ebc7c9c12d6905e781a8bf

SHA256
72bc31a806e582c73351213e85136f9f3a0a50e3c0db8785810168be2bef79c0

SHA512
8ff660640862c6cea6985b7dfba418dbc34fcd3d8f32e61910dc64e749bc3fc4081a263bfff2de8fa8cf88501e60446da8eb85521d143db24afcf6f791bf105c

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
314KB

MD5
4d85ee7a60a90f97c02dbb401381dc8d

SHA1
45b2b7a10034609edd0496b0f3302349e8483ebb

SHA256
3c71591f5254b48700f49b3c79c6c23a9f510e59f216f61ee0d8d53c1b515fcd

SHA512
915ba44f5d8604b494327367309de4dde2b11342610fdbd07b38f5dff27b9035576e4435ffd3a847d5179b32ff01f91db6afb7fa67095e13c74c3a04ac0bca59

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
314KB

MD5
d4b2c43818b822d5568f7955fffd6389

SHA1
b3906141d6a4f02f425b082f49f7187ac4dafcf7

SHA256
59940e65bb80811c1a82429018222dc84c416c73de608dde9ae817cc824c7800

SHA512
40eb24aa982a054c75b6d1129f872404d07785423e6a1cf07675f14d76e59f24656220837ecd5de7cf23c442b5945e038496b3ff9a4eb02447e4bf1d03f1c00f

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
314KB

MD5
9477f94ac0a4b1e9d6e433a885650269

SHA1
c9168b4797f075664e53613425addd2e56cd421e

SHA256
5cb783b1f6840c883cfb5c509373b9607e3a55d11666675251d0ea8769df7de9

SHA512
b3788085c048b25d93a0c29ee6607119c8bbc7dc876c439e2c9a6a6e1202aa02e42222fcdfb2a3cab34cab7868311847100f606771f4783239c2ddfdfd3aef0d

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
314KB

MD5
beef4f6118bd17523c31e74249939523

SHA1
7f00d508f63aaf61ea9b2822b5a5bd8996e63776

SHA256
2f24da6eadc254fe4ccdb2f3d2fba6bd7c493a18104bd976e4a5565f7ba19f1e

SHA512
587aba90e4f220a6dcacc6740c9a9b01af32d4518ffe2602f79441b8527e22b6b9d92ceef42c6970c5d3b439556457f574a4c3ff543e1754b80a54e5e6d9a2f0

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
314KB

MD5
ef8896f09fff698b543e4bb11c8fb52c

SHA1
a05c06be17449f0a6ec9395a5114b9be71013189

SHA256
8d2bbe046bcc798653078225b1e9b4ada6589179945ba2bf512b7bb32cfc65c5

SHA512
8b61e2b387bda5de002ec89c41fb5d6d2614bda0c0dc7775b5dc624f45248412da9b5deb7fd03f1d33e3ba6529e9c907495f29a0e8a44a72a6a713749a7a573f

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
314KB

MD5
4606ff4f7af9a5a4ff56769b353561ed

SHA1
70f9d0b921919abfac242cc8aeb34caaad7ebe94

SHA256
3e1b2a5befd1544b2ffae331209df00946487ccfba98477b1feb40ad842b4853

SHA512
03c07d8a18c90b2c4559cacda586511c24f509755c9a640695eb1afde458a349e37980b9ee776f83d386f48d5688174fda2002133dd7a5074d98f77ca4dab59e

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
314KB

MD5
f4ca78012a1c0ccf234a034b3dd6409f

SHA1
a6909ad6b72a0d467b72c52a44d9c178857730b9

SHA256
205c69c1b4d6839f86a13ee99556d77240273e377c450d2067a62e0182afc924

SHA512
d09018d3972156ba7d0183887f2041e36509fa1629f40f0dbef11ba7c2bf55523c7173c29cdf70f52feca2d078b35db80b6ac7fc5e5168fe4ff860100b6da417

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
314KB

MD5
93c1b59759646a93bd8c4d388c28578b

SHA1
0a034aa65c827edbfdb6116e144dc238b2b12a9d

SHA256
184bb1be027f215a4bbfdffbf42592e553c9d47f46be1f671583d6aa23143db9

SHA512
e03d822613cd60175d0fd582e7fa11fccc80616d493d36a1bff2f5b1b9dfd4739cfdde9a040cd48f6153a40a3f77de7149b334db35e803addd0b6b1421ff13ff

Download Submit
C:\Windows\SysWOW64\Mmpijp32.exe

Filesize
314KB

MD5
681399e448cac6c3dd38b767feb3caaf

SHA1
df28c47729dd35efe556e7aec93824f23e35191b

SHA256
098918b5527cc17717cd251cd65a79f829dea8f9167b58c5dfeb6274a8f3803b

SHA512
6a498b75f90235cecf0b62fc30591ec0b37ba93e4062660a0471175011060515698b3891d284bf51537d8f71bc76989eea7651b97f8437152f7f1774793fe812

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
314KB

MD5
0da1378367b4ef0096f71eb700d61f21

SHA1
633111010dc1108e470ca57af52ae61d6367741d

SHA256
4b140169ddfe048073ddd7ff0d1610482b1df093061a3c3c1e264ee187d9c90f

SHA512
3568212b25673d12ce6115898f862daf0c71358c3fa1ce2f5d169c3de4cb9d2524de6721e1e877ac91b56766a8f79bffcdf2b4206aecb66c81b5725b797101c5

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
314KB

MD5
811a79d76b7e92315cc4d94f8f7d0974

SHA1
3cd531d0997212660d615db1fbe6e9468be71e13

SHA256
291a267d4fdfcbfb9d7818c39b855d9bfb20a184058d5e7f30f0b73111b05ed5

SHA512
c29d5f21c0889d828a4ba4ab9ca5010c26ddcc664e730da500dab3e45ec4d07aa24e37b2e544034a7b297c1f63affe8aff5905d9f54545c2488d2edc3fa5247c

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
314KB

MD5
66891bb5fbc64aa7479b681fb8531154

SHA1
a4a687eb4a0f681fff4f09aaa8ef648a14b7ca18

SHA256
22025a861627c55fcb9a95d88c8c07a8d60da076df6fee790c45e029e13e1def

SHA512
f84fc1d087fd12104ca9089ad7b264f4384e3bd626c310439ff8bc19b5fbc1987309da8e95626be5a1e26b751149ae14c6e2f8d1f6e5ebe95037219969e05bc9

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
314KB

MD5
12b65c57b47463efbe0194a3d4ee070e

SHA1
13707fcaad1fcaa1ac9f72a9a4565cfdd8129fa7

SHA256
89bd26f0fc320c9ad8c80942c6c8f12f3c562e144ea0629b4321111e6e32898e

SHA512
0ed43dcd056d9e82c91c1e3cb49f355ceeb042ac4567903acdd40e1e2d997ebbabe4dc84c644ce97b613925eaed8b778efd57f3f82b3eafed17bc3fc0b1cf5b1

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
314KB

MD5
345ef98495abba5eac70a5d8092ccf0c

SHA1
09ca6465c4ad1a5c37109a32a231f9d17abae325

SHA256
d900de773b4b753cbc7ba7d4b83845ea7ed718bae22cbeeada2efbfa90be0d8b

SHA512
a896e9493e2575acf76550b6a31c5757a46f51b9f915b4d0262dfcc28f11f6b6e5587d4a3b4ae99711d90518214b41e8df2ff88ba8937faffa6a6367731a5033

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
314KB

MD5
7b5d7fa75409957aee2a192585d18722

SHA1
2ac48f6f9c7c113898503912ab27791e2d4cb43b

SHA256
327d39f1f4b99566d44df354c7ce65e854a095015ff4f25045f834e5d75b48de

SHA512
6e2d7f1c6ad8b254b6a723739f7c4dee4cd76ff202a9c645dad89fb9baf846e3d65bb75819ee03f3a0c1d0e741e37bce62d549c795cdc6ccea35208802dba82e

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
314KB

MD5
84750f5924dce8873319d8f88ea48195

SHA1
076c1dab19e6cd21dd3b5a4c27b7e8fcac9ddf0d

SHA256
72a359fcdf4964ac3a8e31ad0beffbee45e2bee1a0331172dd4aa10d59abbbf3

SHA512
6429fd1ca526c1104ec21a0a632efc248e70ba2930442cfdd21bf06f26c9ebb5a481731dc5101dbd44d6de6679707cd54d41ef215c4ac7f1b390ab5d18a3927c

Download Submit
memory/212-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/224-287-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/228-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/516-473-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/628-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/708-128-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/756-461-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/816-353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/960-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/960-580-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1076-497-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1168-317-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1440-401-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1448-192-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1480-365-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-200-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1556-533-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1632-341-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1668-443-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1672-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1696-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1756-152-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1840-371-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1892-573-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1892-32-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1972-594-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1972-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2072-347-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2088-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2208-383-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2240-88-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2244-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2276-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2292-479-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2324-275-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2328-144-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2456-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2516-305-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2616-515-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2768-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2796-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2832-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2924-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-24-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3076-263-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3140-491-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3176-521-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3240-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3280-335-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3312-559-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3312-16-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3364-359-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3424-587-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3424-49-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3544-588-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3556-311-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3716-419-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3740-413-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3768-395-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3800-509-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3820-553-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3824-425-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3964-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-539-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4032-552-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4032-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4136-567-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4244-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4280-574-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4316-503-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4368-281-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4376-449-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4408-581-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4444-232-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4464-293-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4476-467-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4484-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4520-560-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4524-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4556-437-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4572-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4644-485-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4656-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4660-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4768-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4800-377-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4836-546-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4992-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4996-455-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5012-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5028-431-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads