berbew | c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45

Analysis

max time kernel
96s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
Size

164KB
MD5

9f9001427f1b8dc066467425fb77c6cf
SHA1

0f078bf0a7085dfb87cde4c253c89a843fdd31be
SHA256

c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45
SHA512

412b1d9964cbb6a2611b4aa5d20b738184933543cdafc7372939bc9fe24e055239a189dd66d4d1768ff34326440c25c8cc34be3ce67b7cab1dd2761fe491f466
SSDEEP

3072:M0JiiavMlNqBygysKG90BZS808uFafmHURHAVgnvedh6DRyU:M2i1vMz169yS808uF8YU8gnve7GR

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmcojh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcbpab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcojed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kikame32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcagkdba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmoeoidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amddjegd.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1964	Eleiam32.exe
1516	Eemnjbaj.exe
4692	Fafkecel.exe
2540	Fdegandp.exe
4420	Fkopnh32.exe
232	Fhcpgmjf.exe
400	Fchddejl.exe
2180	Flqimk32.exe
4824	Fdlnbm32.exe
2148	Foabofnn.exe
4996	Fhjfhl32.exe
3508	Gcojed32.exe
628	Gdqgmmjb.exe
3924	Gcagkdba.exe
848	Ghopckpi.exe
4104	Gohhpe32.exe
5036	Gdeqhl32.exe
1904	Gokdeeec.exe
2664	Gbiaapdf.exe
3340	Gmoeoidl.exe
1892	Gblngpbd.exe
2780	Hiefcj32.exe
3540	Hkdbpe32.exe
5096	Hckjacjg.exe
4008	Hbnjmp32.exe
5008	Helfik32.exe
1324	Hmcojh32.exe
1568	Hkfoeega.exe
1864	Hcmgfbhd.exe
4072	Hflcbngh.exe
1496	Heocnk32.exe
4972	Hijooifk.exe
4400	Hkikkeeo.exe
3580	Hodgkc32.exe
1692	Hcpclbfa.exe
3252	Hfnphn32.exe
4652	Himldi32.exe
2616	Hmhhehlb.exe
2280	Hofdacke.exe
3664	Hcbpab32.exe
596	Hbeqmoji.exe
4896	Hecmijim.exe
3792	Hioiji32.exe
3048	Hkmefd32.exe
1520	Hoiafcic.exe
3928	Hbgmcnhf.exe
3052	Hfcicmqp.exe
4268	Iefioj32.exe
4776	Immapg32.exe
4360	Ikpaldog.exe
1036	Icgjmapi.exe
2056	Ifefimom.exe
5100	Iehfdi32.exe
3456	Imoneg32.exe
3652	Ikbnacmd.exe
3144	Ipnjab32.exe
5060	Iblfnn32.exe
4780	Ifgbnlmj.exe
4408	Iifokh32.exe
4352	Ildkgc32.exe
4832	Ippggbck.exe
4820	Ibnccmbo.exe
3104	Ifjodl32.exe
436	Iihkpg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mlampmdo.exe	Mpjlklok.exe
File created	C:\Windows\SysWOW64\Lgepdkpo.dll	Npjebj32.exe
File created	C:\Windows\SysWOW64\Fchddejl.exe	Fhcpgmjf.exe
File opened for modification	C:\Windows\SysWOW64\Ipnjab32.exe	Ikbnacmd.exe
File created	C:\Windows\SysWOW64\Fllifblf.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Iifokh32.exe	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Njohbh32.dll	Ifefimom.exe
File created	C:\Windows\SysWOW64\Ibcmom32.exe	Ipdqba32.exe
File opened for modification	C:\Windows\SysWOW64\Jfoiokfb.exe	Ibcmom32.exe
File created	C:\Windows\SysWOW64\Kcdgpfak.dll	Jioaqfcc.exe
File opened for modification	C:\Windows\SysWOW64\Gmoeoidl.exe	Gbiaapdf.exe
File created	C:\Windows\SysWOW64\Ifjigbdo.dll	Hbeqmoji.exe
File created	C:\Windows\SysWOW64\Ceacpg32.dll	Ikpaldog.exe
File created	C:\Windows\SysWOW64\Allebf32.dll	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Mnodjf32.dll	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Ogbipa32.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Nlmbpgdl.dll	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Mhkngh32.dll	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Chmndlge.exe
File created	C:\Windows\SysWOW64\Eemnjbaj.exe	Eleiam32.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Mjpabk32.dll	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Fdlnbm32.exe	Flqimk32.exe
File created	C:\Windows\SysWOW64\Ogibpb32.dll	Lepncd32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Lpnlpnih.exe	Llcpoo32.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Mdckfk32.exe
File opened for modification	C:\Windows\SysWOW64\Fafkecel.exe	Eemnjbaj.exe
File created	C:\Windows\SysWOW64\Aogmoeik.dll	Fkopnh32.exe
File created	C:\Windows\SysWOW64\Hofdacke.exe	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Iikhfg32.exe	Ifllil32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Fhcpgmjf.exe	Fkopnh32.exe
File opened for modification	C:\Windows\SysWOW64\Gbiaapdf.exe	Gokdeeec.exe
File opened for modification	C:\Windows\SysWOW64\Heocnk32.exe	Hflcbngh.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gblngpbd.exe
File created	C:\Windows\SysWOW64\Mpnaemnl.dll	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Oncofm32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Npcoakfp.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Qmmnjfnl.exe	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Ikpaldog.exe	Immapg32.exe
File created	C:\Windows\SysWOW64\Jlpkba32.exe	Jefbfgig.exe
File opened for modification	C:\Windows\SysWOW64\Kebbafoj.exe	Kbceejpf.exe
File opened for modification	C:\Windows\SysWOW64\Kdgljmcd.exe	Kibgmdcn.exe
File created	C:\Windows\SysWOW64\Fkopnh32.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Mfadpi32.dll	Iifokh32.exe
File created	C:\Windows\SysWOW64\Kbfbkj32.exe	Kebbafoj.exe
File created	C:\Windows\SysWOW64\Aomaga32.dll	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Cnkfcl32.dll	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Pacghh32.dll	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Hflheb32.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Medgncoe.exe
File created	C:\Windows\SysWOW64\Fafkecel.exe	Eemnjbaj.exe
File opened for modification	C:\Windows\SysWOW64\Iefioj32.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Nabqkgan.dll	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Madnnmem.dll	Lffhfh32.exe
File created	C:\Windows\SysWOW64\Fplmmdoj.dll	Ldoaklml.exe
File created	C:\Windows\SysWOW64\Npjebj32.exe	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Baicac32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6212	7076	WerFault.exe	269

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbiaapdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iehfdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iihkpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgljmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpqiemge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fafkecel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olcbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oneklm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkfoeega.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hodgkc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikame32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdjagjco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhjfhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifjodl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iikhfg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckndeni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foabofnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfcicmqp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifefimom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmpgldhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkdbpe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcmgfbhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kibgmdcn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hijooifk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ifgbnlmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpnchp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmlpoqpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbnjmp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icgjmapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jefbfgig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfhdlh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljfpnjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpclbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpnlpnih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpebpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Immapg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikpaldog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipnjab32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpnaemnl.dll"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hioiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekclg32.dll"	Gohhpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecaobgnf.dll"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fojhkmkj.dll"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iifokh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcbnbmg.dll"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlmbpgdl.dll"	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knfoif32.dll"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipeomnnj.dll"	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaeokj32.dll"	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpeohm32.dll"	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eheqhpfp.dll"	Immapg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmcpemd.dll"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnkjc32.dll"	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogbipa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fchddejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbeedbdm.dll"	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imbajm32.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmcojh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1964	1216	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe	85
PID 1216 wrote to memory of 1964	1216	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe	85
PID 1216 wrote to memory of 1964	1216	c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe	85
PID 1964 wrote to memory of 1516	1964	Eleiam32.exe	86
PID 1964 wrote to memory of 1516	1964	Eleiam32.exe	86
PID 1964 wrote to memory of 1516	1964	Eleiam32.exe	86
PID 1516 wrote to memory of 4692	1516	Eemnjbaj.exe	87
PID 1516 wrote to memory of 4692	1516	Eemnjbaj.exe	87
PID 1516 wrote to memory of 4692	1516	Eemnjbaj.exe	87
PID 4692 wrote to memory of 2540	4692	Fafkecel.exe	88
PID 4692 wrote to memory of 2540	4692	Fafkecel.exe	88
PID 4692 wrote to memory of 2540	4692	Fafkecel.exe	88
PID 2540 wrote to memory of 4420	2540	Fdegandp.exe	89
PID 2540 wrote to memory of 4420	2540	Fdegandp.exe	89
PID 2540 wrote to memory of 4420	2540	Fdegandp.exe	89
PID 4420 wrote to memory of 232	4420	Fkopnh32.exe	90
PID 4420 wrote to memory of 232	4420	Fkopnh32.exe	90
PID 4420 wrote to memory of 232	4420	Fkopnh32.exe	90
PID 232 wrote to memory of 400	232	Fhcpgmjf.exe	91
PID 232 wrote to memory of 400	232	Fhcpgmjf.exe	91
PID 232 wrote to memory of 400	232	Fhcpgmjf.exe	91
PID 400 wrote to memory of 2180	400	Fchddejl.exe	92
PID 400 wrote to memory of 2180	400	Fchddejl.exe	92
PID 400 wrote to memory of 2180	400	Fchddejl.exe	92
PID 2180 wrote to memory of 4824	2180	Flqimk32.exe	93
PID 2180 wrote to memory of 4824	2180	Flqimk32.exe	93
PID 2180 wrote to memory of 4824	2180	Flqimk32.exe	93
PID 4824 wrote to memory of 2148	4824	Fdlnbm32.exe	94
PID 4824 wrote to memory of 2148	4824	Fdlnbm32.exe	94
PID 4824 wrote to memory of 2148	4824	Fdlnbm32.exe	94
PID 2148 wrote to memory of 4996	2148	Foabofnn.exe	95
PID 2148 wrote to memory of 4996	2148	Foabofnn.exe	95
PID 2148 wrote to memory of 4996	2148	Foabofnn.exe	95
PID 4996 wrote to memory of 3508	4996	Fhjfhl32.exe	96
PID 4996 wrote to memory of 3508	4996	Fhjfhl32.exe	96
PID 4996 wrote to memory of 3508	4996	Fhjfhl32.exe	96
PID 3508 wrote to memory of 628	3508	Gcojed32.exe	97
PID 3508 wrote to memory of 628	3508	Gcojed32.exe	97
PID 3508 wrote to memory of 628	3508	Gcojed32.exe	97
PID 628 wrote to memory of 3924	628	Gdqgmmjb.exe	98
PID 628 wrote to memory of 3924	628	Gdqgmmjb.exe	98
PID 628 wrote to memory of 3924	628	Gdqgmmjb.exe	98
PID 3924 wrote to memory of 848	3924	Gcagkdba.exe	99
PID 3924 wrote to memory of 848	3924	Gcagkdba.exe	99
PID 3924 wrote to memory of 848	3924	Gcagkdba.exe	99
PID 848 wrote to memory of 4104	848	Ghopckpi.exe	100
PID 848 wrote to memory of 4104	848	Ghopckpi.exe	100
PID 848 wrote to memory of 4104	848	Ghopckpi.exe	100
PID 4104 wrote to memory of 5036	4104	Gohhpe32.exe	101
PID 4104 wrote to memory of 5036	4104	Gohhpe32.exe	101
PID 4104 wrote to memory of 5036	4104	Gohhpe32.exe	101
PID 5036 wrote to memory of 1904	5036	Gdeqhl32.exe	102
PID 5036 wrote to memory of 1904	5036	Gdeqhl32.exe	102
PID 5036 wrote to memory of 1904	5036	Gdeqhl32.exe	102
PID 1904 wrote to memory of 2664	1904	Gokdeeec.exe	103
PID 1904 wrote to memory of 2664	1904	Gokdeeec.exe	103
PID 1904 wrote to memory of 2664	1904	Gokdeeec.exe	103
PID 2664 wrote to memory of 3340	2664	Gbiaapdf.exe	104
PID 2664 wrote to memory of 3340	2664	Gbiaapdf.exe	104
PID 2664 wrote to memory of 3340	2664	Gbiaapdf.exe	104
PID 3340 wrote to memory of 1892	3340	Gmoeoidl.exe	105
PID 3340 wrote to memory of 1892	3340	Gmoeoidl.exe	105
PID 3340 wrote to memory of 1892	3340	Gmoeoidl.exe	105
PID 1892 wrote to memory of 2780	1892	Gblngpbd.exe	106

C:\Users\Admin\AppData\Local\Temp\c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe
"C:\Users\Admin\AppData\Local\Temp\c8758d817da289a9747dc60684a9f9d25b450dc39b64b4a6eaa87439c488aa45.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\Eleiam32.exe
  C:\Windows\system32\Eleiam32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\Eemnjbaj.exe
    C:\Windows\system32\Eemnjbaj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\Fafkecel.exe
      C:\Windows\system32\Fafkecel.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2540
      - C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:848
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2780
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3540
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        25⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4008
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        27⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1324
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1864
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1496
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        34⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        37⤵
        Executes dropped EXE
        
        PID:3252
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        38⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:596
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3792
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        49⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4360
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1036
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        55⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4780
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:436
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2904
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        67⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3536
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        69⤵
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1888
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        71⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        74⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        75⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:824
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        77⤵
        Drops file in System32 directory
        
        PID:3296
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4544
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2104
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5080
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        82⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        84⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3232
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        85⤵
        Modifies registry class
        
        PID:4552
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        86⤵
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        87⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        88⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        89⤵
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4276
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        91⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        92⤵
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        93⤵
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        94⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2308
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3292
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        98⤵
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        99⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4748
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:3904
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5236
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5280
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        106⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        107⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        108⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        111⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5632
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        115⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        116⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        120⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        121⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        122⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        125⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        126⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        127⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        130⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5536
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        132⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        133⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        134⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5708
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        136⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5832
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        137⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        138⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        140⤵
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        141⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        145⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        147⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:3196
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        149⤵
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        150⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        151⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5316
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        155⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6088
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        158⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5844
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2040
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        162⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        163⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        164⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        165⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        166⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        169⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6348
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        175⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        176⤵
        Modifies registry class
        
        PID:6632
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        177⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        178⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        180⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        181⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        185⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        186⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7076 -s 416
        187⤵
        Program crash
        
        PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7076 -ip 7076
1⤵
PID:7140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ageolo32.exe

Filesize
164KB

MD5
96fbc602b2cfa19338ca3b71f4535795

SHA1
d48140b15ffaec1fd24409d684f9dc61de5c79ef

SHA256
65fcdf8894a0c1f92d7a9cc2cd14aedb058c20cdc5b45c7082a2b7b7f1575ca2

SHA512
127e91bf0119d3f6c1cd8e3460054c1c1bfe460322c59a04139d861fd21ce3e822e8c2c201cd0915d483a96f098753b6b486f50350808dfb3ccd0bc8aa1427b1

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
164KB

MD5
da8d0940460f73a05db7343780aab046

SHA1
01818cc93c02f14c971f4e40e9c8ec7fbf77bd7b

SHA256
589e5d5eaaa06479db98e9ac0b8d761b9e92ad5645a3a6c97619b97b8bc45c0b

SHA512
2aa9019ede2750b63134ad675024dabbe47ce59f08ccfa679426d32873433320b0e32d87640370fc550b6c123ad0b53a90aa22a2ed188a6882b18ad991b66269

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
164KB

MD5
cb3693bc41eb05f2fe4ae38a158d9e78

SHA1
ee9b2c7990e51f3d9d3bdf799d37cf6c0ee01b70

SHA256
175ebde314a3c94b06b340a68825759ab3dda19e58763cb98995964f5cabe533

SHA512
f8949943624482f1da539554f7f4961020d3403b861cf917f237a2fe9ec85961399aa4645f2ca06b908bc49acec61ac69aa9168de9fc161657f71e65e37962ce

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
164KB

MD5
e239433ec9c366930d535ecded60ad81

SHA1
465ab8e3b36354e779f6a3a38ad44c62c5b6856e

SHA256
fcb5d3c928157f2c076d02cf97329930607239785a234f16a18d1e83cb8e9a4a

SHA512
62b8af859d477aa86f7cecf2b45076d3193960ea430121d0f03b9d870daf0eee8bcbaae2cc3621ae75814b8886a783ea4da3474514eacc2aa307c341151d027e

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
164KB

MD5
f1ab3ce75f9c63b1662d82bb01e6be3f

SHA1
8de2ce46dd7b5c4e62dee2a94fa42080e4cf915c

SHA256
751bfd081918162aae5c8343934376f2810b096052dfe5053777f81c735ad175

SHA512
1c684cfb3b99454dd38f78d4963a1b8b88437de9fc29a601309edea5173f0b0f4a2236fdf0b726c7a568161e18b019b33b5474b0ef2a2ef3e38c240f127745b4

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
164KB

MD5
d3c740c70985cc25fc39a327b34150fb

SHA1
dc193965576c4375a1c7f54cab27a19cf6454d04

SHA256
dbe9124ea96501cbeef3fada14e080ac082f733a1c8a860fe00ff391a997567b

SHA512
ec07ee2f402a75ae16a7277c2a3b3ab210786722d5c9d0158bffacdb7f16a0fea739df06a30fe1153df244bb406faeca73c66be46e96243547a68e66c85b91e5

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
164KB

MD5
f6c853686b4166091a9ee1ddc909a0e2

SHA1
2244e4ad7703a29f6b2b7c8fa5ad1dc5a72d3039

SHA256
a5df247b3cdfdce0683b8d97b19d8b844c15b424526296fe77138c794ba26252

SHA512
a7081bc71e2338b7ca7f9fbd8be57c91a568f4c7b64941303e1ffeaf1c11d390e58ca24c099ee30b58c6fd85df73632ecf970ef84be89bf3553cf5db606ff899

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
164KB

MD5
c2d7714a8cf0a02e449029f201e49670

SHA1
016ba3b0c3b9fe73e3e9e5961ac356dffc6cf017

SHA256
3f0d9eed1b1d6c650ac7efc2888171235d72c955ca9a654819feab48233ed195

SHA512
0d68f4667472d79289498cad46f4af4ed7c5245b98955e1002759985a4686b810a1e2ae1f9fc75c407b0b87fa7e943370b62d2a7d228ca699cd12c3a36f5c417

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
164KB

MD5
5e47b44519d3ebf9f98b6acc6011ba4d

SHA1
032fb8bb44a2ee981d9802bd21172e228fa651f2

SHA256
d787e13abc6a9c039454bfa7df6c672fa1cf13e20702f2b43f198fb7f872b1d8

SHA512
312562477ad672f04febf6d8eadc714c768fa2906782e5387adcefa1037db393d7430f77889048816afb5ddaab38f3881d108fb5da49f0e1bff1dee3749de2c7

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
164KB

MD5
1811152a5671d28f1f3c9242f705b5eb

SHA1
55c7cb081ca0e96eeb7b90ffc581a57df51fef74

SHA256
36f00c05cd7d672632ae1d0f0c7822758cf187ad042ec60ff47e69360e71c270

SHA512
1b3713ccee83504015e8a99e1ed7f314705a1513d41dd7f0c84551af7123c72c70c975f1bf4de514f874684612c33b09f66a8245f66482ff5086269f8bd8240b

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
164KB

MD5
44616c36729f6b02ba47e2b503740bcc

SHA1
7f7379f6f15d8c4cad1bd97b2a138915f8c25485

SHA256
808b0a7741c77f9750a05858df4de28fb866e60c85d76f1b4a165a8bb7338d0e

SHA512
2dd2a75ab23cf858d31e5086d0f005d68bbdffbb4b1bd9e5ee6f4a245fbb4919dd0cbafd692c321a2c0f5f55c68616e67b9128116e752aa861c81b0c5a8c0049

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
164KB

MD5
fd9c7d778325f977c8aec4f5ad91b747

SHA1
6a050bf4b1427b863a498558bfa0e9f41fafb630

SHA256
6697bfc86d4b59c7cd2d0b3ddc2d03e5e4fb54df1ce32399bfcc599abaebb333

SHA512
bedf63556095ddb8946d2a3995b47a4697235f64ecee168deb87933d16a536b863923d879061be7461b444d5ca84ded98772e1e5ace444f60f1b1b95612666e9

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
164KB

MD5
5f1a9f18ed276281b97b82edf6f82409

SHA1
25afaa03bad1900839b90d9fec6768c877657f08

SHA256
e8e286ece5bb84206828fbea80816557628c731e8422f65413910252c9726f21

SHA512
7d17768db5022df5aeff9237d329e6497905b7023e14c8dfb56402bbb70c99f21eaf565513c14d357e42a59b174bb0697b698fdf1c58588e2007f4d454aa76ea

Download Submit
C:\Windows\SysWOW64\Fafkecel.exe

Filesize
164KB

MD5
9b44f210d2a064eb831d7974d6ff9c3b

SHA1
e2b76d3252820ef1456d7d4fbe222d613f7f5180

SHA256
00600298da3367315db5d5755ca0b7ef0a38ec1acf0715b8ff9822d55e502515

SHA512
23774ae95f52aeb9e6be757fb97545ed869e06558349f81a10be205e9d38e0c7403598cc5a7658e872f9502a3b31070875e83260f15767f7ae92d280c2445740

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
164KB

MD5
3f0372353c39bb6f02aa7a03f1461837

SHA1
bfb21e9179a36bf50c4c6e5b308cd57ab6d2040f

SHA256
ed1ae445f8de87f269f5d5d27469609388f979c46b63f1e29171b87cc8a66fea

SHA512
c452d4466bf253bfa7d53bd744270b509de6689c5048405111945dd4e01af26a754e8ef1db0aa95203a12ee72982be910df5b307b96af6e71c254c472b8879cb

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
164KB

MD5
aa6c8ee9c7eb157252eb43cd3bd9b323

SHA1
3567cda1718bfcb9a0461773a5615afd04452beb

SHA256
a6c295a05b4a3449676c3cedec0a0b1c188234fd7142ebacf5b01c9b413dd1de

SHA512
fbe5181c1fbd5b68f0c6bb9c0172b747012c5257c8ec05946c0bef64f40f037eca96daf49f269414cae9120f85b3b64be7731ee0e934fb2f64c1248e6d5df140

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
164KB

MD5
e0fd33f63c61daa33407430766908cf9

SHA1
9e2e663b5553a336f0c5a1d24ee50d7f7b103c44

SHA256
09eb44607c684966f16292d3cd74059696bc4c652a633cfe9a4e7c9dcb8709bd

SHA512
592f7c7a6db08be02296b6a2bc47da3e570976da3d07257c325a5b29798517226d65b8760afb7c9d197c7a7244745abb03ba38cd322915eee98aca5dae503deb

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
164KB

MD5
012fbc057b9530c2afd7c2d0728e35b7

SHA1
9de9168ff3c0da24d5caf2990f97d86145637889

SHA256
bfa54e51c75e05e4f757ee7e0a2557dac73e2590a98d78d96db07a6e7d75ff2d

SHA512
d8bbaee822183466bebdd00f2da1a45cedbd140c20f7cee7a7627261d51f1869f665af1cec4ccbcee72586cecfe3055573abf8abb3f5de3f597fb1e0b1b07de8

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
164KB

MD5
d3dd6d627d4419df090a94d15dda652f

SHA1
273af89e2a837f0c52d7f557390ce28c2d5eb770

SHA256
45c4f0145ca2085b26546a815762b04356a03b796d63fbe23c1a0b6a65201ff9

SHA512
d78b0ab77021f7f97e9c61e8436d0d325d3c0219664636604dc6ec51b19e2d4d4847677c9a3821e486e0f176d6a62de12e4547707c97dd2b02d3e78ff20e6209

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
164KB

MD5
a442871839335d9fd562a30fece40aea

SHA1
898d58bb5f884ca104bf2184da857e19ef029041

SHA256
9b618b2499e9a3aa6db35161555fd5d57e6313069a7c96215c14369b416a2888

SHA512
54889e8e8fad9956677154d25bc7354a6e3be98ab780e6e0f67b071f62b40ad9c021d60da2764a1e118e4095328943c5eccb5b9dd1e827cbdaf4d6eb1aab705c

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
164KB

MD5
a1aaf7f38401d9506fc1106c1c0d33ad

SHA1
d6dc381f239d4223133c6446195feb06b58912a9

SHA256
61b3d37b2d9d5e5e37b86308450ffe353653dab43fe3c05186912951a499a06d

SHA512
3a7c6c80fefb3db49d4a4a1cf830450ba574f9ec344ceae7c9a191113f49c4918ff53893f2837d33258c40c413d2961983d2d395f0a63820a17dd44563c0c339

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
164KB

MD5
cb836f1b8256d5f771ac9a42ad89e8b1

SHA1
c249f9ba3a08683da90a0d90e73c155d06f07c63

SHA256
c54018f960686f69ce057428189d7af4bb1fcb50bfae5d960d5450883d6e00ad

SHA512
13cc2d404a8e59ade9cdbbb45e177abb2a48bd074b3f22921ea9b41d98d4a8e88746bf753385280c1a73bc00543771f2bcca67b20409eb3728bfc172ddd5d762

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
164KB

MD5
21029dbd5c4bd966c9d2565791df3907

SHA1
ff484069516f3faa9086de33addfb82bbc84d5d4

SHA256
ef860c6fd51e7707fe55446115def23b50e31267e0a4efb2e1903a099686581f

SHA512
f085d57a4c05d66b886a99a0c9e16fcf3f5dccc0a304ce578ca69e9a5871dc95648df2b9f58a6980e06249c30e1b5c899bc3dfa9bffe124917fe9095c98a8a56

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
164KB

MD5
14dd672a21eb6522436693d420c554de

SHA1
e1177373d44a54e0763a73be26c48d7d2b2660b1

SHA256
fcdd7f656f4f0101f56d60606f8a9e8252024efdb254d6a5eed952e10410b84f

SHA512
34a82f871af48882fd60492573b9fd21f2c2901a7c131307c4314a55422350a39eb24412aa88c1cfaafaf7e35b8b9104854a50f76f729c6a8670a5de62da8890

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
164KB

MD5
73601210f3a7347c9445e24e76f42705

SHA1
7b6838ca93eb1457664709c179c613fa62d2e754

SHA256
ce73c9e685ab4b9ab4db71d6b51691afcc7f0db148364033e62f1590116a7b52

SHA512
680d95f446f392fe518fcf7cdce520d07cc27f950c7fd9c30d35317e7348b51c17e8165417ccc7a5330f4c515e1033c55a43b62983f1b5582fb4d0b7be22d450

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
164KB

MD5
5feb47b9b67cd1d33c613b15ac065f99

SHA1
b4bea84022ef437d98d58f4ad27853a04c5ecf79

SHA256
7af3ad704d47acffae3a7c9aed5a9e4eb5a2aa2543d656aabf28e0d0959cf31d

SHA512
38560ed9c89bb3935314c906acf6715377c81e15d90d074fcdeaeefdcb59f1826fac4b606aa7d1979b2d0b42bef07a300d8f704e02bcccc31caac1ab9b947ba3

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
164KB

MD5
4b34961f7e01873e311d49b04ed60b23

SHA1
4acae04f69267bd62a13f8ddcbd6400f940662eb

SHA256
8f94ce94da35f51a4d64e36908cb997ba950e6787ee46f84a41b7492d43bac57

SHA512
5753563eb1b9efb31d1674af9e1b0489313131b374593488e26d4b021fcb0549e5981fd0e9c5c9009b4a5eb95ae82798e1ad3937af457c3d19664afb9c328705

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
164KB

MD5
20f8fcfefa0ec17df4a8e5c279d57715

SHA1
65a8cb8d6baf59d4854772ed58004cc11d9acfe9

SHA256
b856025604bc3444cf4d3c4e98a3359d093f3049dc2e1d5dc83f087240d305c6

SHA512
bfbc246f1ad3ecf8f8841c95e5783073cacb0f48d7bc85a3ad857e2dfb4d162cdf22f0981c265dcff848830013df95f68d471ba90417af8baaf0a8eced59fdc0

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
164KB

MD5
3286a6a0353b52242ea056c5cf687d40

SHA1
f6c7a81bc37fa0e21f25308db0d3223d7895d9d3

SHA256
1eb5bb151c03c9585815cd9a46f168e4fdeec798f7d16904bd9e611d10d5c8c2

SHA512
7a81080682992a22387d88e0be29cbb7c591a4dd96d03ae3c1376b5a683c9a44f8361719e04335bd194e278d6a77a406d7eecee5ff5c3c9f1209821201335b8d

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
164KB

MD5
a7fd3f545a66ad45efbaa2b9e550517a

SHA1
5d2dd3a40dcc8e8b68614078a8438f197ef5b133

SHA256
ce71e92266881067558521be33c57e228256e06d65fbcb31ce7322e441dde7c0

SHA512
67ecb8383a074eef1c023c679796843e7751991d28b30dbbe1bdf27d240ccb1a247a6586470870609aa7725f1b9410ae1431d996d7d584d195b590fb6c217499

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
164KB

MD5
ebedf3ebe9ce92ba11e5a974de1cd254

SHA1
273ec40347f65da85864b5c8f1ff5c800e6b131f

SHA256
69d72c2e63cd64ab9e21969ff1ef7b85d3554ce6409a4ac4ce9136da3c964097

SHA512
273256d9b6caeada40fa643d1724b76efd7dd1905fa9d2be0ad12e64c455338035f347da074d6c7e2ff423db1b688c1047fb68041ad73d5f35a62d94fdb90552

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
164KB

MD5
5ef1985991063755fc2f4d334c7afb58

SHA1
824fe75d85955a899eb7e441a1f1ac35c8b906aa

SHA256
7dffd1e7d9c97988a9ffade2b9d2cdba6418fb8c85769941387cbbaafadcea47

SHA512
41630308834a278bb8aeec3f01e913a8be80eba3cb36be3c99f4467227085b9493421a92d33fb332ef3e1f2bab61b247270deb57dd523344a2c56058d0a2f67e

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
164KB

MD5
43bd0424d8404301d01a5c9bac59bbbc

SHA1
d3776d907f955f87c59d1846fedcfbc9a8353e2a

SHA256
431003865d7e4df6ff32b3bdbc14d52ce65a1c105a2c2a61dcd64b5a65317f3a

SHA512
6c6d3721dc49d5def658f3ca16a7f9553072546d6f96f77ed54a9f08ae4049341e8e50a810abb26f3c2fcc8f6266b03a5f8195646f09885590981ac3651ce946

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
164KB

MD5
cac7dfd317b7e0034990ee02190b6889

SHA1
d8e4895e92ffa4b48ad2966cda9f8cd6d82dc7c2

SHA256
085a6106b50cfc6afb70cf8a60762398e1cbede36a810c197a27a488110ceb80

SHA512
adb25625d27882dd61aec4fa5afc71ce1ef526dcb89605c5d171f4993cdc50d793e5e9e13972a5c3153c2ad290421714a10c88cef27b3102728f628282c2b991

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
164KB

MD5
3038a24ddea24a786778cdf670ee1964

SHA1
e803e624ea7ff184043b3ff544286927610bcf60

SHA256
f9e5659d59bffae8fc8f3702fb6bc9391684274028d790f0a342d2f1ff4da90f

SHA512
2d5827720b00823533b3d0713f1444512c706431a85fbc286aa5d173db8e760e42f28a8ee286e603fd9edf5a2f00b3c02c2ea6d5e166f4d3097261c4dc423c2a

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
164KB

MD5
862013389d3a4f5991267340bde2ee84

SHA1
fdc70c01e92fb903c93e4741deb924af0e0ea83e

SHA256
30ecde0f9b58c45d6d73167375ebdf9aab9bb80016f419c355dce13307ee87e9

SHA512
d278702bf2389270a0221f2a51434065162a602052438571df544fc332e1ee19f9e7c6ee4aee9fdc931b42f6edb10860e4de59c08353d3d2d64862237be73021

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
164KB

MD5
3a1dfee25c9241d5d803150ede2082bc

SHA1
5e2c36ae51f920f77b98bffae0b51f36d1314d6b

SHA256
2706d6e46dbbcfff78ba66c1043d6d69ddca2ded406daacb2c20c804836109ad

SHA512
c1f9d394913f0b6c1ebc6d106a2bde1a80b7416d7387de355ee26ad5dbc47ef81a93c0c3c61fabf10f75356557eeb71c2f4b98ea9eed952d450dc633e9ba97a8

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
164KB

MD5
c0a4a0289d9338b9f8aeba654334b082

SHA1
ba7de180349c27a874f5cb4466be910f53dbf0b3

SHA256
04b247614d1961a81849767060fcc3c221929591224eb92f01371b566ff5e871

SHA512
9fcece7cea639601ba83f3c11e79bb2ec3432a8626cf5a1fd3ae33c9b65dfff04fa582ab248d47532f943ddb89f3cbff7e55c6dc38fa782777c32c4fb77c3269

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
164KB

MD5
508b0b6c553fa7f0565fa49f2d0f81ff

SHA1
2432de610f0ded8412e23c81c2e26344f77d7f69

SHA256
17f9f78ba4e205ef48b88f7c0836895c34127cc5b68feac43907c1360adc5f59

SHA512
2b1edabe20f270a70fd80ab04dc36aef6c171f86c19df9ca2311828122e39e533c6a9b622145ab62b56931c809ee943dbf237e96565eace9f3c8454d1af24313

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
164KB

MD5
9a6651f7ebda3d37ee36fe80fc48d55a

SHA1
03475eefb3048cbf016c39de9df396e3be9502e9

SHA256
38e705980f111b80d492c2937c797a963cd3ade9cb5a4abace08654d7a290a05

SHA512
ed8fd738fea93a7f947b9b87df7af60ab96fbcaa9cd8f2d559be5e9baceabb8afbb9f3fe2e9bf9756af17a521d591a7bb6cfc1dde5f9af09a8f124a87f244dc7

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
164KB

MD5
346ce0228989e4aeff7798cd761bc72b

SHA1
d68f842b340a8f97f123fbee07e9270dc3b19020

SHA256
d4acee8cc516c77b2a88c6c667c997f6382bc66658b2b145307ee769b3d6ef44

SHA512
4e0fdc51be41c78abceb4edae5081a68df06a6022281c97c82f2583a506444e27461517ebbb392eade7c625314737f112f709a1c771c8870268340e9b3741257

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
164KB

MD5
48054259f511ad1e3d01e1fb36f45589

SHA1
c718fabb7f0892cd9b5602cc3964a070c1c6d350

SHA256
70a96b8fe161511967a2e81f10719a4588e3029e835a90fe26140a30239d705c

SHA512
1eaa70b8539034cd14eba2a1b4f2763e3124ebae2d9e8994e770592511330b89ad6f52153cb64c83517068d9f49f6fa178c4dfd2de7ddccf821e480b7e91c9e6

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
164KB

MD5
6560472412a2075319966eacb15e0185

SHA1
3270f0b1ff76595a6d197d0a09d59debe4fec063

SHA256
81a30201c34e0484c9e7bef9fe3056c8ee8f03312f1bb29143af68f62fbaa55d

SHA512
9eeaccd3bbd229652fd53b3500d912dc6d4a0688cd2a5bd1687168e2061fe080ee09a154d9e9b768c40b6e0798c2f16e9b25b577ca1b9036833110dff302ca11

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
164KB

MD5
90009cc3b0a8ffc7909a8b479fe65b8a

SHA1
8de9d26b268fe4596de4bdd7d6db62403b4831da

SHA256
5a2c1c2110254001db61110b4a410aacf4d928f34c9271c452a8ae7703611715

SHA512
803165e354bfa366089d14e88c4e0f5e683d16bf5dc639f5d32f2ea5f30a355671e96e9e11f45623f40ee66b0f09ecfdb9c53fa9a15f3f892c9fed0a4eec9700

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
164KB

MD5
1c4103d34224e74c3181f37adb862e8a

SHA1
9de1af8c795abca09e24547fc1092bbbdd48001c

SHA256
7a1d5f7fd3d20fb4d1f3072a2e5e27081b08141425583d46fc0da47b318f0235

SHA512
5a1fc9ebba11c6e65485a528b74c033a0919ac1660400b2ce5562306fc61ff8912568c4830fc21ade555506b896e8335860f72bf0176fd044cd7dd246efce472

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
164KB

MD5
62b30ce0a61c9998a0a9f84ffcfa136e

SHA1
68e0909904321fbb0e97e7fd9eb13cbabf96ead7

SHA256
4bbce822da628094e2e93f5a6d72e0b6c81922dcc7bf4a05624237c6e7b27f09

SHA512
59aa6b9dd3a5f29ef24e1e32129fe99cc81ae424752b2b49d65d3f40b18356c8fb71a39d81338539d294ecbf68f551063aeb8de529f0b9b2fde410160ea12c5f

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
164KB

MD5
4719b6bd6428938a544469ce02dbf15e

SHA1
902f55006d92b513ebe4a39325b162f64cd1d0c8

SHA256
0a391763f10759063fe7a2144a3142dd4fc1ef167be7a170fa707ba2c7f335db

SHA512
d117fe75cb83ac37dd25b8cd49d4563d70807ac7d81803351b3450f6442b9fd9b9c8492caa5ba50c7cb21918500d64ed557db19a2823d1f3970e5cc80dfb3783

Download Submit
C:\Windows\SysWOW64\Lfkgaokd.dll

Filesize
7KB

MD5
91881552f0e1558cab3a37ecc2894129

SHA1
36ff7f6d319b28d5a0bc955fc9c124176ca424dc

SHA256
0b8d1f3ddfe9373f8fb48188991dd7c7c09c8c626c18b990baa774cf760a52bb

SHA512
5d2f468cc7f5acb1d6299af720ab9ce465e84f03ec737282ba0474180954d3519526de35da7db62b0f217e6914656b9222c408678af1890aee7d84e9921501a0

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
164KB

MD5
b490e20f1199c09c5699b31b5678db2f

SHA1
3f690ea0d4686f83d7167047995a41d9ffc9867c

SHA256
1e7a57f89e4aacf79e2c50636d56353f0f59e3fe72fe47cf1253e588730e62ff

SHA512
01cb2fc8384be2727445880026782f976fadea7ff6536c5d7f1753d52a73e6fb365d61814a43cd34b6042e50a7b111e70eb11616f7aaa1773f22a8adc5112957

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
164KB

MD5
d53108dbb55a1ddfa34596c8c724b7d9

SHA1
c9b0ca456e9c23f599d78d1c5b9992e7b17af737

SHA256
68a39af4d65475bd2a44b2d51878eb5064c54e2f6e9079914deaf24cf35851fa

SHA512
33a6700cd0020a1c6c9dad887f6cc18e987d8360628bb14c6b1afd0a53e0fd07aa5510f1f8bb29397200322c5c3deb2b13e6ee2ee3984299d648fded0c1128ad

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
164KB

MD5
37c8adea38f128542ce09782a235d6c1

SHA1
0271159bfbea0281eef95d7b28b9be237b2d464e

SHA256
2ba12184752fbc7426d9fcbc2d356faa82369fb3ff9ade044a542b57e67606ab

SHA512
ea2dd9def232a8c9895fc82471c000012374bbd5e9a4abdee9daef5a4cc115d5c64a39f13a897674b1d7424837493dcc0ca19e9b4acb466763f8ffb7e8039978

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
164KB

MD5
e3a2da19def73e8dfaebce07797a322d

SHA1
b11931b473ef9d7a17b99299b728bf5520e9862d

SHA256
442c09f495c4deb367b2d844684a9d08d88696bbd30af52706778340b124d51b

SHA512
ca35a933156b2d19d9fcd72952894e491aa90fad8e30d9401813c841d64ae8c1b3b063023cd22d0410d8bf65bf0fa724e4357018214b020828bdcaef22c416b3

Download Submit
C:\Windows\SysWOW64\Ncfdie32.exe

Filesize
164KB

MD5
2b996ae0ab78a22226d53acf0a661f4e

SHA1
c9689bfb347c3555f34c0ca28377964c486e9c6b

SHA256
e06c7cb28fb06289852ca3f7c0f1f5503e6c21b2ea1925f3e80e0bdd4b49f9a0

SHA512
bc53ea3bb2c455e73e0731c3828c55617a175f7a3fa8d4b0270766e077815e2841a7c88ee6a841a64bbc22bb9d0b7e445f1799d917373e83d0f78e467c0e97a0

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
164KB

MD5
31ee9aaf48405bc05c10db6bcebd9e72

SHA1
93d60617c40b41583e369e3cb21a8f91944bae83

SHA256
86f3c7c083f71cd6cefe3f4e5944f6dfd1db034a052e0214f186471b7a9eb79c

SHA512
17936c5c6106a845f8ea78feeece5dc5a13f87add1720058c3eded7366e6d70f1e10a55c0631107a11ba7172d4bb5d8e19d63a6657dd67d0c38ae2e1be26bcf0

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
164KB

MD5
5b4be477473baa9f82e8fb8d8d279ee5

SHA1
0f60079ecdb05fdbbd689f6c4a7acf9f378d147c

SHA256
b2ba37eca5e827e47666b7c34f868e14e2add341b7846e919835d4f53caaf5d9

SHA512
d1e982576302ffda69c51ea67927f424fe4fef26a08bff8cab5fee538eb993fa6dcc89883bcf100eb05af3c10d10eda5aca0b6646535ad2c2c6932d21d537da5

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
164KB

MD5
f386ac8b4366218fcea1e2b513b5d54d

SHA1
754fc2d5536601c8aed4dd5d77cf325ec2e163c8

SHA256
cc003f411714cb19b801b4c422ea27dad0b2be3a25a7671fb332f63cf255acda

SHA512
f42520bcf3ef8b9c16303932dc700141c72713c5d407bf52ef281d1204bf184d0a8c4845124480d4d64c625ea45dad7172bbf8770ad2b55ab96c28b54c2cbe7a

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
164KB

MD5
91020f6d4d4e0dd3914f13221ff44e10

SHA1
4f3a239f005c06df8e9ef660c53570636dc5d4ed

SHA256
0880a541c7a745180167ddd96596c00aa9a1e0161dc0cf1ac44d76b8e64647d8

SHA512
6fb311378bf554e22b722d53eafc5ecaef9e0c5e97ae677e7a373230f0cf8a764fafe4d99a25e2b727e2c9b1faddce5879601012b0e15b66921476b46be907d8

Download Submit
memory/232-47-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/400-55-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/436-452-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/468-550-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/596-314-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/628-104-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/692-538-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/824-524-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/848-119-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1036-374-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1216-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1216-610-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1324-291-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1376-580-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1496-279-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1516-624-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1516-16-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1520-338-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1568-276-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1692-287-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1864-277-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1888-482-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1892-167-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1904-144-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1964-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1964-617-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2056-380-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2104-532-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2148-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2180-64-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2276-488-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2280-302-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2300-578-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2480-464-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2540-32-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2616-292-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2664-151-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2780-180-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2904-459-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2976-586-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3048-332-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3052-350-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3104-446-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3144-404-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3192-592-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3232-562-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3252-288-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3296-519-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3340-159-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3360-518-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3456-392-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3508-95-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3536-470-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3540-188-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3580-286-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3652-398-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3664-308-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3724-476-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3792-326-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3924-111-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3928-344-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4008-204-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4032-494-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4072-278-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4104-128-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4132-556-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4268-356-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4276-598-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4352-428-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4360-368-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4400-285-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4408-422-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4420-40-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4432-500-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4436-506-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4472-611-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4484-604-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4544-526-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4552-568-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4652-289-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4692-24-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4776-362-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4780-416-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4820-440-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4824-71-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4832-434-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4880-618-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4896-320-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4972-280-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4996-87-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5008-275-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5036-135-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5060-410-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5080-544-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5096-195-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5100-386-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads