berbew | d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2025, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe
Size

465KB
MD5

0cd0390fd623f2743323ac907ef836d3
SHA1

3244dc83cb43ed423ffdc9a06fb7d34f3b5822a4
SHA256

d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3
SHA512

7bb67add467db8e967ed4c4515385dbf43220754a1ec6a10a3285097b8ba7a43f2b3123516e6ce59ad1fbab0d411247b060dba9f7bf521182d9eadb6ea24d661
SSDEEP

6144:/RfEwvFou3njPX9ZAkvntd4ljd3rKzwN8Jlljd3njPX9ZAk3fs:/xpljP9ZtVkjpKXjtjP9Zt0

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqdqof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opakbi32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1468	Kpeiioac.exe
4784	Kmijbcpl.exe
1448	Kpgfooop.exe
5052	Klngdpdd.exe
4640	Kfckahdj.exe
2036	Kplpjn32.exe
4700	Llcpoo32.exe
1304	Ldjhpl32.exe
4112	Lpqiemge.exe
4000	Lenamdem.exe
2056	Lmdina32.exe
1804	Llgjjnlj.exe
1672	Lbabgh32.exe
392	Lepncd32.exe
4384	Lmgfda32.exe
2256	Lpebpm32.exe
3332	Ldanqkki.exe
1740	Lgokmgjm.exe
5060	Lebkhc32.exe
2216	Lingibiq.exe
2852	Lmiciaaj.exe
2012	Lllcen32.exe
1360	Lphoelqn.exe
4520	Mbfkbhpa.exe
1104	Mgagbf32.exe
3772	Medgncoe.exe
4316	Mmlpoqpg.exe
1488	Mlopkm32.exe
3852	Mpjlklok.exe
664	Mdehlk32.exe
3416	Mchhggno.exe
4036	Megdccmb.exe
4604	Mibpda32.exe
2780	Mmnldp32.exe
428	Mplhql32.exe
3976	Mdhdajea.exe
2564	Mckemg32.exe
3108	Mgfqmfde.exe
468	Miemjaci.exe
3220	Mmpijp32.exe
2388	Mpoefk32.exe
4460	Mdjagjco.exe
220	Mgimcebb.exe
3040	Migjoaaf.exe
3324	Mmbfpp32.exe
1544	Mpablkhc.exe
4824	Mdmnlj32.exe
4572	Mgkjhe32.exe
788	Menjdbgj.exe
4688	Mnebeogl.exe
2824	Mlhbal32.exe
4660	Ndokbi32.exe
2400	Ncbknfed.exe
1428	Nepgjaeg.exe
3956	Nilcjp32.exe
4452	Nljofl32.exe
1048	Npfkgjdn.exe
1296	Ncdgcf32.exe
756	Nebdoa32.exe
1060	Njnpppkn.exe
2124	Nlmllkja.exe
5164	Nphhmj32.exe
5204	Ncfdie32.exe
5248	Neeqea32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Lemphdgj.dll	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File created	C:\Windows\SysWOW64\Gmdlbjng.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Maickled.dll	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Mgagbf32.exe	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Ohbkfake.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Lenamdem.exe	Lpqiemge.exe
File created	C:\Windows\SysWOW64\Qncbfk32.dll	Ldanqkki.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Miemjaci.exe	Mgfqmfde.exe
File created	C:\Windows\SysWOW64\Nljofl32.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Mbfkbhpa.exe	Lphoelqn.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Olmeci32.exe
File created	C:\Windows\SysWOW64\Aeniabfd.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Mnebeogl.exe	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Npjebj32.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Kmijbcpl.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Lpebpm32.exe	Lmgfda32.exe
File opened for modification	C:\Windows\SysWOW64\Lebkhc32.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Lphoelqn.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Npfkgjdn.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Ngdmod32.exe	Ncianepl.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Pnjknp32.dll	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Lpqiemge.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Hleecc32.dll	Mchhggno.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Nlaqpipg.dll	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qqijje32.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Clbcapmm.dll	Ojllan32.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Mdehlk32.exe	Mpjlklok.exe
File opened for modification	C:\Windows\SysWOW64\Nnneknob.exe	Njciko32.exe
File opened for modification	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File created	C:\Windows\SysWOW64\Mmcdaagm.dll	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6996	6676	WerFault.exe	284

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llcpoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldjhpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbknfed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjagjhnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmiciaaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onhhamgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncianepl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqfdnhfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbfkbhpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmpje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpgfooop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olcbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogpmjb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndhmhh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klngdpdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mibpda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nebdoa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nphhmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmoahijl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndokbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Menjdbgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepncd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lingibiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Migjoaaf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lenamdem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpebpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgehcmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llgjjnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lebkhc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgagbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcpbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofnckp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmlpoqpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpjlklok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nebdoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnjaqjfh.dll"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdgbkil.dll"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfgfh32.dll"	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmmmebhb.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbpbca32.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gokgpogl.dll"	Qdbiedpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eflgme32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjiol32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfkedibe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1468	3636	d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe	87
PID 3636 wrote to memory of 1468	3636	d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe	87
PID 3636 wrote to memory of 1468	3636	d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe	87
PID 1468 wrote to memory of 4784	1468	Kpeiioac.exe	88
PID 1468 wrote to memory of 4784	1468	Kpeiioac.exe	88
PID 1468 wrote to memory of 4784	1468	Kpeiioac.exe	88
PID 4784 wrote to memory of 1448	4784	Kmijbcpl.exe	89
PID 4784 wrote to memory of 1448	4784	Kmijbcpl.exe	89
PID 4784 wrote to memory of 1448	4784	Kmijbcpl.exe	89
PID 1448 wrote to memory of 5052	1448	Kpgfooop.exe	90
PID 1448 wrote to memory of 5052	1448	Kpgfooop.exe	90
PID 1448 wrote to memory of 5052	1448	Kpgfooop.exe	90
PID 5052 wrote to memory of 4640	5052	Klngdpdd.exe	91
PID 5052 wrote to memory of 4640	5052	Klngdpdd.exe	91
PID 5052 wrote to memory of 4640	5052	Klngdpdd.exe	91
PID 4640 wrote to memory of 2036	4640	Kfckahdj.exe	92
PID 4640 wrote to memory of 2036	4640	Kfckahdj.exe	92
PID 4640 wrote to memory of 2036	4640	Kfckahdj.exe	92
PID 2036 wrote to memory of 4700	2036	Kplpjn32.exe	93
PID 2036 wrote to memory of 4700	2036	Kplpjn32.exe	93
PID 2036 wrote to memory of 4700	2036	Kplpjn32.exe	93
PID 4700 wrote to memory of 1304	4700	Llcpoo32.exe	95
PID 4700 wrote to memory of 1304	4700	Llcpoo32.exe	95
PID 4700 wrote to memory of 1304	4700	Llcpoo32.exe	95
PID 1304 wrote to memory of 4112	1304	Ldjhpl32.exe	96
PID 1304 wrote to memory of 4112	1304	Ldjhpl32.exe	96
PID 1304 wrote to memory of 4112	1304	Ldjhpl32.exe	96
PID 4112 wrote to memory of 4000	4112	Lpqiemge.exe	98
PID 4112 wrote to memory of 4000	4112	Lpqiemge.exe	98
PID 4112 wrote to memory of 4000	4112	Lpqiemge.exe	98
PID 4000 wrote to memory of 2056	4000	Lenamdem.exe	99
PID 4000 wrote to memory of 2056	4000	Lenamdem.exe	99
PID 4000 wrote to memory of 2056	4000	Lenamdem.exe	99
PID 2056 wrote to memory of 1804	2056	Lmdina32.exe	100
PID 2056 wrote to memory of 1804	2056	Lmdina32.exe	100
PID 2056 wrote to memory of 1804	2056	Lmdina32.exe	100
PID 1804 wrote to memory of 1672	1804	Llgjjnlj.exe	101
PID 1804 wrote to memory of 1672	1804	Llgjjnlj.exe	101
PID 1804 wrote to memory of 1672	1804	Llgjjnlj.exe	101
PID 1672 wrote to memory of 392	1672	Lbabgh32.exe	103
PID 1672 wrote to memory of 392	1672	Lbabgh32.exe	103
PID 1672 wrote to memory of 392	1672	Lbabgh32.exe	103
PID 392 wrote to memory of 4384	392	Lepncd32.exe	104
PID 392 wrote to memory of 4384	392	Lepncd32.exe	104
PID 392 wrote to memory of 4384	392	Lepncd32.exe	104
PID 4384 wrote to memory of 2256	4384	Lmgfda32.exe	105
PID 4384 wrote to memory of 2256	4384	Lmgfda32.exe	105
PID 4384 wrote to memory of 2256	4384	Lmgfda32.exe	105
PID 2256 wrote to memory of 3332	2256	Lpebpm32.exe	106
PID 2256 wrote to memory of 3332	2256	Lpebpm32.exe	106
PID 2256 wrote to memory of 3332	2256	Lpebpm32.exe	106
PID 3332 wrote to memory of 1740	3332	Ldanqkki.exe	107
PID 3332 wrote to memory of 1740	3332	Ldanqkki.exe	107
PID 3332 wrote to memory of 1740	3332	Ldanqkki.exe	107
PID 1740 wrote to memory of 5060	1740	Lgokmgjm.exe	108
PID 1740 wrote to memory of 5060	1740	Lgokmgjm.exe	108
PID 1740 wrote to memory of 5060	1740	Lgokmgjm.exe	108
PID 5060 wrote to memory of 2216	5060	Lebkhc32.exe	109
PID 5060 wrote to memory of 2216	5060	Lebkhc32.exe	109
PID 5060 wrote to memory of 2216	5060	Lebkhc32.exe	109
PID 2216 wrote to memory of 2852	2216	Lingibiq.exe	110
PID 2216 wrote to memory of 2852	2216	Lingibiq.exe	110
PID 2216 wrote to memory of 2852	2216	Lingibiq.exe	110
PID 2852 wrote to memory of 2012	2852	Lmiciaaj.exe	111

C:\Users\Admin\AppData\Local\Temp\d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe
"C:\Users\Admin\AppData\Local\Temp\d46ffd3ea4963b654fd301d71c28b34260399430124a48b3621f78b810a13bb3.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\Kpeiioac.exe
  C:\Windows\system32\Kpeiioac.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\Kmijbcpl.exe
    C:\Windows\system32\Kmijbcpl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\SysWOW64\Kpgfooop.exe
      C:\Windows\system32\Kpgfooop.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1448
    - - C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5052
      - C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1488
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3852
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        31⤵
        Executes dropped EXE
        
        PID:664
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4036
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:428
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        38⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        40⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        42⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        43⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        44⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3040
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1544
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        48⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:788
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1428
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        62⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5204
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        66⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        68⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        70⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        72⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        73⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        75⤵
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        76⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        77⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        79⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        80⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        81⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        84⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        87⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        88⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        89⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1908
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        91⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        92⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3428
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        95⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        97⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        100⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        101⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        102⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1064
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        103⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        104⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        106⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:516
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        113⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        115⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        117⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2016
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4808
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        123⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        124⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        125⤵
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        130⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        132⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        133⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        134⤵
        Drops file in System32 directory
        
        PID:3284
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        135⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        136⤵
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        137⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        139⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3508
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        141⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        142⤵
        Modifies registry class
        
        PID:1372
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3348
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        146⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        147⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        152⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        153⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        154⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        155⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        156⤵
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        157⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        160⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        161⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        163⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        164⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        165⤵
        System Location Discovery: System Language Discovery
        
        PID:7120
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        166⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        167⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        168⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        169⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        170⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        173⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6688
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        176⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        178⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        179⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        181⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        182⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        183⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        185⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        186⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        187⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        188⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        189⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        191⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        192⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        193⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        194⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 396
        195⤵
        Program crash
        
        PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6676 -ip 6676
1⤵
PID:6828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Balpgb32.exe

Filesize
465KB

MD5
cc352165297671484d0af6df1df63d45

SHA1
41d73d60f974fa09de3fc02634aaab3410178db9

SHA256
daa16ab494222ac0fac97a0d4e2c9f8b5bb4dccc48674a8eab409f2513463c24

SHA512
f944f8d9d2a9af4aa3ab6e26d061d395dee9198d14c51a8c8b9b8a62843811b1f8575d37d7fa63ff71403fc27f9c71f6f8c6a48bcd034af43970cbc80c0d98a2

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
64KB

MD5
ee110a139bd172d63e2b8f70caa751a8

SHA1
e80a94c413abff53876d4f00a0c24d8b5030ac49

SHA256
85f69919d8e37bf0d64ffd1f79730a3e8d55ad68695f935d9409cf3b938d1016

SHA512
b851157f6a4ccb477eb12fcbf3fca8e73cfd79d8aab142d5ce111683e99e6e7122d7472021ec1fce63cd47078ace427a07f68a8a1399c5eaef0c0668d380c2fe

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
465KB

MD5
9ef4bfd0135ca3369d5d4d29656a021b

SHA1
e931ae6c52431777429453cd41958ce376021249

SHA256
93263cbdfbe412b0a3da61a6f9dcf19c12a56b54400da4edc098596f9e20d7ed

SHA512
2b2e9df6e254d3bdf6fbe6205d40d89141871214f1d735cf5899356e619c2df8e38ca446bb0200ae2a65ec8805ded50e7e6e40492a06376b209787dac6e94e23

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
465KB

MD5
df5646b6afbc125c2a0d61148b9bffef

SHA1
60dc5658e0ab9e1eee08446ed41b4a76c717dd9f

SHA256
09df48d93cb63ac6d55d792665454db3db8046836f53eaa720d3ea6dafd12ef9

SHA512
8c1c83faf79a43b802835dd2167185887e3f3baee0cde19a3ca51711f6b23b13444c7eff80efc09c63ec7b5f3fb5930eda59c0c22ec3185fc239460639e9e67b

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
465KB

MD5
f53db15d4698405da9b7963bcea489e1

SHA1
79b01171e16544a3dbf070ccd2c4dc00bfb178f0

SHA256
eb58bf4f396764470ac2e5237a8fa932c326bcfb1cdb1f519173a50370086611

SHA512
b7fc2aeb2950c0e3e4ebc8fb0c43c81d9e4e45f48d74a4259365d46f7f680e6fc12e0a6f7c62b76737322ddaa35ef8ce17d1de43a772d234e14e707a6f123b16

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
465KB

MD5
0e98a74ff2c1494e9375179a95ee9057

SHA1
6f2e06fa4c47bd7b1a9e1cfbaf7eb401605f85a7

SHA256
0731a405c4af2e3ccdd73cdc37fb5e11d6587521e65fdf20aea4d34549d3da28

SHA512
258093f005ae3955bb784d58ef673e02d2c9499d5e8713f5cf6f769190aa22f42a8922a7dcc5a5bcd951298534f0e8f626ed780f9e6867460bdcaa2cce90fa66

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
465KB

MD5
c94bb52a078b5d6c24299410152582e1

SHA1
0be3eb0559fde28e495e828f53f5b4fc5c726287

SHA256
3db0ffbf4f3972b288a8b0b04f408fd6c1ae46d1693491e799c6c5c86f97a8fc

SHA512
b940ac99a360f30dede5604b1947c28ba69b5de3c9d4ebe92b8032dbee30e0d35ec979a2941b3c105ec20dc9b61bb3685dbe0d715d9a71d2039ebf52e8e2308e

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
465KB

MD5
27343cb4b41a3a451342f599ff00ef60

SHA1
0449e71c2c34b47223d90d5277a678aa2b6fcad1

SHA256
1adef0fb2eb0312350bf76da9073ef4310a6ffc073e33ad6dc448887fca8d8f5

SHA512
31b85058ecade77eba6a3b0003392bf7257da368aaf96bea29525f2c1c1e956a450576ee22e11f3936f15456a633cc72196359b13fded30d1389c50c5bbef46b

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
465KB

MD5
d948310a6e76d11cd911dda92ec76359

SHA1
6910810c34d58bf720609db6909643fd75163dfb

SHA256
9b6bc094dabb33ce735f12f34489abc34df6a10a009f06dbd7da206e23f10452

SHA512
0573b247ea2936420dd97ad6c2f18125330728de7f5cbe1ee3ff1a69eaf396aade1e5c032913073e8ad61e7d0dfec1c576586134c2142417a6168409654c16ba

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
465KB

MD5
fc6736cbc6e990c3a2f972abab0dcd24

SHA1
8458e628cdf34f3a56a4f5052b196ced96711f40

SHA256
a2a195b15357812ed781a0a22637915a300ed20e6a0be9bfe3de0bc8efd97a4f

SHA512
92642c820b2780946cc1844479baaa958044073ee255d5ee807907bd5a0e6512fa3dd471adad6b4e65758672cb79aa46c64598801a5f887a0e9109b32ef416b1

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
465KB

MD5
9b0e61e8ef51e2fe85068c996a3c355c

SHA1
433b2069b58306da40d2e8c341400a7fadac9878

SHA256
5b67ee08a802695f2960bc4c8ab250e749f5f4e31987d59f61f3973a4bbfe0ed

SHA512
101592e82e91bd6133acb545607f3d33a57e0686cdf310681886dda446a9409d63f6848bd392fb55faf3d8685eefb03aafe3581f0e5034e865db3a7ce02c21d4

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
465KB

MD5
095bce875fdb90a454261fafd53b0744

SHA1
7c6650e6d894c81fb0203809746ac4756fa24d6a

SHA256
887a168acf44d114a93685e54b537748fd4a970ceb3ec14e9cc171939618ff0f

SHA512
49b89e762f589a6b483102c0179c364c32b7c7e0fb0bd624166acd3f4ea16d804786ac7a66da0f1b6eefc8a6f724cf19ef242361638f859dcc3d0be8d759b5e7

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
465KB

MD5
18cd446de1394ac391d24442606428b3

SHA1
12270a1baf1bf403ef91d8af71d1beb6c96c7792

SHA256
ed6716b1ec2750bba9296fd6e932005667f451902f4e8908351138a8474d3a4a

SHA512
4b38c5254ba797c5245959779f162ffa2e2edcdef7b64958b04425a7ebe4e49ea6cb946975fcb7d74559a78ab1ed62c9965311850c90999edd559c7619d6aaed

Download Submit
C:\Windows\SysWOW64\Lebkhc32.exe

Filesize
465KB

MD5
52b037d5b42b6d423bcf65f4fdda0d38

SHA1
9518ac8f1346120221f6d8777a1546456bd67a68

SHA256
5a7cf485da9d06dd5b0f1927f559ee166b790126c7fb0265f193a46d53c0ccf5

SHA512
2c64c57549c3600794171f42491ae4f6cd002e150f3e00fcb75f9ebb3d8af5234923dedb9ec5f6d30fe46da46261b435d591c4a09294ea91690a6add0253d5f8

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
465KB

MD5
1b4da4abaafad0bec068139e0cdb9e2c

SHA1
240dbb45fdc9461aefb7a4e9d9ee604f4d2c4b39

SHA256
44dcec9ccaaab6e79584abdd5e53b41348837f2380e8e3411f76b1582b996601

SHA512
8edb3497cdac9e523a3f5680c268a3168e4acbb4152d8b095c887baac89ee7e57eb58723efad393c184568fe4bb39499514f78761b1cac5d6f25fee93e9a81d4

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
465KB

MD5
a80c355ab575d5d781dc6af72c0f29d2

SHA1
46ec6f2efc51754965a31e6532d33c2f77706253

SHA256
135166b2883eedb4709faaf03efb68ccda289fff690de81094aa8c67f5c90ad9

SHA512
408a432565e5eb335b9ba3083eaac25ce14ae65aeaa35a5ab7f4bb5d2735c932dcbc499848846394521e41beba8a993d0d4630937a11cb044ffe8c2f57801d97

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
465KB

MD5
ae0cf984c8f1996f1925ad8982af1c75

SHA1
f61166acb43a2f30d001c5a7f7d7c9869e752612

SHA256
dac62c13cf96b312f70beeee457f5044cebdda4a8fcc8ce582799bdd3509b655

SHA512
1bb17111755f78fba72929a96a435f9118e66fa98898771287ab2eaa4e8877aaad7dd2f5815cff9827656d77b4de15f3fb1551996a9857bb428655079eb3fe44

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
465KB

MD5
9c07b9c767abfe547d3fd09925fc70e7

SHA1
14575f2fd261c4fcceb0d6a9277995f6cd48a05d

SHA256
aa7a51098bf7c38fc72381c33fa7d4559d412afa2201b9821d8716b24145a1aa

SHA512
c5bdd96a50e16b20b8fc7e0b284c82684d86a69a0afae914eb26548663e26796201ad163808fb7b55be43e5e5f2bdd02fb05bf018f1ec460e1013c7e0773fb59

Download Submit
C:\Windows\SysWOW64\Llcpoo32.exe

Filesize
465KB

MD5
9b5d6e2d762e18d6b3d3640a81230c3c

SHA1
5a0b1aad5c41e7967961470bde1d8f2804784bff

SHA256
b8cda55542abc4758c267b63232fe7a35f39c98f0b2c6c302e7c283ef251fea5

SHA512
8db4b6b01489bd877d8417ec81926a3415dcad1194e15f6aebb3dfdf67fbc71ed11aa07443ac5a0ae2a76ab6f4db05b3beb56f75dd4e3e636173548d101ef42c

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
465KB

MD5
5ed653e8533d6b69cab2d47b73e9b2c7

SHA1
c691930364779ac9242ce1561d5810507c6942d3

SHA256
8d869948b48efe685d454af029b29e32afc38ab44cf35dbb61f3df8d1702bd96

SHA512
0552032765d11575a00d49ce07bbf85842047776640e06a1f96e7b97ced94eac9e939bd0540c5ad80210b169768e7c84daee3db97e2453ba83b81b81fd32a8ac

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
465KB

MD5
9ff33a8fcba766e364286b7b2ed0b7f4

SHA1
37cdc4a1e72d22ba4e0b0f102c0672b102e8a033

SHA256
14a8ba9eb2abb4049150ebe80517aa636bffd507767384a5292551a456494594

SHA512
ffc94934b3957b977d7faabb931a47d39545137daa863dfb6f03e9ce2edfb2573fb06f878db4985b37c211543fcd4cfc750066042b69b4bee2356a4a5ce084c1

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
465KB

MD5
b7842a13d78c979e7847c66ce7c83cfe

SHA1
58ecda0d1cd72af5d686fd4c3d610cea2b1e161a

SHA256
da0003c8df7fbf11c7104757cbee5de9135bfd5c2155606df3c027fbca2674ae

SHA512
47a10003da3d0c90d575c2efa48f7dbca670a634746da02939dabfc6247d715362d948009700f6f2dc3369a519ce6d5a0e0c8ae7ba8e9353562d48c0ddfc671b

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
465KB

MD5
b1208c948f1d90fe1cb46b69a3eb3605

SHA1
c0204e346657f2d7ff8f940f535307c775c45600

SHA256
e73257369fdc5a2a7a4bcb6e9dadde0f4d260de835d127ec405c6e0a078bb082

SHA512
d8ac35c45a332a8c015d6ac8e859f789b1d62c0b594f6b83d2c43c630ec6ba8cc0dc100c3e50d683c58f6ae387411b1ecc3d1d3d912aff7fec64f0698e4afc59

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
465KB

MD5
a15150de788635230772292f77d1d3f2

SHA1
da7b10a156b1b267f7329bfd9b04a974131b1e9e

SHA256
f5bbe66e2d06ff80d98cf24d8d3bcfaee13e9a144863592c940f272f0d7357ab

SHA512
527507e9df82608ec8ae4634ce67f02f52cc32edeca713221b2e12559e7a9e7e4aec598926f40d65fb7b32e7e24f3a7940295f91bb495045f27da69047c2557d

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
465KB

MD5
767edb70d42f7ae2b13d3f8091e64b74

SHA1
e0baf9dfd6df28278cbb4529a60b9d59035249fa

SHA256
01b7c39a891973d29cc3c176d8a6ec33a6a62b3201cc56fab577aa1bdda45a10

SHA512
0d5fa3b30e59c6e140fa0ef0edfa55a0f22682a1c56b677258cfc6aa2d7b3ec8ccbc090df6bf58264540c1cac1b4a46f1bf3a013efc329c892ff48bf7162c982

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
465KB

MD5
959661c7228947c666aef496038865c7

SHA1
af869416da78d90aa8c2d56e39292e1f73550255

SHA256
8b2e740a929deb0e07aa47d60669c5288c5a4aa8f9a7ba82810f44b211d8b2d2

SHA512
257c146c8d0b5af56a922024e5d9d5499c2e4246f617b0cf39ec23915e455d96a9a5549cdd5c8c334ebb31480abe20772593c94eb16329d8b3daaf6c4167082e

Download Submit
C:\Windows\SysWOW64\Lpqiemge.exe

Filesize
465KB

MD5
a8124f0ae1e61ddcaa3573a7a1759501

SHA1
cd7ca7d312026d6d35f3a05586354b71888ee570

SHA256
5401cf5f8e2c3e54b0be7a87679ee5ef3121766ad12f8192477d8252a17fd336

SHA512
eb570e9c6631f8bd622172474a97b40fc0b3efbce2bc2ba9e5998d5c9bd0844b0ec95fd173d76f1bbea47739a5b5b170de07a94d80eaad1eb17506de3b23ddba

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
465KB

MD5
788a295bf212babaa1a74b9d9390ef69

SHA1
73771ce7fffb2c00f0d11843765af0c9bda04cae

SHA256
19fda8a5c6eb3f2efd288e6f861b67a63cea9f55c5ed2e5677dd767c49ad20db

SHA512
8d2b2041d075ef11df7ad1a9230c8ff41fc8e93b6d4931153a749312c9b3870777a1eb75cdc2dc4dee8988f98d649fb0d9096030e9cba50d7942ed8784de08c7

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
465KB

MD5
55673918070a3e42ddbe3ab0425857b2

SHA1
0f3ae7482d7f3202443a2bbeb4970690fc490c40

SHA256
15bd18313e35bc8fce6310be4a5271790ab3447e4036ce6ff8c3b02297952d75

SHA512
352babcf952021c1f1f371702bf0e7ac78c7955413d839d9aec652974a23f5ae4234f29abd31b1e7f2a93e0a7fcd1eb8a4627ee1312c3c0464a987bf7eb7ece7

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
465KB

MD5
4490e7eecbb38a64137bb28eba05adb6

SHA1
1ec22cab36a58fcf7e043ed9f096075e54f03d6c

SHA256
b4dea3fe0ffd7adaa43cc1e348e2d16f711eabb48c9430deab90c092e6f6a23c

SHA512
c2f155d66a75e749e953ff98eb63a06211261ef1727551c3421e22157531b1653103197fa0954bacf02c9a547a422ba662c4d108b83d1734de916ec94635b734

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
465KB

MD5
84a750b65604aa0b51dec8c8f7f03539

SHA1
43396986451f8b6597ef4ef4cb8d13084d2e94e3

SHA256
dc56455f7d132dcbf8f5d8297c3696e1ae8410b6f22193196fc3df3a42198e80

SHA512
a8390289c918865e7dd7851f799855268d7a241c4a896aff801b054cd0657da0f6c4403c6a6dd9e7a0d04f7f12a4ae268ce9f22d9b15aba657b6f36b277776e0

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
465KB

MD5
9cb1806fb615bd30126c5e81eb0d5e16

SHA1
598432b37571d50874c7860fc87981703a3be502

SHA256
7bda0f33ec09c67d42d069937e77c03aa196bb85f0a67c79b4be519e467c9a66

SHA512
6d82feb7f95f5c0e51f347ce8208c72f1513998349fc608cb2a6b010b865f2bb317f0a655b83f839349c47a8c106bc926f665eb26289dd4d193e93b4ca1c4a2b

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
465KB

MD5
5fe6829eda141a0b1211535937d772ed

SHA1
848fea75a3e648643476d59fba10a70177c28290

SHA256
99b88514df99848e704492c24b6f25f688c3b82996c88b7234ed2795d452868e

SHA512
362d045a011404150a7ea4450e8f60460e15950e19540a2fa275b456541bb926e263013b3dca90e5b511cf1f7072edc95b19d7651056291701a6a513cd62b921

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
465KB

MD5
0cbe2e40d440705953487c4a1f40dbbc

SHA1
ea9fee93dbb1e85c617bc007703e0e0f5a9f6978

SHA256
15cf5c5efef68a923b447234543ce32f0513aa6b172481f5d5edd17c1fbe2933

SHA512
7a6d471589bbf4168d05fa0ec41752c25ddded3286e4a00a6893610766d1afa09cd45a941341a529efcaacdf3810598b1240529c37dfc721cbef928b30d8aac1

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
465KB

MD5
6690fcd3110e0fc5854ecb089b2bc1c6

SHA1
d2c3cd2bdf15a61af562f43f244df67c542428b5

SHA256
4c582c9be15c132ee68b31b3d0a54f1853dba09a8ff92c4475a5692929dd03f1

SHA512
3bcfd5eba7594ab538949c0b33178748a15a76e9c1ec0fa9f0e3efc9adda9001e4e6891c547b66f019b80e2faebc3d8143e145da5975d1f16f08ac9de5683482

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
465KB

MD5
63c6a4bed8a584961ac872c3af531226

SHA1
274120f072c9d355dac144ed5fcfa31e4e304963

SHA256
037df78ce1ac5661f824fc2532f81b5a96c0208cd7ac88d74be3df910beaa67f

SHA512
a4a4354c5a58f5c9788fcf8e29d48a5d74a3cbc146b7ea31c4b8e6e4b78bee84ee37008e6d0fc6db8265716c2ec9339fb994d8b2a2bf6dd63c49c80feae35d6c

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
465KB

MD5
e2ca881b2c90fb8d0b004cd555061abd

SHA1
8b29346644a00ad2b1dae54f75f714a80302a959

SHA256
408836ea67a02b34a0d187f04b0ed1bd54c945b70a46fc94e2d97329e11be3a5

SHA512
6995d8bf99a01cf723fe4b83ce51657f4a6c8230bdd71ff1852ef86f7fd2849d02168e3e3c1819f02f9f09fca7d9d70280d2b45592a9054245a8a535e4200497

Download Submit
memory/220-324-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/392-124-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/392-626-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/468-300-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/664-245-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/756-417-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/788-359-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1048-406-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1104-205-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1304-588-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1304-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1360-672-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1360-189-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1428-388-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1448-1640-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1448-556-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1448-25-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1468-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1468-544-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1488-229-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1544-341-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1632-1408-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1672-1621-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1672-615-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1672-123-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1740-645-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1740-149-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1804-1623-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1804-614-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1804-97-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1908-1468-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1908-589-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2012-181-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2012-670-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2036-48-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2036-576-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2056-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2056-608-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2060-602-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2124-428-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2216-165-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2216-657-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2256-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2256-633-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2388-312-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-1573-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2564-289-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2824-371-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2852-664-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2852-173-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3220-306-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3324-335-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3332-639-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3332-141-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3416-253-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3636-528-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3636-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3636-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3772-213-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3852-237-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3956-394-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3976-283-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4000-601-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4000-80-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4036-261-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4112-595-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4112-72-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4316-221-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4384-627-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4384-125-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4452-400-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4460-318-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4520-197-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4520-1599-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4520-678-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4572-1550-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4572-353-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4604-267-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4640-569-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4640-40-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4660-377-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4688-365-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4700-582-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4700-61-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4784-550-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4784-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4824-347-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5052-562-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5052-33-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5060-157-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5060-651-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5148-1394-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5164-434-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5204-440-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5320-456-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5360-462-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5468-1407-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5536-658-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5544-488-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5580-494-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5620-500-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5656-1375-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5668-506-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5764-679-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5776-522-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6036-1383-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6052-563-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6052-1477-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6060-1430-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6088-570-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6140-1414-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6332-1346-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6372-1345-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6508-1338-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6552-1337-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6860-1292-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/7120-1319-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads