berbew | 4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11

Analysis

max time kernel
93s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe
Size

87KB
MD5

2c5b6ef70b1338f936d18c73ded35de3
SHA1

f04bbb3ace14f618596326890ed291ed8984ed8a
SHA256

4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11
SHA512

633ea32be68bc88b707d154710708b9a6051d59a8418827b3e80b5e0fcc871ca695cbaad9a700e5fbb6f907258e9d41d1d04fc9ae54ebafdee8f64b65c6b21b3
SSDEEP

1536:aB+XR1bP7wqCgIF2nKxkLKdai8H6cNfdTkKSd7olYRQ4jRSRBDNrR0RVe7R6R8R8:aB6ch0nKxkLKo0BeKAnDlmbGcGFDex

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbiockdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcapicdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddifgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebdlangb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkdpbpih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecjke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hbldphde.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnakk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckjknfnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkphhgfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpmapodj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dakikoom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gkaclqkk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehmmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chkobkod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Momcpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgpcliao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbbajjlp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaebef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jhgiim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfenglqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpaihooo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejqldci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipgkjlmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njljch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pcegclgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eqgmmk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeocna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legben32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loofnccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pbekii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgeenfog.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4140	Akdilipp.exe
2276	Aopemh32.exe
1812	Bhhiemoj.exe
3004	Bkgeainn.exe
2128	Bobabg32.exe
3488	Bmeandma.exe
1764	Bpdnjple.exe
5084	Bdojjo32.exe
4776	Bhkfkmmg.exe
4272	Bkibgh32.exe
2040	Boenhgdd.exe
776	Bmhocd32.exe
1080	Bacjdbch.exe
5024	Bdagpnbk.exe
5016	Bhmbqm32.exe
3504	Bgpcliao.exe
4116	Bklomh32.exe
3068	Bogkmgba.exe
2928	Bmjkic32.exe
3856	Baegibae.exe
3908	Bphgeo32.exe
2932	Bddcenpi.exe
1272	Bgbpaipl.exe
2324	Bknlbhhe.exe
3080	Boihcf32.exe
4064	Bnlhncgi.exe
2920	Bahdob32.exe
4284	Bpkdjofm.exe
4492	Bdfpkm32.exe
1604	Bhblllfo.exe
4972	Bkphhgfc.exe
2860	Boldhf32.exe
4404	Bnoddcef.exe
4376	Bajqda32.exe
3860	Cpmapodj.exe
3376	Cdimqm32.exe
3116	Chdialdl.exe
4560	Ckbemgcp.exe
372	Conanfli.exe
3340	Cnaaib32.exe
2268	Cammjakm.exe
3692	Cdkifmjq.exe
632	Chfegk32.exe
4664	Ckebcg32.exe
3160	Coqncejg.exe
3208	Caojpaij.exe
232	Chiblk32.exe
1468	Cglbhhga.exe
4304	Cocjiehd.exe
2756	Cnfkdb32.exe
3032	Cpdgqmnb.exe
3628	Cdpcal32.exe
3732	Chkobkod.exe
4296	Ckjknfnh.exe
4748	Coegoe32.exe
5032	Cnhgjaml.exe
4728	Cpfcfmlp.exe
768	Cdbpgl32.exe
1792	Chnlgjlb.exe
3460	Cgqlcg32.exe
3648	Cogddd32.exe
1752	Cnjdpaki.exe
1200	Dpiplm32.exe
1924	Dddllkbf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Eojiqb32.exe	Egcaod32.exe
File created	C:\Windows\SysWOW64\Iamamcop.exe	Ipkdek32.exe
File opened for modification	C:\Windows\SysWOW64\Nhegig32.exe	Nfgklkoc.exe
File opened for modification	C:\Windows\SysWOW64\Fnkfmm32.exe	Fkmjaa32.exe
File opened for modification	C:\Windows\SysWOW64\Nqcejcha.exe	Nmhijd32.exe
File created	C:\Windows\SysWOW64\Bdojjo32.exe	Bpdnjple.exe
File opened for modification	C:\Windows\SysWOW64\Eojiqb32.exe	Egcaod32.exe
File created	C:\Windows\SysWOW64\Nkphhg32.dll	Gijmad32.exe
File created	C:\Windows\SysWOW64\Ekjali32.dll	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bknlbhhe.exe
File opened for modification	C:\Windows\SysWOW64\Fkhpfbce.exe	Egened32.exe
File opened for modification	C:\Windows\SysWOW64\Lplfcf32.exe	Lhenai32.exe
File created	C:\Windows\SysWOW64\Lfiokmkc.exe	Lancko32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Oiccje32.exe
File opened for modification	C:\Windows\SysWOW64\Gegkpf32.exe	Gbiockdj.exe
File created	C:\Windows\SysWOW64\Nmcpoedn.exe	Njedbjej.exe
File opened for modification	C:\Windows\SysWOW64\Edbiniff.exe	Eqgmmk32.exe
File created	C:\Windows\SysWOW64\Fdflknog.dll	Mhjhmhhd.exe
File created	C:\Windows\SysWOW64\Mmihfl32.dll	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Kjmejc32.dll	Doagjc32.exe
File created	C:\Windows\SysWOW64\Qglobbdg.dll	Iamamcop.exe
File opened for modification	C:\Windows\SysWOW64\Lllagh32.exe	Lindkm32.exe
File created	C:\Windows\SysWOW64\Nfgklkoc.exe	Nblolm32.exe
File created	C:\Windows\SysWOW64\Lqppgj32.dll	Bmhocd32.exe
File opened for modification	C:\Windows\SysWOW64\Bahdob32.exe	Bnlhncgi.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dpkmal32.exe
File created	C:\Windows\SysWOW64\Cepjip32.dll	Dgeenfog.exe
File created	C:\Windows\SysWOW64\Akcjcnpe.dll	Eqlfhjig.exe
File created	C:\Windows\SysWOW64\Fkmjaa32.exe	Finnef32.exe
File opened for modification	C:\Windows\SysWOW64\Jocnlg32.exe	Jifecp32.exe
File opened for modification	C:\Windows\SysWOW64\Pimfpc32.exe	Pjjfdfbb.exe
File opened for modification	C:\Windows\SysWOW64\Pblajhje.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Nphnbpql.dll	Kpqggh32.exe
File created	C:\Windows\SysWOW64\Nbnlaldg.exe	Nckkfp32.exe
File opened for modification	C:\Windows\SysWOW64\Cnaaib32.exe	Conanfli.exe
File opened for modification	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Dkndie32.exe
File created	C:\Windows\SysWOW64\Dnonkq32.exe	Dolmodpi.exe
File created	C:\Windows\SysWOW64\Gijmad32.exe	Gacepg32.exe
File created	C:\Windows\SysWOW64\Mbibfm32.exe	Mokfja32.exe
File opened for modification	C:\Windows\SysWOW64\Enkmfolf.exe	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Plgdqf32.dll	Fofilp32.exe
File created	C:\Windows\SysWOW64\Kefiopki.exe	Kakmna32.exe
File created	C:\Windows\SysWOW64\Lpgmhg32.exe	Lllagh32.exe
File opened for modification	C:\Windows\SysWOW64\Lhenai32.exe	Legben32.exe
File opened for modification	C:\Windows\SysWOW64\Boenhgdd.exe	Bkibgh32.exe
File opened for modification	C:\Windows\SysWOW64\Egcaod32.exe	Ehpadhll.exe
File opened for modification	C:\Windows\SysWOW64\Ghojbq32.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Hemmac32.exe	Hbnaeh32.exe
File created	C:\Windows\SysWOW64\Gcmjja32.dll	Jifecp32.exe
File created	C:\Windows\SysWOW64\Kebkgjkg.dll	Nqcejcha.exe
File created	C:\Windows\SysWOW64\Ojgljk32.dll	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Nffaen32.dll	Pbekii32.exe
File created	C:\Windows\SysWOW64\Egaejeej.exe	Edbiniff.exe
File created	C:\Windows\SysWOW64\Ecipcemb.dll	Fgcjfbed.exe
File created	C:\Windows\SysWOW64\Fgcodk32.dll	Klekfinp.exe
File created	C:\Windows\SysWOW64\Fefmmcgh.dll	Ofegni32.exe
File created	C:\Windows\SysWOW64\Mlmadjhb.dll	Pidlqb32.exe
File created	C:\Windows\SysWOW64\Lfgnho32.dll	Pblajhje.exe
File created	C:\Windows\SysWOW64\Giecfejd.exe	Gejhef32.exe
File created	C:\Windows\SysWOW64\Ibgdlg32.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Ocdnln32.exe	Nqfbpb32.exe
File created	C:\Windows\SysWOW64\Omdieb32.exe	Ojemig32.exe
File created	C:\Windows\SysWOW64\Nnkoiaif.dll	Obgohklm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10220	10132	WerFault.exe	440

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfccogfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bahdob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpdgqmnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fofilp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njedbjej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofegni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkmjaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaqhjggp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaebef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mokfja32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bajqda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Enmjlojd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqeioiam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gijmad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmhocd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqgmmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fqgedh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loacdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhjhmhhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfbaalbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhckcgpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dakikoom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipkdek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llcghg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiqjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jhgiim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jifecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkibgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdimqm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gkdpbpih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iefphb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcclncbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookoaokf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppdbgncl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdagpnbk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edplhjhi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehpadhll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hpfbcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibegfglj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieccbbkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joekag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lohqnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nimmifgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jahqiaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dglkoeio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebdlangb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdojjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ebifmm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbebbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bklomh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hnlodjpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhkfkmmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfhmgagf.dll"	Eqgmmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npdhdlin.dll"	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjnlmph.dll"	Cnjdpaki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Enhpao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcdihk32.dll"	Egened32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojqhdcii.dll"	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oiagde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oblknjim.dll"	Cgqlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eohmkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppadalgj.dll"	Kplmliko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mablfnne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lebijnak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpikki32.dll"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Likhem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojemig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekellcop.dll"	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hnlodjpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gaebef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fiqjke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Geldkfpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkiongah.dll"	Fqeioiam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gkdpbpih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegcnaoo.dll"	Egcaod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjggal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Caecnh32.dll"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkmjaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jocnlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnoddcef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ekjded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Piocecgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plikcm32.dll"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkamodje.dll"	Bmjkic32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pjjfdfbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eklajcmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nblolm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ockdmmoj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4140	2056	4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe	84
PID 2056 wrote to memory of 4140	2056	4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe	84
PID 2056 wrote to memory of 4140	2056	4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe	84
PID 4140 wrote to memory of 2276	4140	Akdilipp.exe	85
PID 4140 wrote to memory of 2276	4140	Akdilipp.exe	85
PID 4140 wrote to memory of 2276	4140	Akdilipp.exe	85
PID 2276 wrote to memory of 1812	2276	Aopemh32.exe	86
PID 2276 wrote to memory of 1812	2276	Aopemh32.exe	86
PID 2276 wrote to memory of 1812	2276	Aopemh32.exe	86
PID 1812 wrote to memory of 3004	1812	Bhhiemoj.exe	87
PID 1812 wrote to memory of 3004	1812	Bhhiemoj.exe	87
PID 1812 wrote to memory of 3004	1812	Bhhiemoj.exe	87
PID 3004 wrote to memory of 2128	3004	Bkgeainn.exe	88
PID 3004 wrote to memory of 2128	3004	Bkgeainn.exe	88
PID 3004 wrote to memory of 2128	3004	Bkgeainn.exe	88
PID 2128 wrote to memory of 3488	2128	Bobabg32.exe	89
PID 2128 wrote to memory of 3488	2128	Bobabg32.exe	89
PID 2128 wrote to memory of 3488	2128	Bobabg32.exe	89
PID 3488 wrote to memory of 1764	3488	Bmeandma.exe	90
PID 3488 wrote to memory of 1764	3488	Bmeandma.exe	90
PID 3488 wrote to memory of 1764	3488	Bmeandma.exe	90
PID 1764 wrote to memory of 5084	1764	Bpdnjple.exe	91
PID 1764 wrote to memory of 5084	1764	Bpdnjple.exe	91
PID 1764 wrote to memory of 5084	1764	Bpdnjple.exe	91
PID 5084 wrote to memory of 4776	5084	Bdojjo32.exe	92
PID 5084 wrote to memory of 4776	5084	Bdojjo32.exe	92
PID 5084 wrote to memory of 4776	5084	Bdojjo32.exe	92
PID 4776 wrote to memory of 4272	4776	Bhkfkmmg.exe	93
PID 4776 wrote to memory of 4272	4776	Bhkfkmmg.exe	93
PID 4776 wrote to memory of 4272	4776	Bhkfkmmg.exe	93
PID 4272 wrote to memory of 2040	4272	Bkibgh32.exe	94
PID 4272 wrote to memory of 2040	4272	Bkibgh32.exe	94
PID 4272 wrote to memory of 2040	4272	Bkibgh32.exe	94
PID 2040 wrote to memory of 776	2040	Boenhgdd.exe	95
PID 2040 wrote to memory of 776	2040	Boenhgdd.exe	95
PID 2040 wrote to memory of 776	2040	Boenhgdd.exe	95
PID 776 wrote to memory of 1080	776	Bmhocd32.exe	96
PID 776 wrote to memory of 1080	776	Bmhocd32.exe	96
PID 776 wrote to memory of 1080	776	Bmhocd32.exe	96
PID 1080 wrote to memory of 5024	1080	Bacjdbch.exe	97
PID 1080 wrote to memory of 5024	1080	Bacjdbch.exe	97
PID 1080 wrote to memory of 5024	1080	Bacjdbch.exe	97
PID 5024 wrote to memory of 5016	5024	Bdagpnbk.exe	98
PID 5024 wrote to memory of 5016	5024	Bdagpnbk.exe	98
PID 5024 wrote to memory of 5016	5024	Bdagpnbk.exe	98
PID 5016 wrote to memory of 3504	5016	Bhmbqm32.exe	99
PID 5016 wrote to memory of 3504	5016	Bhmbqm32.exe	99
PID 5016 wrote to memory of 3504	5016	Bhmbqm32.exe	99
PID 3504 wrote to memory of 4116	3504	Bgpcliao.exe	100
PID 3504 wrote to memory of 4116	3504	Bgpcliao.exe	100
PID 3504 wrote to memory of 4116	3504	Bgpcliao.exe	100
PID 4116 wrote to memory of 3068	4116	Bklomh32.exe	101
PID 4116 wrote to memory of 3068	4116	Bklomh32.exe	101
PID 4116 wrote to memory of 3068	4116	Bklomh32.exe	101
PID 3068 wrote to memory of 2928	3068	Bogkmgba.exe	102
PID 3068 wrote to memory of 2928	3068	Bogkmgba.exe	102
PID 3068 wrote to memory of 2928	3068	Bogkmgba.exe	102
PID 2928 wrote to memory of 3856	2928	Bmjkic32.exe	103
PID 2928 wrote to memory of 3856	2928	Bmjkic32.exe	103
PID 2928 wrote to memory of 3856	2928	Bmjkic32.exe	103
PID 3856 wrote to memory of 3908	3856	Baegibae.exe	104
PID 3856 wrote to memory of 3908	3856	Baegibae.exe	104
PID 3856 wrote to memory of 3908	3856	Baegibae.exe	104
PID 3908 wrote to memory of 2932	3908	Bphgeo32.exe	105

C:\Users\Admin\AppData\Local\Temp\4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe
"C:\Users\Admin\AppData\Local\Temp\4e03cfe06b63083a433f045f4324791fa11034a255d016dad65f7be86e7a9b11.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\Akdilipp.exe
  C:\Windows\system32\Akdilipp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\Aopemh32.exe
    C:\Windows\system32\Aopemh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\SysWOW64\Bhhiemoj.exe
      C:\Windows\system32\Bhhiemoj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
      - C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2932
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        24⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2324
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        26⤵
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4064
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        29⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        30⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        31⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        37⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        38⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        39⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:372
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3340
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        42⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        43⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:632
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        46⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:232
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        50⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3032
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        53⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        56⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        58⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        59⤵
        Executes dropped EXE
        
        PID:768
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        60⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1200
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        66⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        68⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        69⤵
        Modifies registry class
        
        PID:4980
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        71⤵
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        72⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        74⤵
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        75⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:832
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4616
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        78⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1592
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        80⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        81⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        82⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        83⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        84⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        85⤵
        
        PID:940
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        87⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        88⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        89⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        91⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        92⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        93⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        94⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        95⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        96⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        97⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        98⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        99⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        102⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        103⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        104⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        106⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        107⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        108⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        110⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        111⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        114⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:536
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        115⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        117⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        118⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        119⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        120⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        121⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        122⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        123⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        124⤵
        System Location Discovery: System Language Discovery
        
        PID:1008
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        126⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        127⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        128⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        130⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        131⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        133⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        134⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        135⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        137⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        138⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        140⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        142⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        143⤵
        System Location Discovery: System Language Discovery
        
        PID:6116
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        145⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        146⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        148⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        149⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        150⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        151⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        154⤵
        Drops file in System32 directory
        
        PID:3144
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        155⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        156⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3824
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        159⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        160⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        161⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        162⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        163⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        164⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        165⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        166⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        167⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        168⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6644
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        171⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        172⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        174⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        175⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        176⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        178⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        180⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        181⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        185⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        186⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        187⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        189⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        190⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6928
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7140
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        195⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        196⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6456
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        198⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        199⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        200⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        201⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        203⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        204⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        205⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        206⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        207⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        208⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        209⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        211⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        212⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        213⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        215⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        216⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        217⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        218⤵
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        219⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        220⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7460
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        222⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        223⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        224⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        225⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        227⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        228⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        229⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        231⤵
        Modifies registry class
        
        PID:7916
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        232⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        234⤵
        System Location Discovery: System Language Discovery
        
        PID:8048
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        235⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        236⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        237⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        238⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        240⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        241⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        242⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        243⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        244⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        247⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        250⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        251⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        252⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        253⤵
        System Location Discovery: System Language Discovery
        
        PID:7820
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        254⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        255⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        256⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7356
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        257⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        258⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        259⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        260⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        261⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        262⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        263⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        264⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        265⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        266⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        267⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8200
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        269⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        270⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        271⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8332
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        272⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        274⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8472
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        277⤵
        Drops file in System32 directory
        
        PID:8612
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8656
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8704
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8752
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        281⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        282⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8840
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        284⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        285⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        286⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9088
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        288⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        290⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        291⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        292⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        293⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        296⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        297⤵
        Drops file in System32 directory
        
        PID:8744
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        298⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        299⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        300⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        302⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:9124
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        304⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        305⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        306⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        307⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        308⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        309⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        310⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        311⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        312⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        313⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        315⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        316⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        318⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        319⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        321⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8340
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        323⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        324⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        326⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        327⤵
        Modifies registry class
        
        PID:412
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        328⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9260
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        331⤵
        Modifies registry class
        
        PID:9376
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        332⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        333⤵
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        335⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        336⤵
        System Location Discovery: System Language Discovery
        
        PID:9604
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        337⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        338⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        340⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        341⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        342⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        343⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        344⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        345⤵
        Drops file in System32 directory
        
        PID:10000
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        346⤵
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        347⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        348⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10132 -s 420
        349⤵
        Program crash
        
        PID:10220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10132 -ip 10132
1⤵
PID:10192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akdilipp.exe

Filesize
87KB

MD5
986459711104cf23793086822c5053ec

SHA1
99d999ca2d8319bbc88fd4d7dd6cbdc39ca70695

SHA256
578a38b04ad08ca0db4058a63d27406d6e882d0898cbc76acdd3a54b71851115

SHA512
3e5096de38282e2f727c7ab79b294c62f50ba5917b499d3a0ffd293ddbda462359975bc1032b8a8290b0cdf6e7c46ff40c42acb1cc03f7b86b5d24b2ef3a99dc

Download Submit
C:\Windows\SysWOW64\Aopemh32.exe

Filesize
87KB

MD5
904cf67eb01ae8abf261ec8f9e983975

SHA1
53889621d58d0d7ddeb4c3adf2429670164f3d3f

SHA256
c57eea5ed4f67e766e641ea0c46edf6f5879b39d26aa81d702d5a369b4b3940f

SHA512
cc7e88393897e86e0af9ce2f468d0dacccb871ab3011f2d7d0be3b94e32a0f51cad9e68bfc76b6d4809bf4693322590888e7f6f64c53ef4d99fd55151150be58

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
87KB

MD5
79cc4a8cd88ff87ae1c0336e5b0952b7

SHA1
68438b22e38922374f288dd25859ff9e72e7ee1e

SHA256
65af320083beb6bce5d565db150a32655bb4c5498e30547957fe9bda431491d6

SHA512
c3ca24709a5bf1c412b8eb8f6ffc21a66cffd8920fec09c09e06a4166ef61ca88de67b079cc1ddb710758a48bd0d0aa4691c967800f222e5344ea16a5ed2b6eb

Download Submit
C:\Windows\SysWOW64\Baegibae.exe

Filesize
87KB

MD5
f50ede4d655c4561b6fe0b1add77fbd1

SHA1
e8b82fff99558ef53640830cd7f8e2cca13f09b3

SHA256
f8b5c62370fc7695c3c008c65e210939ff15773eb00ba94de714be5780583807

SHA512
d63a7cb734421e802d4d83150ba1de23cde985a6c1040b53a1e2c2988de8dd1f6b64a7556ebf86b4a1d1fea7efc1397aac438742211fcb216e418229b6176893

Download Submit
C:\Windows\SysWOW64\Bahdob32.exe

Filesize
87KB

MD5
25970ca65dc696f987641ae5a6349339

SHA1
dd4ecb60a88143fd2048b34fc01b98046d48f652

SHA256
13b4a1788a1b4530d58cc2d289ac524eaee96991caddd99fa05b5a9601be32d8

SHA512
78a7e0553c141f6fe4cb618f5c247e9362c51cce16f5e12eb85ffe9ca0c180148f4894e86ccc17a4ea1faa7b313454c8699292579991763b74a9fcc8a2a46f37

Download Submit
C:\Windows\SysWOW64\Bdagpnbk.exe

Filesize
87KB

MD5
7653c21414c592b18506092fcceb3004

SHA1
8b3dfa510df7363e4a140e5e8bea59b7409258f9

SHA256
79653f1577fed6a8fb78b3c6af0940cf5c1636cc4bffd8d43b39c8ad42ed55a7

SHA512
2bd6d8b72db4a8277635d7a29124e9e0ca770bfa0a08a2ab4047228ecd37b516df855f6300a72e85c392852415874361193b50c15d75b6d867c88d7b0becb306

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
87KB

MD5
1dc231924ce4d8638cea9dc3c0152a5b

SHA1
6500fa6dd69dd6d321dbf02cc4d87844f4eb00d3

SHA256
10729dc7197fa77b90845812b8bcaad2ccb3cd0008bd59be8ea00d78b61d8183

SHA512
b1768935a6049b4cc08c7da9aea7a96054494eeac78e0a117294dff546f16c6a475bc6b003201dcfd5d57dce21f41c86f2c0bee18b0c03f9977ec946adaaefd5

Download Submit
C:\Windows\SysWOW64\Bdfpkm32.exe

Filesize
87KB

MD5
4e9787cf8111b744f8cc8b79b6a61efe

SHA1
052fb7cbac5f9a592362008154056c647a278e9c

SHA256
74c83e0121e5489ee5cabac65dd0e43a87c754d65b352c25dde8a8002a5fb64b

SHA512
66481caf46d3dde4683ba50ce472541687d08175d77ef9e72c630290c1a8f8d381e685c04f484eee049ea2d83b5116c0ecd05e793921161cfb92e24739dff7c5

Download Submit
C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
87KB

MD5
f79c12be9b2032933b992036bf89b346

SHA1
adf65c07da798f644393671448f5f7b777534d7e

SHA256
8ff2527821fae0c1c979c5553264454c94db405b984e606b0075656a5a773d09

SHA512
b7bd397f0bb04ebcda2f05351ad58f306049ca795200b368e6b6e2030a234f87c2c3f5b33119a2dca732d739d5ccbe92a947bd11947564b126d26660b4da4574

Download Submit
C:\Windows\SysWOW64\Bgbpaipl.exe

Filesize
87KB

MD5
2b61812ebff42ef98d78370a17c674de

SHA1
41674534a523925a64acc0de3aba82c36cdbbc61

SHA256
99f685d898a0c865f63e7a73c038f8ffae61b1a26aa4749da88a64456c47d15a

SHA512
70456d8ac854d0044e55de411a8710302fa1392245f6291ec974a640bcb9f4360ab56321dbe18d97754034c442fcf49a0fdb12fecaea15f0df80b17d34a50951

Download Submit
C:\Windows\SysWOW64\Bgpcliao.exe

Filesize
87KB

MD5
e2888563f25100bd8c7d248d860d1271

SHA1
790ea39627c888300ab7e85d1b365ec861385582

SHA256
1fae5b6f1363317f215e4b2d6bffb91e665098f345df9daf6dd7e462d0f5f125

SHA512
4ededfe7e0eaee744584efd348cb066af88d7c67ce396140d1c2c268d4c1655634ba3038bcb0d694fec874451921e583ccd29ade378544ef03ad846ba9217fce

Download Submit
C:\Windows\SysWOW64\Bhblllfo.exe

Filesize
87KB

MD5
4853e29cc845617cd21dc67e83095bc5

SHA1
ddcd0ee2b0d40391fac4238bb8d13e54f29654bc

SHA256
fd167423ffa1fc3d9fe45f612b27f5374192c1e46bd090dfc2af6c49a5e10e66

SHA512
7ae711351ec803b1cf9dec772558a7375ff0ef1e1ab56457a5de513bbf9061ac3c4b509cc496ed72cbe72db49d0b82569af692f1ea78634f4b7b83799f9a704a

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
87KB

MD5
7409b9bf5869861226ce4fcc782df50c

SHA1
43fd568c9fe061ed48325776bd2d8e07b7eb8a50

SHA256
a3b825ff7c22e4fce42a30d743349c6552c9628b0996e137143a033fb8c6cedf

SHA512
98ba7c12aa3ee8a6c9b5a3fe0bed8357b4c918e2672b686120947cd84fb5dda321be7e638b0058af62ebdf3183d63d50bc1d6422967a1ef103b55356a85c286b

Download Submit
C:\Windows\SysWOW64\Bhkfkmmg.exe

Filesize
87KB

MD5
2389cb21411b6c6778762892621806f3

SHA1
73a54005bc65b0f2928808fb9b8b9acdb96699ee

SHA256
95358f9ef86dc75da153d84bbd130b4fd64f2d840fb08c17d600e733c2f18ae9

SHA512
4bd61b39103c7a19579e641324b52d97d6e9f8c41793cb13e11fa607e92fbd9b7a54389f238772f30b9f4d8a0ae7a9a758165caf47507c98c68c8bfdf41280b6

Download Submit
C:\Windows\SysWOW64\Bhmbqm32.exe

Filesize
87KB

MD5
c2ed5070920500d9d5fcaddd9af2e7bc

SHA1
8ff192a3f075090193ac206feccf286f6b9e9f76

SHA256
f433f5bb984796efea315af7803dd8ee214fbed3295e58b6a364e5f828ddc992

SHA512
3fdb90ef0ea1b1bbda373a8ec83818f7cc7ecd29d8105bdb06c97d59d2529dd0e6e6628407d012656ebada59309adcff254dac469182b3a89a872336f4a7d861

Download Submit
C:\Windows\SysWOW64\Bkgeainn.exe

Filesize
87KB

MD5
82311325b461af58556acc6798df3c55

SHA1
47e40a18a1547e248e8a7444092c1963f8205b57

SHA256
684b668a103f0f4b147104d75cde87177527ca20fbe33edd2ee17e8545569540

SHA512
e488e744de7b59a2cbbd404df43432232e5e320cc441fe0d3841fded94f97e618486a05aa1a2af455f845489b9188c1318f12a95798180fe8261115e53b7a36e

Download Submit
C:\Windows\SysWOW64\Bkibgh32.exe

Filesize
87KB

MD5
8e5923f60564d6281da5ffa8ef4a2206

SHA1
c65bd3026f1bb4ca16876293b509d8d1999e2f6e

SHA256
03be13864aef9a40198833bb29be8c60e96c8feb8eab7143bfb5de1c800f0726

SHA512
627c0257772f4082fd74e03fe7472eb93ac5c6a827f89de6b19e0c2095e7fc046ea9f0eac39926dd75103502075c5b0e458f4ce9331e43a38ffbad073bcc4de7

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
87KB

MD5
b5383409d7e2fdb33e24cdd52f025b47

SHA1
16668bbe15df1ed822e552b5a5ba1e7678db5f27

SHA256
b9d87b8e10308304888f1bc771eb1b834997bb63db6186cc45a6cedb763410c0

SHA512
1f7f453183886377938c006bc9fa3dcc2e4e590cb9c670bcf260086f40a291d518cffc35548d1ecd031214ac17135c8229c928b341aba5ca9393281fb8559f2e

Download Submit
C:\Windows\SysWOW64\Bknlbhhe.exe

Filesize
87KB

MD5
b08b24c3d8dc2ecbc3e58dd7346dc684

SHA1
b9f4aebca69c7191a201b326ece66f70262d1d14

SHA256
dc2808d90d9bfa997d865f7caaa5c866d36de7fb51cba7c370cdaf0005073911

SHA512
266320a2204e5d6260ac30eb4230c7cada3e30953d9022c844df74d56f5947f2092f9f5730f0d838c14ec134c8c719e44e076bb7e9942e7d0599d33805301219

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
87KB

MD5
21052c2c36cec51edd1497da2401d52c

SHA1
0f623ce7a04f1a70eff682a9a3a58b142afba832

SHA256
15d973fd4251e1e015ed1c1570898e1ce51259c12fcf929f6fc22be20ecacb2f

SHA512
271914aad54713de8afa75db368da53b262a16a07ff294e2412aa60f843ef526cd1c9bd4cfaf854c45046ab033c28bd03ec7391bfc71d981a9896addfa22a2c2

Download Submit
C:\Windows\SysWOW64\Bmeandma.exe

Filesize
87KB

MD5
5aee253e8d11c7d86f8fd73deb87cfd6

SHA1
d994c311278fab9e64b51b92f281527963a33f2d

SHA256
05ce1ee126bb112b8c58bde6628fb27c0016318a4dd7455cd62ee3d877babceb

SHA512
535f27c6a0ad8e8df011be1b03b50a76adb453705e03300de68617f9a36a325935b73d9bb9303bffcab4f3ab76e60412d800d7155b05842a07142880ef130d52

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
87KB

MD5
ec89e098b10fcd3050b952ac76efdd10

SHA1
4420ab09fc28e0be2bf7fa250e62eb253189e2b4

SHA256
c0987dca46d557e31e99f0928b78645de97b067acdd27f92523d803498ff7b54

SHA512
973092bf3733b8969ab374cb660d87a50b46acfbaeab94d1ee55c8cc5103d6d2cf17fb3df572dd8267e9911d15196432bfe419f1382f076e9efafb4245d264a4

Download Submit
C:\Windows\SysWOW64\Bmjkic32.exe

Filesize
87KB

MD5
5d22f92505459e41a9772cac89addad7

SHA1
6953393f9db623cf3d7a75fba96fb5c8e1a489a8

SHA256
1bfc0ce8e6225e9e9beec584a303fe8b1f49710b02f25a9bde7780645cc2e97e

SHA512
8ecb51c7c146176e35b5d0c35f7f89dbd72132bf8256d6701ed531c14462382cce0d6d0ae769ff50c6a1905df02022d94f48c015a8bcda998fcaeaad4dd5bfb2

Download Submit
C:\Windows\SysWOW64\Bnlhncgi.exe

Filesize
87KB

MD5
5ec4afe276d64472ffe5bfb28ba1d814

SHA1
bcd0d0793beb06995e94cc11b78bc8233e86f1d2

SHA256
48634a6e13fdec5c69e17e32f67362e5f054ce22177fed7c3fde07605ccf0c7a

SHA512
d47f6e34077d1bf72e1fb2a2308faeb316da123499869ed7175cb8466b3c402520cb3d5fd543364195b66be449bc6db1a5120967c6d0e1ec1d5fc3c180f16dbd

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
87KB

MD5
c8a9d38ed8dc0e215539dd60dcecd881

SHA1
a0650c4abc43ca40a4950913dcd720025246ac4f

SHA256
76f5c543713b0d3860d3549b7c0f69e15d866ec7a9a30547b3da4fafaa2d34dd

SHA512
be71477971368f7fa2e6f8f8a651f3ce56ca24237fdf88571680a1e8fd4ad2dc078676a5085312cfdfc3db60d1da586879c71a2b67d4160e79c0e99d05edaf3f

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
87KB

MD5
535a996ae1dbf9b4c5ac89c971092f77

SHA1
993b97514267ed2d36fb830fbb569b23258b3e68

SHA256
18354c5b68408094b259f0ddaa6f57984d052905f91a774ee238975e33c751ac

SHA512
e733e0b7e052d54db965963038ca6cf2bb5ad508a68566fafcb07ea189c2a1671d3efd7e55c370cf52cf55f465bf3820fbb7995f84efd248b8eba4027bec294b

Download Submit
C:\Windows\SysWOW64\Bogkmgba.exe

Filesize
87KB

MD5
d93fad5795fe5c5381031f7067b27977

SHA1
e95817fe1af75838354d16336986b79b28b93684

SHA256
cac5d855447661801008cb47653351cc752b65d2e7196b98eec6b653d29f1865

SHA512
306b25100fbf67b4bd6f4f33588f0c82b13782a2cedfe94f958bff471826ef4d55c76b4162f9f357a21c7f554b6045189c5c9e945c2ee64d0d15ff59025336a2

Download Submit
C:\Windows\SysWOW64\Boihcf32.exe

Filesize
87KB

MD5
1c145485a233b6adba8d41ff56ab3092

SHA1
b3d4ab1d3a8a2a047079b2dfd4e320f90bb07a25

SHA256
f4b8288d0fcc1237b5e57d2e56c2ca0037cc4b536054f3ea5d3941e7b6aee447

SHA512
2b607b8a3033f0211b96a7d8921ff8c4a0ad9d967024e3183c58b37072b704523fa632699172225e6d49c3a9efee66b6dbeeb8ee1356d1b5c71fb090fdfcc35a

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
87KB

MD5
dfdea67dbbe90e2706b09941eaa574b0

SHA1
0144c0520f197fba26ef25591b3e40344b972b5e

SHA256
18706c39676fb1485bc7131e1c121dbc23f6eabfd0a12646c02d33ca4d789137

SHA512
83a5a23d4f6a4ccf2891aae3ce95499402e190b839bc7388a020e4b16dd9f866b5856613815fda31aea8c89678b5195a186f11f931076704c8c9328848c773d5

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
87KB

MD5
226598efd212a2abf85c13848eb89f38

SHA1
17ce62811c35284d52d0db04d7b8733993505b55

SHA256
046054e1f1ebe6ee6252fc1ee686c8adc4064354dde0940e37fca9e617586b7d

SHA512
8bd025c045d41832da9f6170a7399225d9d478b559fb43c02af220986b2b0c7e2748403d1424e1f710bb08598b3795dbebb12fb772dd707b6ba49e6e1686606a

Download Submit
C:\Windows\SysWOW64\Bphgeo32.exe

Filesize
87KB

MD5
8e40121fa161f2f05fcd1bcec2afddf3

SHA1
2d751a9c8d44fb39abed31775e71643692422db6

SHA256
354490abb1c35b89ed5333281645babb71188d15bcb617c34f6ec6488934677a

SHA512
2587a154ac09b129e79c7df6389d26c2d5b42ab7c754da7866427459849d95d71dc7aa8e82c294a098148c375712b1bbd85ceb6e4e279b15a5e4f27d738b1a7b

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
87KB

MD5
e5f272becce1967e05a6482d9cb25d07

SHA1
7d3d746c59632038b0dc1eadc389c8ee2b80ece0

SHA256
d82e441b9e762a8fa0c8da82427a8724bea3ca4f6491d3c853ea2519634b3ba2

SHA512
0f4c6eb514984360369037cb2c3bd1bda36ea365e768d07f1df135eb2b76886383c4cf9c34ae523cd5c8c37548225fdc4becf4502b6f22a7c0590b0b8c1eba61

Download Submit
C:\Windows\SysWOW64\Gijmad32.exe

Filesize
87KB

MD5
bfd70ffb05c34b8c34079eca4190f8b5

SHA1
f049c0f6779b802a1c3f6612cdb1128f2bde5d36

SHA256
d394ccdb4b7dd3f608a8b9600d884d82fab9e875c91165c46ad0a14dcf2b89b2

SHA512
d40b8f881713e2de148565016ae1bacb7b9ede01466219a67079fe8330beeaed807af11de3416ed824cc7af0dddd415b674dfb26c877468fddc9b6df9be25f06

Download Submit
C:\Windows\SysWOW64\Hbenoi32.exe

Filesize
87KB

MD5
019d79c2a6518041531277520dcb7008

SHA1
e8bfff423a6fb32ba560db11210e9385b2c1d6fe

SHA256
88870f6f8ea8fed04d048d9354ac4088d9fc56f77dba12a48a20275a22c21f81

SHA512
c74a519469f79e4efc24fc8fbbc2202f8b9044f8f2e877cf7ce3eba9f2ee7c3892b45aff4cb0b06d356d81a9b2327ad0005f8d66107530cd92d494da760b6a64

Download Submit
C:\Windows\SysWOW64\Hbihjifh.exe

Filesize
87KB

MD5
db5d7d130043ff688ab66c4c9b812f57

SHA1
9e03814a33e45cc85941925d3c8717ace727bbe0

SHA256
1f6008659dd8a5b078f887c3deee44bc2044b04ee29a92af6dce8716a884f953

SHA512
50867b0f29785420b4fa7019b64c3a679b63ef91145e24ccc9a28fa871749406fb8c3fddf26ab74fa87d3ddd8833da937f536153da5ac1690ef489cda7948fbf

Download Submit
C:\Windows\SysWOW64\Ibqnkh32.exe

Filesize
87KB

MD5
b8ab2d4079e4e8ad04a02c4c996e6eb6

SHA1
4b0852aa574ca3162f93153dbff7a30c6374ff8d

SHA256
d17741ee3e4299a171d811f2dcb92b2a58509b453cd94b622d023e95000ed159

SHA512
56bfec876325b1719eb130c57b58c8c82150be1292cb838a0062eb133ca8fbdd81f8287eff758e2ddcb907ef82d38b035b7aeebb50dbfde7dd654fdf761aa968

Download Submit
C:\Windows\SysWOW64\Ieagmcmq.exe

Filesize
87KB

MD5
f7385aa5be8e22e6975a0a2df41d9b07

SHA1
4415226016b1a1724b74fb5fac327b322e027c4c

SHA256
924eecafc9736a76eff26b28d5d619edaa5c2762b265610fa67709a7f9de017c

SHA512
23d12128223454c43ee4ba798cb1d622b7d9a14656306c16488656ba2354ee0ed0931908547e4e0edf46aa5c2e9f3cf0165c875e1752654a0aedaeb3b05d4085

Download Submit
C:\Windows\SysWOW64\Ieccbbkn.exe

Filesize
87KB

MD5
a76344a88baf0c1f66230ff87de502fc

SHA1
2fa3f028495810c15ffd83f1542497875640479a

SHA256
3d1cf5b0f4ec5aa9d800b3bcb4d12fbb50b22b52a05d391dee93e8fa2e719354

SHA512
574b6d254687023506e1cd433b248cea8febd30455783faa14a7aa8787689b712fb263755316b2681b9337685333f0868bbef50ef469d0251d0ea08ae08ae620

Download Submit
C:\Windows\SysWOW64\Ipihpkkd.exe

Filesize
87KB

MD5
6988c5217404a2ee42ef355b8f10d2f0

SHA1
88a8f7df919e3b74c87aaa0fd18a957325e6bfce

SHA256
30569964ca24a91acd4cebb8bcc3179835e511d214f1d909ce34cd4016b2b02f

SHA512
89229a626d62c6daedc2cc6eaee907825b1275f5f6a7e4d83d2723416f2fad933bf953fae736158a405f7ba6c71cc4b1c04561da97d626563d4b2ecd5e355a13

Download Submit
C:\Windows\SysWOW64\Jeocna32.exe

Filesize
87KB

MD5
626bca63f7370a96600b99965c9df0a4

SHA1
f40f0be541fa722ad739ffa88175c33ef5fd83e5

SHA256
0bf411a7b02016ddae346cb634cbc7a60783b5a68147dd562fc1ef9722c3bb26

SHA512
49df199814e1242eb7a628306f495bcb9e72103feadef9e3d822380c620180ebc8708a79ea9be04497e249dc2b1f31ec790ef65552fff708814b49d6ba6b6008

Download Submit
C:\Windows\SysWOW64\Jocnlg32.exe

Filesize
87KB

MD5
bd712551b49dd0ce450a8efa22f49616

SHA1
410090cd2e22e0c44594bddc8d997b2012c524d4

SHA256
4064471a2b6764ddbfc6390b1b576b272fd8539e8b95e3279620d52cdc54f91c

SHA512
22f9d648876cc3b09db3cf38e4586ed96cd6331da1b501292c08e3b3dfc59430204adb34017fd41d3da921f44171b65b6d8181896c8fd6d3e8903a49a27c8d93

Download Submit
C:\Windows\SysWOW64\Johggfha.exe

Filesize
87KB

MD5
62ae2dafea2d59bab082d974d54eaee1

SHA1
454978f80a1f4ce6dedf27463d76826e80321ccc

SHA256
225c8538d40df75f257c1f90103bfc5f9564f33b9ddc3dfbc6172e9af2f1433b

SHA512
844a508212f838caffbb25fdf25d09b667f1b995222786e20bad7d3dde5367b65690bdea107d57043ef04d03e4ad36530e4931c4752b5a3653c4f40d799a0c20

Download Submit
C:\Windows\SysWOW64\Kbqceofn.dll

Filesize
7KB

MD5
a9d90154a90c4f82ddf766ce48aa0bbb

SHA1
6c2062b05a719c56f0a2a1f540be8c531d06ac25

SHA256
d6a598366d3665c1853e3c9a9c1f5e246ad96a511a3a17e1755ec3ce707e98a3

SHA512
69c64895a8531b7397ca7843efe83392791821581717778eb7a2880976ba094868e63b488efe8ea28dfafcdcd07191db161a7293ba1f4c4b7a5531c3b5123bc1

Download Submit
C:\Windows\SysWOW64\Kcapicdj.exe

Filesize
87KB

MD5
33ff493b26082acd4988d02d749e52b1

SHA1
28798801fe07203f52277cca0769cd4fecf26bdc

SHA256
dd12eb46d389f27a1445e15b56ea11205c1c791e836b36cd950d56a5df232425

SHA512
46ef8be2282425615e1e39fc33b230f6ae4c2cef8ffbc41fbd574885ee84d5c5bdf1de824b40d662035a0f735924f770a1d4fa7c1dc44b129625ee6ad4893eb5

Download Submit
C:\Windows\SysWOW64\Keifdpif.exe

Filesize
87KB

MD5
37a2b77326541245d7d4dcab4b7a2da4

SHA1
00965c6871134c6b3fc7c41f2829e6310c386eea

SHA256
8c3e2f2820eb35e5f626b0e06426de991425912f9ad95526b3ef7aed8c2eb051

SHA512
3f02d440b469ca71bb879ed75886de9d6a4cb4d011efa6566ed628f3b13f5fa35d6ea961963f1280251903801f73aa8d337566dbf8a711932b2df6c92819a08e

Download Submit
C:\Windows\SysWOW64\Kiphjo32.exe

Filesize
87KB

MD5
0ff107b4ec6851afe15b9e505f139a8b

SHA1
a4c2c5680e9ae25d197a5013c231bf3ae5cc50bd

SHA256
5b4ad77c40e3afb3afd0d663ef39e5c389b7512efa15f700afa940e5085f21ce

SHA512
da3cb45e600dde403cd771c2b20b101ff93988f2fa820221e98cc8a0ea69c3eac15566d826ddcbdd23020ab9e8226b44c48ccb6acd9a85aeb65ada9811de1488

Download Submit
C:\Windows\SysWOW64\Lpgmhg32.exe

Filesize
87KB

MD5
54230ece828d2d844e64ac960369b2c9

SHA1
ac604f8306bcba2104bea683656071d00517a698

SHA256
5920e695e7dbbef43ae88723bd816e5f967c8aeba3a22f6684c9fa5d7ec4240e

SHA512
82d9c1cbfb7aa88a6c1b223b5583044f22e1ee353c5107d69b977f29a1bcb174d73241cf0263477c6745ba291bc59ce7ed03ef9783a66db245c1ef4b02e4d1a4

Download Submit
C:\Windows\SysWOW64\Lplfcf32.exe

Filesize
87KB

MD5
274a85b176de0b3cf1faec53ddce0906

SHA1
4ad30e6f173071619bb97cd3b95670ec86408e46

SHA256
584d3858f589c0d667b842e38a9b5d1c919559c452d5b8b86c2fd95505da4526

SHA512
659b93b0cabab9498fa4d22309d00a874bd655851bdafb3c06418130b8911b6fd2498898e6b42bc9aec68c7e606350c98ca1125960698faa2e208eee24ceb58d

Download Submit
C:\Windows\SysWOW64\Mhckcgpj.exe

Filesize
87KB

MD5
c9c855eb75c38997650dc06057ca41c2

SHA1
a42aeae543922df5934e37c787cfa5e33cf0a52a

SHA256
a6aa3ab6882ee719f3503c0424325cd76f9c80dbf5e98e85a593b47b8c8e15eb

SHA512
6f22a33638b77dd852cd2859f458e54270806a8295339bf980d08386356ae8388beaf76c2c5ad78fb6044570971101863f9d9e791943f8b185954d763d00f183

Download Submit
C:\Windows\SysWOW64\Nfgklkoc.exe

Filesize
87KB

MD5
c6df4b09e8885cf73c6de9f1ce61126d

SHA1
778d14c35e67f248b08e418396a85bffb6768837

SHA256
d15b7648248191719a88c704a43c89d6cb1e04830f58a3a61c4d9969f20a8b89

SHA512
20d0014b697b783d02b672d4183cdf5950021c23c58a344fbb779812c1584b719c9a9c4ef2595f8ed531dac45fd005fa2aeaf058622f6877fbbf02799d59ad15

Download Submit
C:\Windows\SysWOW64\Nfldgk32.exe

Filesize
64KB

MD5
588298737a91e02b18c51072cdca6512

SHA1
66aa103f07024e872377380f5ce1c3fb981f5011

SHA256
7003f77ba26d3f20e71babb8bdf729009e1ebece93bbe510e850e57eabc67165

SHA512
57331119587906fdf278626a72a0a3315108ff30a160ac8171b2c7143c367e5fedafd50bdf6fdb1ae101fdb78144661459cf1db90c82678b96cc80c00e53146f

Download Submit
memory/232-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/372-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/632-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/768-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/776-101-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/832-522-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/940-576-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1080-110-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1200-450-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1272-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1468-360-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1508-564-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1592-541-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1604-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1648-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1752-444-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1764-60-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1792-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1812-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1924-457-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2040-93-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2056-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2056-92-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2128-135-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2128-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2156-510-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2268-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2276-109-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2324-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-516-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2756-373-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2860-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2928-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2932-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-126-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3004-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3032-378-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3068-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3080-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3160-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3208-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3340-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3376-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3460-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3488-52-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3504-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3544-534-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3592-469-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3600-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3628-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3648-438-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3692-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3732-391-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-492-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3856-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3860-283-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3908-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4064-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4116-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4140-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4152-498-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4272-83-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4296-397-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4304-367-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4360-558-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4376-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4404-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4560-301-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-528-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4664-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4728-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4748-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4776-85-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4840-504-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4892-487-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4972-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-481-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-127-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5024-118-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5032-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5048-570-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5076-474-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5084-82-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5092-462-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5152-582-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5188-588-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5232-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5272-600-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5312-607-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5344-612-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5384-618-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads