berbew | 6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2025, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
Size

240KB
MD5

7474114d50a4eae75e4348673c31a11e
SHA1

a0fca52e0df891c54ac487253625c22219c56633
SHA256

6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175
SHA512

6ffedffc340b9e83acde4827031499007035fef297455b7a164f1445ca6327ec72e68ba30b6e59a573e765d26706893d67cc547db0b5a68d87e5705e88efb472
SSDEEP

6144:3dgF4r/3GyZ6YugQdjGG1wsKm6eBgdQbkoKTBEA:qF4r/GyXu1jGG1wsGeBgRTGA

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpeahb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojiiafp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibcaknbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmfkhmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkgeainn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmbphg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fligqhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jghpbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgelgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ilqoobdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgkmgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chiblk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iibccgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcpjnjii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhnlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmfkhmdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mfqlfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kgdpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lfbped32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pffgom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpdnjple.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfbped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aokkahlo.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1424	Efjbcakl.exe
3164	Fneggdhg.exe
4292	Fligqhga.exe
1496	Fngcmcfe.exe
1824	Fbelcblk.exe
2276	Fmkqpkla.exe
2052	Fbgihaji.exe
5100	Flpmagqi.exe
4808	Fbjena32.exe
3000	Gnqfcbnj.exe
3904	Gejopl32.exe
452	Gbnoiqdq.exe
208	Gmdcfidg.exe
1888	Gbalopbn.exe
4436	Gmfplibd.exe
868	Gbchdp32.exe
3524	Glkmmefl.exe
5028	Gojiiafp.exe
3576	Hbhboolf.exe
1236	Hfcnpn32.exe
3420	Hoobdp32.exe
1040	Hidgai32.exe
4844	Hlbcnd32.exe
1744	Hblkjo32.exe
3384	Hfhgkmpj.exe
4796	Hmbphg32.exe
4908	Hlglidlo.exe
4296	Ifmqfm32.exe
408	Ibcaknbi.exe
5008	Ifomll32.exe
3456	Ibfnqmpf.exe
2388	Igajal32.exe
832	Ilnbicff.exe
3664	Iibccgep.exe
5092	Ilqoobdd.exe
5060	Ioolkncg.exe
1080	Igfclkdj.exe
2292	Impliekg.exe
3236	Joahqn32.exe
520	Jghpbk32.exe
2516	Jekqmhia.exe
3616	Jleijb32.exe
920	Jpaekqhh.exe
1468	Jgkmgk32.exe
1612	Jlgepanl.exe
1548	Jofalmmp.exe
1032	Jilfifme.exe
3080	Jljbeali.exe
888	Jebfng32.exe
4024	Jniood32.exe
2360	Jgbchj32.exe
4252	Jlolpq32.exe
2248	Kgdpni32.exe
1788	Kjblje32.exe
2236	Kpmdfonj.exe
5068	Kckqbj32.exe
4552	Kjeiodek.exe
4952	Klcekpdo.exe
3416	Koaagkcb.exe
4564	Kflide32.exe
3804	Kncaec32.exe
1052	Kpanan32.exe
1576	Kcpjnjii.exe
1296	Kfnfjehl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mkfefigf.dll	Qobhkjdi.exe
File opened for modification	C:\Windows\SysWOW64\Bacjdbch.exe	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Chkobkod.exe	Cdpcal32.exe
File opened for modification	C:\Windows\SysWOW64\Kngkqbgl.exe	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Onmfimga.exe	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Paiogf32.exe	Pnkbkk32.exe
File opened for modification	C:\Windows\SysWOW64\Ppolhcnm.exe	Palklf32.exe
File opened for modification	C:\Windows\SysWOW64\Ilnbicff.exe	Igajal32.exe
File opened for modification	C:\Windows\SysWOW64\Jilfifme.exe	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Kngkqbgl.exe	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Okehmlqi.dll	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Nnahhegq.dll	Onapdl32.exe
File created	C:\Windows\SysWOW64\Kbjpeo32.dll	Nqmfdj32.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Njfkmphe.exe	Nfjola32.exe
File opened for modification	C:\Windows\SysWOW64\Nmdgikhi.exe	Njfkmphe.exe
File created	C:\Windows\SysWOW64\Pnfiplog.exe	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Omfmcjlk.dll	Ohlqcagj.exe
File created	C:\Windows\SysWOW64\Ckjooo32.dll	Hblkjo32.exe
File opened for modification	C:\Windows\SysWOW64\Lgbloglj.exe	Lokdnjkg.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Njmqnobn.exe
File created	C:\Windows\SysWOW64\Oakbehfe.exe	Onmfimga.exe
File created	C:\Windows\SysWOW64\Opqofe32.exe	Ombcji32.exe
File opened for modification	C:\Windows\SysWOW64\Panhbfep.exe	Pnplfj32.exe
File created	C:\Windows\SysWOW64\Fmbgla32.dll	Aogbfi32.exe
File opened for modification	C:\Windows\SysWOW64\Hmbphg32.exe	Hfhgkmpj.exe
File created	C:\Windows\SysWOW64\Gifjfmcq.dll	Jilfifme.exe
File created	C:\Windows\SysWOW64\Npbceggm.exe	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Fcokoohi.dll	Ncnofeof.exe
File opened for modification	C:\Windows\SysWOW64\Lcnfohmi.exe	Lmdnbn32.exe
File created	C:\Windows\SysWOW64\Njfkmphe.exe	Nfjola32.exe
File opened for modification	C:\Windows\SysWOW64\Nncccnol.exe	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Ikjllm32.dll	Onmfimga.exe
File created	C:\Windows\SysWOW64\Kcpjnjii.exe	Kpanan32.exe
File created	C:\Windows\SysWOW64\Dannpknl.dll	Nmipdk32.exe
File created	C:\Windows\SysWOW64\Baiinofi.dll	Ngndaccj.exe
File opened for modification	C:\Windows\SysWOW64\Agdcpkll.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Aokkahlo.exe	Agdcpkll.exe
File created	C:\Windows\SysWOW64\Gjecbd32.dll	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Chiblk32.exe
File created	C:\Windows\SysWOW64\Gdaklmfn.dll	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Flpmagqi.exe	Fbgihaji.exe
File created	C:\Windows\SysWOW64\Akcoajfm.dll	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Ibcaknbi.exe	Ifmqfm32.exe
File created	C:\Windows\SysWOW64\Cgdgna32.dll	Ibfnqmpf.exe
File opened for modification	C:\Windows\SysWOW64\Mjaabq32.exe	Mfeeabda.exe
File created	C:\Windows\SysWOW64\Ocgeag32.dll	Opqofe32.exe
File opened for modification	C:\Windows\SysWOW64\Ahofoogd.exe	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Kiodpebj.dll	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Folnlh32.dll	Nnojho32.exe
File created	C:\Windows\SysWOW64\Nclbpf32.exe	Nqmfdj32.exe
File opened for modification	C:\Windows\SysWOW64\Onmfimga.exe	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Onocomdo.exe	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bkgeainn.exe
File opened for modification	C:\Windows\SysWOW64\Dafppp32.exe	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Fkccgodj.dll	Fbelcblk.exe
File created	C:\Windows\SysWOW64\Lmaamn32.exe	Lfgipd32.exe
File opened for modification	C:\Windows\SysWOW64\Ljhnlb32.exe	Lgibpf32.exe
File created	C:\Windows\SysWOW64\Nagiji32.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Offnhpfo.exe	Ocgbld32.exe
File created	C:\Windows\SysWOW64\Ejphhm32.dll	Aoioli32.exe
File created	C:\Windows\SysWOW64\Akfiji32.dll	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Oclknk32.dll	Fbgihaji.exe
File created	C:\Windows\SysWOW64\Hhaljido.dll	Jokkgl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8036	7944	WerFault.exe	312

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onkidm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgpcliao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hmbphg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Igfclkdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jofalmmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcbpjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npbceggm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qpeahb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akkffkhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ombcji32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdoacabq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aphnnafb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adfgdpmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chiblk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lnldla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llodgnja.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjdho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chdialdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbelcblk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hoobdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jljbeali.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Knenkbio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oclkgccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfmmplad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdpcal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fngcmcfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmkmjjaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgifbhid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlolpq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbgihaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jleijb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kckqbj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fneggdhg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gejopl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbchdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fbjena32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlbcnd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmaamn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mqdcnl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhdgpii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njfkmphe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnaaib32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lopmii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnojho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocohmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phonha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amnlme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpkmal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npgmpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkqaoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ibfnqmpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioolkncg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdmdpjg.dll"	Jljbeali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfoaecol.dll"	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hmbphg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebcmfjll.dll"	Mmfkhmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpghll32.dll"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpaekqhh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eleqaiga.dll"	Mfhbga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Glkmmefl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcckk32.dll"	Jpaekqhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekoglqie.dll"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oakbehfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opqofe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nalhik32.dll"	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhafck32.dll"	Kcbfcigf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hilpobpd.dll"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocjoadei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Figmglee.dll"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppgif32.dll"	Kpanan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aphnnafb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpmkebjc.dll"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofkgcobj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iibccgep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hblkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhejhfp.dll"	Jlgepanl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlme32.dll"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efjbcakl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nqmfdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njfkmphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmlmhc32.dll"	Caojpaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llodgnja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ppjbmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Galdglpd.dll"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjmj32.dll"	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eelche32.dll"	Kcpjnjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njfkmphe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1424	2352	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe	85
PID 2352 wrote to memory of 1424	2352	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe	85
PID 2352 wrote to memory of 1424	2352	6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe	85
PID 1424 wrote to memory of 3164	1424	Efjbcakl.exe	86
PID 1424 wrote to memory of 3164	1424	Efjbcakl.exe	86
PID 1424 wrote to memory of 3164	1424	Efjbcakl.exe	86
PID 3164 wrote to memory of 4292	3164	Fneggdhg.exe	87
PID 3164 wrote to memory of 4292	3164	Fneggdhg.exe	87
PID 3164 wrote to memory of 4292	3164	Fneggdhg.exe	87
PID 4292 wrote to memory of 1496	4292	Fligqhga.exe	88
PID 4292 wrote to memory of 1496	4292	Fligqhga.exe	88
PID 4292 wrote to memory of 1496	4292	Fligqhga.exe	88
PID 1496 wrote to memory of 1824	1496	Fngcmcfe.exe	89
PID 1496 wrote to memory of 1824	1496	Fngcmcfe.exe	89
PID 1496 wrote to memory of 1824	1496	Fngcmcfe.exe	89
PID 1824 wrote to memory of 2276	1824	Fbelcblk.exe	90
PID 1824 wrote to memory of 2276	1824	Fbelcblk.exe	90
PID 1824 wrote to memory of 2276	1824	Fbelcblk.exe	90
PID 2276 wrote to memory of 2052	2276	Fmkqpkla.exe	91
PID 2276 wrote to memory of 2052	2276	Fmkqpkla.exe	91
PID 2276 wrote to memory of 2052	2276	Fmkqpkla.exe	91
PID 2052 wrote to memory of 5100	2052	Fbgihaji.exe	92
PID 2052 wrote to memory of 5100	2052	Fbgihaji.exe	92
PID 2052 wrote to memory of 5100	2052	Fbgihaji.exe	92
PID 5100 wrote to memory of 4808	5100	Flpmagqi.exe	93
PID 5100 wrote to memory of 4808	5100	Flpmagqi.exe	93
PID 5100 wrote to memory of 4808	5100	Flpmagqi.exe	93
PID 4808 wrote to memory of 3000	4808	Fbjena32.exe	94
PID 4808 wrote to memory of 3000	4808	Fbjena32.exe	94
PID 4808 wrote to memory of 3000	4808	Fbjena32.exe	94
PID 3000 wrote to memory of 3904	3000	Gnqfcbnj.exe	96
PID 3000 wrote to memory of 3904	3000	Gnqfcbnj.exe	96
PID 3000 wrote to memory of 3904	3000	Gnqfcbnj.exe	96
PID 3904 wrote to memory of 452	3904	Gejopl32.exe	97
PID 3904 wrote to memory of 452	3904	Gejopl32.exe	97
PID 3904 wrote to memory of 452	3904	Gejopl32.exe	97
PID 452 wrote to memory of 208	452	Gbnoiqdq.exe	98
PID 452 wrote to memory of 208	452	Gbnoiqdq.exe	98
PID 452 wrote to memory of 208	452	Gbnoiqdq.exe	98
PID 208 wrote to memory of 1888	208	Gmdcfidg.exe	100
PID 208 wrote to memory of 1888	208	Gmdcfidg.exe	100
PID 208 wrote to memory of 1888	208	Gmdcfidg.exe	100
PID 1888 wrote to memory of 4436	1888	Gbalopbn.exe	101
PID 1888 wrote to memory of 4436	1888	Gbalopbn.exe	101
PID 1888 wrote to memory of 4436	1888	Gbalopbn.exe	101
PID 4436 wrote to memory of 868	4436	Gmfplibd.exe	102
PID 4436 wrote to memory of 868	4436	Gmfplibd.exe	102
PID 4436 wrote to memory of 868	4436	Gmfplibd.exe	102
PID 868 wrote to memory of 3524	868	Gbchdp32.exe	103
PID 868 wrote to memory of 3524	868	Gbchdp32.exe	103
PID 868 wrote to memory of 3524	868	Gbchdp32.exe	103
PID 3524 wrote to memory of 5028	3524	Glkmmefl.exe	104
PID 3524 wrote to memory of 5028	3524	Glkmmefl.exe	104
PID 3524 wrote to memory of 5028	3524	Glkmmefl.exe	104
PID 5028 wrote to memory of 3576	5028	Gojiiafp.exe	105
PID 5028 wrote to memory of 3576	5028	Gojiiafp.exe	105
PID 5028 wrote to memory of 3576	5028	Gojiiafp.exe	105
PID 3576 wrote to memory of 1236	3576	Hbhboolf.exe	106
PID 3576 wrote to memory of 1236	3576	Hbhboolf.exe	106
PID 3576 wrote to memory of 1236	3576	Hbhboolf.exe	106
PID 1236 wrote to memory of 3420	1236	Hfcnpn32.exe	107
PID 1236 wrote to memory of 3420	1236	Hfcnpn32.exe	107
PID 1236 wrote to memory of 3420	1236	Hfcnpn32.exe	107
PID 3420 wrote to memory of 1040	3420	Hoobdp32.exe	108

C:\Users\Admin\AppData\Local\Temp\6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe
"C:\Users\Admin\AppData\Local\Temp\6d3520557e0fb8574dac25348cbc20d0302d3920f0867455d274f08d6e904175.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\Efjbcakl.exe
  C:\Windows\system32\Efjbcakl.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\Fneggdhg.exe
    C:\Windows\system32\Fneggdhg.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\Fligqhga.exe
      C:\Windows\system32\Fligqhga.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3576
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        23⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3384
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4796
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4296
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        31⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3456
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        34⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1080
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        39⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        40⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:520
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        42⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3616
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:920
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1612
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1032
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        50⤵
        Executes dropped EXE
        
        PID:888
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        51⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4996
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        53⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4252
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        56⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        57⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5068
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        59⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        60⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        62⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1576
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        66⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        68⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        69⤵
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        70⤵
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        71⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        72⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        74⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        75⤵
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        76⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3028
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        78⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        79⤵
        Modifies registry class
        
        PID:1528
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1676
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        83⤵
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        84⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        88⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        89⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        93⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        95⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        96⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        97⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        98⤵
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        99⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        101⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        102⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        103⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        109⤵
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        111⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        113⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        114⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        115⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        119⤵
        Drops file in System32 directory
        
        PID:5216
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        120⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        121⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5468
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5580
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        124⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        126⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        127⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        129⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        130⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        131⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        137⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        141⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        144⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        147⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        148⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        149⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        150⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        151⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        153⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        154⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        155⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        157⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        158⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        160⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6908
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        162⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        163⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        164⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        166⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        167⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        169⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6448
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        171⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6616
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        173⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6776
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        175⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6920
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        177⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7056
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        179⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        181⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        183⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        185⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        186⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        187⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        188⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        189⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6724
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        191⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        193⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        195⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        196⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        198⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        199⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6440
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        201⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:7236
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        204⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        205⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        206⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        207⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7500
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7548
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        210⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        211⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        213⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        214⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        215⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        216⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7944 -s 420
        219⤵
        Program crash
        
        PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7944 -ip 7944
1⤵
PID:8008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aoioli32.exe

Filesize
240KB

MD5
3aabdab573c01caac562a361116aee4a

SHA1
2037f042909601250223fed60ec4672ebbd1be34

SHA256
69f9cee4b9eac099ccb37416dacf3d0346491b352308dd29d9a89c33c2ac2f1b

SHA512
967b887b28b65b57f26b3591be58a3f9e900315349cabbfa3cfe132b9836f6588f082785a5604b55b9094d8b8592736350b4c8b241508064c8bdfb303a0e1a09

Download Submit
C:\Windows\SysWOW64\Aphnnafb.exe

Filesize
240KB

MD5
eeecee7b221e8ee7fa3a224908d94dfb

SHA1
365371213f9b82204113df6268a5aa0e7360d6f6

SHA256
2e4fb596293bb98e5004c48c99334d4acf285238dd2a454d29194616bc1e0a1d

SHA512
d01c1e2490347546e428fa758acd0eb8eec9fc8ff90d1b4c714e856d3d70f3088e0e2b1a72e65063fdbe3eab5bc0050550c21769a40dc2c0c53033635f1adb94

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
240KB

MD5
8a4fb50b817ea78c1266b1dca44dc297

SHA1
6f96eca26ee43ec460c969584f0137110e1cf6b0

SHA256
fddaa22b0ae7decf9f9389e0342749f6129f8039ea5e90c24cf62ec96cf5ab6d

SHA512
bd8e4541ac8fd859229a83dd4867ca08633d7b314f53a649c05541f9d724283f9db534b56f7cf6c321d7d834fc8b34a8927b08d074d53c28ff0ea8bb93b7f7d8

Download Submit
C:\Windows\SysWOW64\Bhhiemoj.exe

Filesize
240KB

MD5
ce2489484faeed2b6d570cc7c1fffcd5

SHA1
b3306136e62ebd6ddce3e59707eea57e266db55b

SHA256
a3edbc7d60593a99adb52bdeeeef936357d375e9bbad8762a90099934e91c3c1

SHA512
7e5808851cad70a147c4df9335ddea0395ac19a432477f2bc1c2bcc441351236453f681b5507a2066e8318fd2b82c8744a302a9f5f488f89a39e009558cd581f

Download Submit
C:\Windows\SysWOW64\Bpdnjple.exe

Filesize
240KB

MD5
96df7d77bff760eb83f0f55bb59d57f8

SHA1
94285847767ca781c7f6693a37118b0b13800280

SHA256
f2bf96a078583be5464c5c43a44a01f46b8e0ed8c11784008c3edf5f6382f358

SHA512
c0c9e36cc6518c3402fe7bd50521351ab3a37e493c49f32867e5b1814aaa54358e136c84e3f48e86c053fabf84ee4f78e6b29724370be22d7235800f55fb6679

Download Submit
C:\Windows\SysWOW64\Cdbpgl32.exe

Filesize
240KB

MD5
ad38e188a77ccd3476c890a54dc6181c

SHA1
65cfe1e65536b6876cdf5dfe8a9b15d31daf050a

SHA256
ab0672db52a5b3aee3088e6ebe3ccbd42345a344bbf69f76cc5c8c6eddf1cde6

SHA512
aec43a798cb81420f7764c9da73f4f08bd3af05ef75376cddd4d379b4cdba8f427a6a7a594a0a7d5e3221383359e70a7fbf4e816023ea5c19304a6505390af54

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
240KB

MD5
51b72bb2fde9925d748ea17f3761dd0e

SHA1
0b2658a5c16ca2646101044d29a1f1bd0510e4b6

SHA256
6c31a041595de122654d7bbe8a677071d320e1f6b91936bc391a04f61168ce94

SHA512
466808a856ec55fba55eba3f3934b0632619dc18e627d1856b7659e30909736a5675ec6b49fca8e09bb08eb27bd22f5200dec2dfbd54dbae21b67cddd13f4089

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
240KB

MD5
0873b74f18f614e05a937a5ab5a3f936

SHA1
54abff14b6e29075955dd2da382509865bd6551e

SHA256
1ddeae2a1ef4af07c63f35be0283e22b7fbb3b218222cd91471ff98fb9fbd45f

SHA512
5a94860baf0e5c1c481571e541ba7791f2beeead83a0073685e0a699104c442eca5af636800d36b29ec711de1835d458811eb2a093ff3c86eb005d69a73e6395

Download Submit
C:\Windows\SysWOW64\Efjbcakl.exe

Filesize
240KB

MD5
ea129cc0adf5424229c50b38fc2a3ed2

SHA1
08a1155b3c60cb030b11460108fc50be7d482209

SHA256
6c87c615ddb62b671a64a2794c123e10aa348e76b8c2e309120ab160771fffa7

SHA512
3203c86c468a6584c7bfc793d8d86a3c803b7633e4b084d0192dbab55e7ca566b7512669cb979ed5f3e8f0a5200d70c7d6733345e11d838e38adc67c15395da9

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
240KB

MD5
2fbdf9dfa03d6fcbaffc2835f809b4e1

SHA1
fff3da771e7b0c72efe37c8a016f3ace689d6506

SHA256
0fee650c9fa3dc97dedf4c1822c6c7d9fcc43951ae14545daa2de3a12a6a5b6b

SHA512
c73f5081643379430bb50d95387e5b5666630234cba1b2c4097b51b55806028392805f8c65738c586ecef1968fad3471f0f830802ac279e6729861cd9e3110de

Download Submit
C:\Windows\SysWOW64\Fbgihaji.exe

Filesize
240KB

MD5
4e821cc934644557f70ca219eb6b62a4

SHA1
312f44a52f7550f52c9aa9462e3e36306cd6a041

SHA256
1e44a96caac66d92a2c78d15da60756a94695938e18af20a9307f1910a5f2f76

SHA512
88aeec45a008db11842efa59dd92f4ec2e8360937e5eb7345c8fe5f7d82abc2444fb327f4a71f3434e9f45a38afc81c987581cb7b713f0df52ec1f8e40f287d5

Download Submit
C:\Windows\SysWOW64\Fbjena32.exe

Filesize
240KB

MD5
c095cdb930f1c347ff16ff13fe0b30e9

SHA1
cd48f97e8a5c8d3161dce3c65fdbe4de1abda04a

SHA256
8b8e967eff4acbdc67f0213e033dacbde2ab8f70c62badff0f2d06c10d6d34d6

SHA512
84e0fed88c644241d1847dfe928cf038161d26c212937c5470f267765272ebdd9e47d7d84def7648f15223398f80d26cf9e2e19ff498f73a6b3dd7ff89add9b8

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
240KB

MD5
56658334b6ec704e682c9e0abb67d960

SHA1
0e26a7d61b942efed8b2b5aea91bd9edb19f4a93

SHA256
f40b5f4124d3957179a15f0ed23019c668d8202c321a72249a14c5a3f8683bca

SHA512
2349f8d84782b56ddd2272e3570fb1f4ce352b83633923bf0d82148ce31e94c6897293f0d90163b5d6016a84067fdd301d5ebe71fe6bf1bc39da0b61bac80493

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
240KB

MD5
6ede1ce7dbb22e5e93a39fa2144f7b9f

SHA1
69f616ddb713b92f39b11cc22294e9513ffc6f1c

SHA256
6e122688a644200939eb8837cd54dc1e2da95cb48058d0331d603811985acc05

SHA512
020910c9a76302c0cabc57dc7a872cde5b3ad50e04ec58bb381718dc52e2351decf2f1614084dd633145146b03b5516bc90afb36ff6caa409edf54984375d890

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
240KB

MD5
fe01aeda96ca37b5153063f370e2e024

SHA1
7c0308a2be00e43a8f0083b23685fc26a93972ac

SHA256
2f74c93472b551255f92d81bf2289576b2084f85a60fe1ae829b90b964000b89

SHA512
0fbc89b0c317329d66726f149b282585aac6c623e9530c39fe521087667379a1ae0a162935df73f97a1beade240450a3a9b5250374dd2dd5852e0dd81f80d067

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
240KB

MD5
743603b93ebb78bfbed4380bccf90772

SHA1
ee6de1274f5d4e03f82bf2d5bb6e672c3f9c4192

SHA256
b38fa15703c4b0d63b51860612a3c45b8107d403e957afe057b81a08257fb81b

SHA512
688a0efa46e46be2ba6bc790a5461c8b880775a909e463f6d77aa26bbfb2b4d13abe3285fbbc023247396d1d77f7003d02c48b1e6c18e77b8f9dbfe5b5e01545

Download Submit
C:\Windows\SysWOW64\Fngcmcfe.exe

Filesize
240KB

MD5
9967051c5a53e0d2dda65487eafbc22b

SHA1
8be4b7a4194475ff24a8b825718b12ffb97e51c1

SHA256
917da9f0ecdacce44e6b157bfd3e0bbfb90d7a8059c3ef9e5f06b69575134b6a

SHA512
0ce10f179c769cb513214b448f04c3b875d975990040c70513e7c71d9e1a7cd708aa38d7b40d1c4e919bdbd2c60b4b8467d8b3f7ea2b71ef8dc62ed8c93a3130

Download Submit
C:\Windows\SysWOW64\Gbalopbn.exe

Filesize
240KB

MD5
2e044c152c90ef16e36fc43d64b33c68

SHA1
56bb9d81ca26c2bca2eaf211be2954307cec2841

SHA256
91f4fb66b4b6f51c558bf96e801cfc3945c2ade047484a17f80f4c6bca78fbbf

SHA512
fbc73fb51cb4de22e2149094ee82da168dcd2591b52a94ee607f430232aac6503831d809026359bc396b4fa26952f2e9d147716f9b51c6c55e3b27b083892de8

Download Submit
C:\Windows\SysWOW64\Gbchdp32.exe

Filesize
240KB

MD5
15d9b216801cf6679fbcd4644c8a2810

SHA1
064dcd646c4d01147e8c9367653aa60b68360404

SHA256
911349da43c6a72297077260319b6f4b6a056f1c148b5efa816ce730769d451e

SHA512
409eff36879934d9442eec1ebca1abc206ad24268f58d9363fc05622117be9812a86caf09a59d1f8fd4da190efcb0eb0c2c2eb24e5e4f8cd7ae09aaf7883c372

Download Submit
C:\Windows\SysWOW64\Gbnoiqdq.exe

Filesize
240KB

MD5
740d1a6dd7e883062f55546e9349c7d3

SHA1
579f9b6e2032284c760d5b1fe042ce394cff6684

SHA256
84933381dae0b12c86f376b160379a44ffdea1287230c5ef41670d46ee2cc68c

SHA512
4d3f0c726a5d4f8afd2890ab760228b53490734f1fd53fbd5db25ddd9aad48aef256e564cb2f68248b291113e64594d4fd2c5396b3aeb9aef24e71ad2200aab5

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
240KB

MD5
dd5965e9110bd03458bccc44e632a80e

SHA1
705cd482a80c46db16d3b44dfe23df0ae99d5284

SHA256
8d41c0b5bcb9c881456b9eefd6e89ef3271e9cff35b2274f95aead813eb21b0d

SHA512
35e248c790496ec31ebf6c35a754451814e500fcf45496d92e420614502800acbb7c1a23e665772f1524dd3b9455ef6a6d26f76aa3e1421a591dd30e5a688c49

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
240KB

MD5
ea43aa983ebe10da4c0d59401c6bcc38

SHA1
9c0c770ca6ae8f23e305b210461556837fa858de

SHA256
c7975446cfae2a42d7b26fb857ba886b10f240c6ccb5caef7ee75fe83b620dc0

SHA512
692f1682588ddc73e96e51bce32ba7a22b652f8d265901644dc68cb3341e9b8b77c2a519727e8b5ae771640cc92b6c5aa3865f4979c0684158abd531a0f36237

Download Submit
C:\Windows\SysWOW64\Gmdcfidg.exe

Filesize
240KB

MD5
b9efdefcf79aa4a1088a14db9872fa37

SHA1
a42658cd48c20360ccff8d24ad04cc1f0f8ed98a

SHA256
0108b4b74aac45e8894ec331d14f39f038f37082c9b7730f62b60329e2f9c89f

SHA512
2631ff5ad8fd4be1b826ac62b4c1cfefbbd9d06c1d7bd1adfda0a005b887e6a7c29c45022647104d278d7e730b87482e2956d3341bb95603eea67b23fba44cfc

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
240KB

MD5
e21c55bd15b63e78b2c876c7b1369e2e

SHA1
e926715980ddd4288173315da19587c45f63e36a

SHA256
b470a2ab3d829df52ae8caa84b9a15cd1e8d889ada4180906b746b6cfaedbcf5

SHA512
831a0cbe8b3ab18b350c55d0e310b9d7ed7708a9f38ba111d93d977e2501d1b338433487651b5248866e3ebb51b6c2b1f5ea6c6d3a94b72e75a97d0469b3f18a

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
240KB

MD5
1dc4ab61bf418eaa3ed64590f821460c

SHA1
d91701876142d6d128c40b3e3b2c9849cfa73d6f

SHA256
09c847933901ad6094506c09424bf2c3055d89865035b4f51221384b30fc8d66

SHA512
cfa282ea09c81ac4b0f5aec18eda0a3e9316614053565225f527af3e6de85da3121c3b78e4ed4024dfcc79cfe86fd1cb9e9a69d8fe7448247847b6c242555b09

Download Submit
C:\Windows\SysWOW64\Gojiiafp.exe

Filesize
240KB

MD5
b7f83e35b8a7ff3e835746cc841c01f3

SHA1
2a6c0f398e7d5996d6da36e99006da16338121e8

SHA256
66c9a507ecbbe1a309b01e5448448d8dae4e84de46dd187e812413842312d428

SHA512
1cd15adf179d0c36de12993ddff4562222d8dae38208d4dc64f66707f8e400aac3de87452587e43ede4de2459574f398a8b986fb334234988af3bdae73b1b14f

Download Submit
C:\Windows\SysWOW64\Hbhboolf.exe

Filesize
240KB

MD5
12416f134cacd9b0853e1d31cb2f7a2b

SHA1
c3909a7e3a989a9b5fe027fee3afc4e5280833b7

SHA256
5d95e6fc3c7b96f41d0bff776bab7393432b195de61b89c07845893527e6710c

SHA512
31434627a9ab8f799ba9c3ce57fa22e3b7d2f7fd9740c02b2f3fdd35964384d6aaa18e8c4eb9c9c944e5c2a5154f9e1deee02a2af6baf8576fe99ecaf4de3fd4

Download Submit
C:\Windows\SysWOW64\Hblkjo32.exe

Filesize
240KB

MD5
50a65ed155344f63be4e87e1952732bb

SHA1
537748025790c5d192cc2b04003c5b72f022fdf8

SHA256
74fcea063c96a672ed877abc4f6c78f1cffd17e29a7c697ce45dfd17cf939d8b

SHA512
c7fa1f4f7f4fad288b2bc8aa228f737aaef14a80438ba512d7bf2026dcc02228a8e5af975383ac9a0d4f50729d69c23ed76e6a84b2028732a101c14ba3c84727

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
240KB

MD5
e4c184a8c92902065488109a02e595eb

SHA1
b8245035c6b5df4221214b719fe28cae80b370d7

SHA256
08a8a82a85b9d828cce1944e5b7fdcbbf23a5840e048d1128e555825f321d647

SHA512
9f7a85aa697083c38b6a2981da448c657bd0bac29a5c81221f9d0454adcdcfb76f17c47a617903c842ebe2e888a3965a57616f5e450cbbb24d629ac84f5afffd

Download Submit
C:\Windows\SysWOW64\Hfhgkmpj.exe

Filesize
240KB

MD5
19ae079efc3e24bd83a35b329b2fc1c8

SHA1
11e20d1b335599a6a550675c06cff366de65d48f

SHA256
b7f2214355d79e6675802e6222a9a4ccea0fa4cd5dd3fe5e172b227d43a8a01a

SHA512
e82d0583b8fa360916e0a8561b895c74d6b3b2deb5440e79f13710d260f0795ebdbc2d4353102ce58630ae5fc69174d3216b268121303ce4fb57eac0c3e173a7

Download Submit
C:\Windows\SysWOW64\Hidgai32.exe

Filesize
240KB

MD5
c525b37223e1ba8c56ff5869d3780424

SHA1
259ab88febc41c3933e10a629b171928f5f79de2

SHA256
68dff659c66032590c538a9579ec4bcd8a2b81f531425e05ecf6dc1d9e906e74

SHA512
beb9928176dbefd8e7a3a2ea62e3dedb549a7f9bfb3d43a7f992f4e6bcd96a5c68092b595a44937f3167700df14dffa8043baa699c7ab9254ab6e50ac1f6c51b

Download Submit
C:\Windows\SysWOW64\Hlbcnd32.exe

Filesize
240KB

MD5
ff537bbbaf7799633ae2d23f918c10c9

SHA1
be36e49c3fac353d2cf77bda0d10bf1118649ed3

SHA256
3ed5b59d9e947f5a9996d17f48479eedc32d307f0cb09c139d61ac2db6d41852

SHA512
555cf550ad552dd370b0ec1db6796cfc447fcd056a91de514e8a9c40219a065720d3b542392d3ee9798848db030ba02129495e2b34dc48b2dfa652ac5879bf3b

Download Submit
C:\Windows\SysWOW64\Hlglidlo.exe

Filesize
240KB

MD5
e69db772043673dbfb1257a71a622b8c

SHA1
751fb6265911b4e7c0bfda28f1415ddd0a59609f

SHA256
7db274d5fe4c035ab651445f43d8b9b128389dba87ba6f3845b5e604dfd2f9f4

SHA512
3575e2e9a2db4b722d60d50419f579ef15bf6da6cd5ebe4e4f58bca4fe8ba22624ef7f14db32de21f431403077742c1de1ba3ee9aee7d25697e4bbdde663a88c

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
240KB

MD5
1fc276c119b3e74cd5ea6f4cf5520dbb

SHA1
75ff8861deaba508f3f19d4332785eae2e7aeb71

SHA256
928a06f206a5a30a4465cfeaf17a4b4021af4b69fcba9669493895df6d136fbb

SHA512
b312bac393708e61256382b3c9bf529f100314a724d4d99f796b0223a9c3971786c778b74446444aa070830d578c29830f406d322cef483940857e5621852d7c

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
240KB

MD5
de389b7eb253103fda3d76e0a4932ae1

SHA1
37e39ce45897f32f0f4da845bbf196006755e931

SHA256
2380707e0abf5bba6470db265fa4115aa766e164c25ace61eecedeacd0081733

SHA512
c88cba93e734b16b24c11bdf07a377f144b703b7aa10f6888146685d87af8c3b34cfa45b5551694d80c90617db4a69d3c59f73b4ba6f009c46f95d611afac56d

Download Submit
C:\Windows\SysWOW64\Ibcaknbi.exe

Filesize
240KB

MD5
59a93dc87d59ebee1480e5ec94b3d241

SHA1
863a37b6581d3014bd7a87f10f4f625954ab5bee

SHA256
f3bf0a167298912c777c940cf664abaee778f45fb2d7e1e54e143c43e1af116d

SHA512
442a7bbff07d85c0e84898e05acb18bfc221b6e8b5b9962585d557c71d45b4fe185ee95656b1ddddeeba24a23b73bb3a7e7bb229a9f61214d9ff423f9cbd4987

Download Submit
C:\Windows\SysWOW64\Ibfnqmpf.exe

Filesize
240KB

MD5
aa849d69d5ebe966fd0b8d4cf9028dc4

SHA1
052bc5830ce486417a34f7fc855bce5c9f63a0bb

SHA256
3743f9190b2b4c6fe91b15b6e765205a33ae6b3c563684aec3531e730d39c5fe

SHA512
f0bc5af4ba84e15634f217284ff61e5fd44fcbdaecbd4d5c27162ffa73e3d3952f55bf42870728128bb3555769e31ed81deecaa95c521f1f8b09fecaf37f1164

Download Submit
C:\Windows\SysWOW64\Ifmqfm32.exe

Filesize
240KB

MD5
9af73883ceae64e9bedefa315e54c804

SHA1
7257d7fa9037e568ceaf5ee4e690a37f52b32bb4

SHA256
076234e2345397d738e66b4696350f8e65cfe56fa4691700e61eacfe4011c792

SHA512
7878a9101fb879b213ed7cf43065700d68ce653261e058e68325798dcdf0fb0d4d67a9c993ff176fe50af81a720fdbe1d4f6f9d89aa90ecf547f16ae26d0c9ef

Download Submit
C:\Windows\SysWOW64\Ifomll32.exe

Filesize
240KB

MD5
208dfaff615725601413ceb5d24131ea

SHA1
ec66c1b9e8943df7223b21d9d907b30423d486fb

SHA256
39745f7ccaa7a6d5da2393446d5720cd090fee5e0a515909c7db258ec7f054ef

SHA512
d68af78a76dcaf99101ec56c2d7442a7442129d9c6f8ca4b17516cd7cf1ffba256475a3fdb1308c0dba443f2d20fdb01b687cca28846b16060b24845d337c6fc

Download Submit
C:\Windows\SysWOW64\Igajal32.exe

Filesize
240KB

MD5
42a151c58ae0344e25a3a120a996b71b

SHA1
60f2c0c9c4f3e1a422492d2fc89f3c7cf2cbe346

SHA256
28c8236166b13e1f0cc3921e162367269b5a3aaa55cd9aa1e4b0daa0b312b511

SHA512
406e994398fc3925f676ca92fbda68acf27665301b3686f521d3a17c1ac2d42e2f38f6c1ff7eab5a5beae736deefe3fb88da1761ead0d9d89e15426519c5a556

Download Submit
C:\Windows\SysWOW64\Jdblhj32.dll

Filesize
7KB

MD5
ffe4999a771bd51c0c08464ad8ae3590

SHA1
9a989a617fef5507a3e97a51f14026866bde74c5

SHA256
ea23ce4141d23b1f4da6b61f02aa392a7755737f25907d95ed6bef26a0c43edc

SHA512
01609a6cd70f34a7aa4a96e33a4c7d78a9fe297677cf6d15a636342306b3f4c7fbbc53c7abc2061126f46380cdbf44da3c91472883cda78c1513cd1286935280

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
240KB

MD5
3fa40b3ab7116285afa64bc3c585a25f

SHA1
543a2f7520df66746b6511648b94cd73e7d54c19

SHA256
c6aca613c8a415679708a768d94485989ab9c1f33e58fca27bfb40c7d9dfab2a

SHA512
cd67ad534c6ff1e03b4f175edf99883804ed0bd002af7ac76726c1e2466b5b06b1412b25e1d67eea505aff1d4ecd3b00a7fd8a30172598c405ecc305c070f4ab

Download Submit
C:\Windows\SysWOW64\Mcelpggq.exe

Filesize
240KB

MD5
8cc359157ee2a855a460b2dd8f91c593

SHA1
9cea30742b489611eb1415d6f23c24d8bf9b494e

SHA256
cd16b3f9325026f9b18704b24d4ae461559dcd254bdf29081305cfa7e7c88fa1

SHA512
999adc80b5b39cdf14ac45ecc93af6616c6660d68fbdca696157abc86d4f982c0fa93a56e01192a3452aa47a1a9c5f3ac0a21a3616f9fbb2c639a124e1c17039

Download Submit
C:\Windows\SysWOW64\Njjdho32.exe

Filesize
240KB

MD5
b55d229781fdabe76fc11c2c1a97f422

SHA1
4f286132f8a12221dd0ad5034c8e84edcd82d7b6

SHA256
5cbfeea36d2afecb8923f83f07e2235af7453ade47e48f87b3f4868bc3ce6998

SHA512
238daba125e9587901f190c5ea3ad9104584d455881a358296fad39a439dd3099d8a25d3fca5341828ef29219d980f5146c2d9bea190abb3d71eca3e2820a5a7

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
240KB

MD5
db90aa23d21194670b20fbce82eaf089

SHA1
4e92234a90706d76b51410234546732862b8082d

SHA256
8c31cb820baf38bc64f24951d64f734b0939059006a1b08d8073fa4e4b3f7c5e

SHA512
5299be7d78ce306a3950169fc5e113d21942dbbcd26abb2727d88d465051d44cf8e5828f7234a84ba980cbf5490501cb7fe8da39a804a6b4a5ecfa345cfaf142

Download Submit
memory/208-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/408-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/520-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/832-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/868-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/888-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/920-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1032-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1040-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1052-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1080-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1228-547-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1236-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1296-449-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-546-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1468-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1496-567-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1528-527-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1548-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1560-455-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1612-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-540-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1788-389-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-574-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1888-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-485-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2052-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2052-588-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2124-521-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2248-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-581-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2292-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-539-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2492-554-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2516-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2552-467-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3000-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3028-515-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-553-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3236-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3384-204-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3416-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3456-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3524-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3560-479-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3804-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4024-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4120-497-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-560-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4296-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4432-533-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4436-124-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-495-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4564-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-461-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4796-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4800-503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4844-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4896-473-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4952-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4996-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-509-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5092-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5136-561-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5192-568-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5240-575-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5288-582-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5332-589-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/6284-1546-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7456-1520-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7856-1503-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads