berbew | 363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0

Analysis

max time kernel
148s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe
Size 1.1MB
Sample260827-pp53tsvclc
SHA256 363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0
MD5 9a02d825cab6e629430070448dc8bbd5
SHA1 4d1780ca1669845ce0883806a0a4258d9ec651a8
SHA512 629d7be738fa3b202952511f02a26417d39a3ecaee4c07d8bd3078dd01b0f1144f5303f3681140606c4075de5986e530866536cdb6e9beef24d6d2accbe00dfd
SSDEEP 12288:jDvQm05XEvGdXEvG6IveDVqvQ6IvYvc6q:jN6X1dX1q5h3z
TLSH
T105458D378D3AAEB6C23975F4443261BDD1531879E2EA90CC96788FA0DDE6C74C852387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpfbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hicpgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kadpdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likhem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coqncejg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnpphljo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gngeik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbbajjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibjqaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpnjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llqjbhdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbphglbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkjmlaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkmjaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbgeqmjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggfglb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jaajhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jafdcbge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jllhpkfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kifojnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocgbend.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Galoohke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlppno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihibbjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klndfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mohidbkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Momcpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaqhjggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geanfelc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iafkld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iimcma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jadgnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klndfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lindkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Galoohke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehmmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lojmcdgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laiipofp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbgeqmjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoioli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohfbpgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giecfejd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghojbq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhgiim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlikkkhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Johggfha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obgohklm.exe

Executes dropped EXE 64 IoCs

pid	Process
3688	Aaenbd32.exe
3964	Aoioli32.exe
4440	Aggpfkjj.exe
3544	Bhmbqm32.exe
3132	Bkphhgfc.exe
3976	Coqncejg.exe
2524	Cglbhhga.exe
312	Cocjiehd.exe
3732	Dafppp32.exe
2144	Doagjc32.exe
3408	Dbocfo32.exe
1532	Eqgmmk32.exe
3384	Fqeioiam.exe
544	Fkjmlaac.exe
1540	Fofilp32.exe
864	Fkmjaa32.exe
4816	Fohfbpgi.exe
4628	Fbgbnkfm.exe
1968	Feenjgfq.exe
4080	Fiqjke32.exe
4212	Fkofga32.exe
4820	Gnnccl32.exe
4836	Galoohke.exe
4548	Gegkpf32.exe
3644	Ggfglb32.exe
628	Gkaclqkk.exe
1776	Gnpphljo.exe
4960	Ganldgib.exe
832	Giecfejd.exe
1820	Gpolbo32.exe
2636	Gbnhoj32.exe
1292	Gaqhjggp.exe
2400	Gihpkd32.exe
3468	Glfmgp32.exe
2064	Gndick32.exe
3912	Gacepg32.exe
3344	Gijmad32.exe
1692	Glhimp32.exe
2924	Gngeik32.exe
3572	Gbbajjlp.exe
2056	Geanfelc.exe
1752	Ghojbq32.exe
3788	Hpfbcn32.exe
4156	Hbenoi32.exe
2092	Hecjke32.exe
2500	Hhaggp32.exe
4668	Hlmchoan.exe
2132	Hnlodjpa.exe
440	Hajkqfoe.exe
1980	Hiacacpg.exe
3028	Hlppno32.exe
1492	Hnnljj32.exe
4388	Halhfe32.exe
2880	Hicpgc32.exe
1992	Hlblcn32.exe
2392	Hnphoj32.exe
2428	Haodle32.exe
2660	Hifmmb32.exe
3892	Hnbeeiji.exe
4872	Haaaaeim.exe
376	Hihibbjo.exe
1628	Ilfennic.exe
2180	Inebjihf.exe
4544	Iacngdgj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ibgdlg32.exe	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Kakmna32.exe	Kolabf32.exe
File opened for modification	C:\Windows\SysWOW64\Nckkfp32.exe	Nqmojd32.exe
File opened for modification	C:\Windows\SysWOW64\Oikjkc32.exe	Oflmnh32.exe
File opened for modification	C:\Windows\SysWOW64\Fkofga32.exe	Fiqjke32.exe
File opened for modification	C:\Windows\SysWOW64\Jaajhb32.exe	Jocnlg32.exe
File created	C:\Windows\SysWOW64\Mpnmig32.dll	Jafdcbge.exe
File opened for modification	C:\Windows\SysWOW64\Ljbnfleo.exe	Lakfeodm.exe
File created	C:\Windows\SysWOW64\Gebekb32.dll	Galoohke.exe
File created	C:\Windows\SysWOW64\Kpbgeaba.dll	Mohidbkl.exe
File opened for modification	C:\Windows\SysWOW64\Aggpfkjj.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Cidcnbjk.dll	Eqgmmk32.exe
File created	C:\Windows\SysWOW64\Gnobcjlg.dll	Gnpphljo.exe
File created	C:\Windows\SysWOW64\Geanfelc.exe	Gbbajjlp.exe
File created	C:\Windows\SysWOW64\Inmdohhp.dll	Kcmfnd32.exe
File opened for modification	C:\Windows\SysWOW64\Oflmnh32.exe	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Gegkpf32.exe	Galoohke.exe
File created	C:\Windows\SysWOW64\Jocnlg32.exe	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Jaajhb32.exe	Jocnlg32.exe
File opened for modification	C:\Windows\SysWOW64\Kakmna32.exe	Kolabf32.exe
File created	C:\Windows\SysWOW64\Debbff32.dll	Kadpdp32.exe
File created	C:\Windows\SysWOW64\Lafmjp32.exe	Lohqnd32.exe
File created	C:\Windows\SysWOW64\Hodlgn32.dll	Gnnccl32.exe
File opened for modification	C:\Windows\SysWOW64\Mhldbh32.exe	Mfnhfm32.exe
File created	C:\Windows\SysWOW64\Bkfmmb32.dll	Nqmojd32.exe
File created	C:\Windows\SysWOW64\Oikjkc32.exe	Oflmnh32.exe
File created	C:\Windows\SysWOW64\Chbfoaba.dll	Hbenoi32.exe
File opened for modification	C:\Windows\SysWOW64\Jlgoek32.exe	Jihbip32.exe
File created	C:\Windows\SysWOW64\Jahqiaeb.exe	Jojdlfeo.exe
File created	C:\Windows\SysWOW64\Hcoejf32.dll	Mhldbh32.exe
File created	C:\Windows\SysWOW64\Oqmhqapg.exe	Oifppdpd.exe
File created	C:\Windows\SysWOW64\Kihgqfld.dll	Gihpkd32.exe
File created	C:\Windows\SysWOW64\Hkhcdb32.dll	Hlppno32.exe
File created	C:\Windows\SysWOW64\Jimldogg.exe	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Lindkm32.exe	Lafmjp32.exe
File opened for modification	C:\Windows\SysWOW64\Mapppn32.exe	Loacdc32.exe
File opened for modification	C:\Windows\SysWOW64\Mpclce32.exe	Mhldbh32.exe
File created	C:\Windows\SysWOW64\Mohidbkl.exe	Mhoahh32.exe
File created	C:\Windows\SysWOW64\Ghcfpl32.dll	Nfgklkoc.exe
File created	C:\Windows\SysWOW64\Iehmmb32.exe	Ibjqaf32.exe
File opened for modification	C:\Windows\SysWOW64\Mbibfm32.exe	Mokfja32.exe
File created	C:\Windows\SysWOW64\Pfccogfc.exe	Pcegclgp.exe
File created	C:\Windows\SysWOW64\Aaenbd32.exe	363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe
File opened for modification	C:\Windows\SysWOW64\Dbocfo32.exe	Doagjc32.exe
File created	C:\Windows\SysWOW64\Baampdgc.dll	Fofilp32.exe
File opened for modification	C:\Windows\SysWOW64\Gpolbo32.exe	Giecfejd.exe
File opened for modification	C:\Windows\SysWOW64\Hnlodjpa.exe	Hlmchoan.exe
File opened for modification	C:\Windows\SysWOW64\Ipihpkkd.exe	Ihbponja.exe
File created	C:\Windows\SysWOW64\Mleggmck.dll	Lafmjp32.exe
File created	C:\Windows\SysWOW64\Nckkfp32.exe	Nqmojd32.exe
File opened for modification	C:\Windows\SysWOW64\Hicpgc32.exe	Halhfe32.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Bjdjokcd.dll	Kemooo32.exe
File created	C:\Windows\SysWOW64\Mjnnbk32.exe	Mbgeqmjp.exe
File created	C:\Windows\SysWOW64\Mckmcadl.dll	Ojnfihmo.exe
File opened for modification	C:\Windows\SysWOW64\Oifppdpd.exe	Ofgdcipq.exe
File created	C:\Windows\SysWOW64\Ocnabm32.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Gdgfnm32.dll	Joekag32.exe
File created	C:\Windows\SysWOW64\Cgpfqchb.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Hanpdgfl.dll	Kolabf32.exe
File created	C:\Windows\SysWOW64\Ichelm32.dll	Kocgbend.exe
File created	C:\Windows\SysWOW64\Naagioah.dll	Nckkfp32.exe
File opened for modification	C:\Windows\SysWOW64\Noblkqca.exe	Nmcpoedn.exe
File opened for modification	C:\Windows\SysWOW64\Nodiqp32.exe	Nmfmde32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5764	1616	WerFault.exe	303

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paihlpfi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aoioli32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hihibbjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iacngdgj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kplmliko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljdkll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pciqnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Feenjgfq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Geanfelc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kakmna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlmchoan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlikkkhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kidben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kekbjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcegclgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmphaaln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkmjaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khlklj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpaqmgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llnnmhfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llqjbhdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflmnh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pififb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gegkpf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hicpgc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilfennic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iehmmb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaajhb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klekfinp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkphhgfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqgmmk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hiacacpg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hldiinke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ihdldn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kofdhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laiipofp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Padnaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coqncejg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fiqjke32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glhimp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmojd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjmni32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqoefand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hbenoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iahgad32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jahqiaeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lljdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loofnccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcaipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Objkmkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kamjda32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fkjmlaac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhaggp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jaonbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Johggfha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Likhem32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjggal32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggfglb32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaeocdd.dll"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fohfbpgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hodlgn32.dll"	Gnnccl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibjqaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lljdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lllagh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdohflaf.dll"	Llqjbhdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlhego32.dll"	Nmhijd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhnoigkk.dll"	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqjbddpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghnllm32.dll"	Nmcpoedn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqgmmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kafkmp32.dll"	Jihbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgogbi32.dll"	Loofnccf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mledmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahceqce.dll"	Ganldgib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjohgj32.dll"	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lafmjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnkibcle.dll"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfagighf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebekb32.dll"	Galoohke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keoaokpd.dll"	Hihibbjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcndmiqg.dll"	Mapppn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noblkqca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjfbb32.dll"	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajhapb32.dll"	Nhegig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejimf32.dll"	Ocihgnam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kajefoog.dll"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiplgm32.dll"	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jggocdgo.dll"	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiciojhd.dll"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onogcg32.dll"	Kifojnol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Loacdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobmce32.dll"	Fqeioiam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mldjbclh.dll"	Hnphoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnekbm32.dll"	Lomjicei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfkgknc.dll"	Mledmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mokfja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoejj32.dll"	Ofjqihnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndbpeal.dll"	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gndick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghgmioe.dll"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipaooi32.dll"	Dafppp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Galoohke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feenjgfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhaggp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhldbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljch32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3688	3896	363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe	87
PID 3688 wrote to memory of 3964	3688	Aaenbd32.exe	88
PID 3964 wrote to memory of 4440	3964	Aoioli32.exe	89
PID 4440 wrote to memory of 3544	4440	Aggpfkjj.exe	90
PID 3544 wrote to memory of 3132	3544	Bhmbqm32.exe	91
PID 3132 wrote to memory of 3976	3132	Bkphhgfc.exe	92
PID 3976 wrote to memory of 2524	3976	Coqncejg.exe	93
PID 2524 wrote to memory of 312	2524	Cglbhhga.exe	94
PID 312 wrote to memory of 3732	312	Cocjiehd.exe	95
PID 3732 wrote to memory of 2144	3732	Dafppp32.exe	96
PID 2144 wrote to memory of 3408	2144	Doagjc32.exe	97
PID 3408 wrote to memory of 1532	3408	Dbocfo32.exe	98
PID 1532 wrote to memory of 3384	1532	Eqgmmk32.exe	99
PID 3384 wrote to memory of 544	3384	Fqeioiam.exe	100
PID 544 wrote to memory of 1540	544	Fkjmlaac.exe	101
PID 1540 wrote to memory of 864	1540	Fofilp32.exe	102
PID 864 wrote to memory of 4816	864	Fkmjaa32.exe	103
PID 4816 wrote to memory of 4628	4816	Fohfbpgi.exe	104
PID 4628 wrote to memory of 1968	4628	Fbgbnkfm.exe	105
PID 1968 wrote to memory of 4080	1968	Feenjgfq.exe	106
PID 4080 wrote to memory of 4212	4080	Fiqjke32.exe	107
PID 4212 wrote to memory of 4820	4212	Fkofga32.exe	108
PID 4820 wrote to memory of 4836	4820	Gnnccl32.exe	109
PID 4836 wrote to memory of 4548	4836	Galoohke.exe	110
PID 4548 wrote to memory of 3644	4548	Gegkpf32.exe	111
PID 3644 wrote to memory of 628	3644	Ggfglb32.exe	112
PID 628 wrote to memory of 1776	628	Gkaclqkk.exe	113
PID 1776 wrote to memory of 4960	1776	Gnpphljo.exe	114
PID 4960 wrote to memory of 832	4960	Ganldgib.exe	115
PID 832 wrote to memory of 1820	832	Giecfejd.exe	116
PID 1820 wrote to memory of 2636	1820	Gpolbo32.exe	117
PID 2636 wrote to memory of 1292	2636	Gbnhoj32.exe	118
PID 1292 wrote to memory of 2400	1292	Gaqhjggp.exe	119
PID 2400 wrote to memory of 3468	2400	Gihpkd32.exe	120
PID 3468 wrote to memory of 2064	3468	Glfmgp32.exe	121
PID 2064 wrote to memory of 3912	2064	Gndick32.exe	122
PID 3912 wrote to memory of 3344	3912	Gacepg32.exe	123
PID 3344 wrote to memory of 1692	3344	Gijmad32.exe	124
PID 1692 wrote to memory of 2924	1692	Glhimp32.exe	125
PID 2924 wrote to memory of 3572	2924	Gngeik32.exe	126
PID 3572 wrote to memory of 2056	3572	Gbbajjlp.exe	127
PID 2056 wrote to memory of 1752	2056	Geanfelc.exe	128
PID 1752 wrote to memory of 3788	1752	Ghojbq32.exe	129
PID 3788 wrote to memory of 4156	3788	Hpfbcn32.exe	130
PID 4156 wrote to memory of 2092	4156	Hbenoi32.exe	131
PID 2092 wrote to memory of 2500	2092	Hecjke32.exe	132
PID 2500 wrote to memory of 4668	2500	Hhaggp32.exe	133
PID 4668 wrote to memory of 2132	4668	Hlmchoan.exe	134
PID 2132 wrote to memory of 440	2132	Hnlodjpa.exe	135
PID 440 wrote to memory of 1980	440	Hajkqfoe.exe	136
PID 1980 wrote to memory of 3028	1980	Hiacacpg.exe	137
PID 3028 wrote to memory of 1492	3028	Hlppno32.exe	138
PID 1492 wrote to memory of 4388	1492	Hnnljj32.exe	139
PID 4388 wrote to memory of 2880	4388	Halhfe32.exe	140
PID 2880 wrote to memory of 1992	2880	Hicpgc32.exe	141
PID 1992 wrote to memory of 2392	1992	Hlblcn32.exe	142
PID 2392 wrote to memory of 2428	2392	Hnphoj32.exe	143
PID 2428 wrote to memory of 2660	2428	Haodle32.exe	144
PID 3412 wrote to memory of 3892	3412	Hldiinke.exe	146
PID 3892 wrote to memory of 4872	3892	Hnbeeiji.exe	147
PID 4872 wrote to memory of 376	4872	Haaaaeim.exe	148
PID 376 wrote to memory of 1628	376	Hihibbjo.exe	149
PID 1628 wrote to memory of 2180	1628	Ilfennic.exe	150
PID 2180 wrote to memory of 4544	2180	Inebjihf.exe	151

C:\Users\Admin\AppData\Local\Temp\363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe
"C:\Users\Admin\AppData\Local\Temp\363c953cdf6e86e0235b678d231a8a1169a9684220df05fbfcf7f8efbff2f9a0.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\Aaenbd32.exe
  C:\Windows\system32\Aaenbd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\Aoioli32.exe
    C:\Windows\system32\Aoioli32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\SysWOW64\Aggpfkjj.exe
      C:\Windows\system32\Aggpfkjj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
      - C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:832
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        38⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        59⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        60⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        65⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        67⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        68⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        72⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        73⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        75⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        76⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        77⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        78⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        79⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        81⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        85⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        87⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        89⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2212
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        93⤵
        Drops file in System32 directory
        
        PID:1916
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3748
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3312
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3048
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2672
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2416
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        101⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        102⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        103⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        106⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        107⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        108⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        109⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        110⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        111⤵
        System Location Discovery: System Language Discovery
        
        PID:6236
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        112⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        116⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        120⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6796
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        126⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        127⤵
        Drops file in System32 directory
        
        PID:6876
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        130⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7076
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7156
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        135⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        137⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6108
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        139⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        140⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        142⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4772
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        144⤵
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        146⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        147⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        148⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        149⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        150⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        151⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        152⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2216
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        156⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        157⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        158⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        159⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        160⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        161⤵
        Modifies registry class
        
        PID:6860
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        163⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        164⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        165⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        166⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        167⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4552
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        171⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        172⤵
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        173⤵
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        174⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:364
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        176⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        177⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        178⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        179⤵
        Modifies registry class
        
        PID:4220
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        180⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        181⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        183⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        184⤵
        System Location Discovery: System Language Discovery
        
        PID:6844
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        185⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        186⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        187⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        188⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        189⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        191⤵
        Drops file in System32 directory
        
        PID:7380
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        192⤵
        System Location Discovery: System Language Discovery
        
        PID:7416
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        193⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        194⤵
        Modifies registry class
        
        PID:7500
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        195⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        196⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        198⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        199⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        200⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        201⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        202⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        203⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        204⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        205⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        206⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        207⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        208⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        209⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:8100
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        210⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        211⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2440
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        214⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        215⤵
        System Location Discovery: System Language Discovery
        
        PID:1228
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        216⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        217⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:1616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 400
        219⤵
        Program crash
        
        PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1616 -ip 1616
1⤵
PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaenbd32.exe

Path C:\Windows\SysWOW64\Aaenbd32.exe
Size 1.1MB
SHA256 3c056a2431906f737f2ef7ebdf73fdd31889b2000b331503bfcdb0609b909668
MD5 d3fb26c8aa72defb83f0472d13189ace
SHA1 50af0df0f46b7cd91243c3550560f4ddd253c422
SHA512 b8db81103cd2de50d6d7da5e0986a8c03c0c5bb58726e547dca183b85496f021598b11199b107e995a3a7fd0fbbd77dd8e4ecfd9b7df40144e79abdfebb7d79c
SSDEEP 12288:JlP7v3m05XEvGdXEvG6IveDVqvQ6IvYvc6q:ba6X1dX1q5h3z
TLSH
T186456B978D7AAEF6C13975F44072413DD9831879E2EB81CA963C8ED0DDEADB4C092643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aggpfkjj.exe

Path C:\Windows\SysWOW64\Aggpfkjj.exe
Size 1.1MB
SHA256 b4557a13075964be192558a400fbacfe6d5a75c4ee3775f96fcb18eb372a4677
MD5 da8000b2ad596a1559b428f35f80a0db
SHA1 3df9d7033efd0b9edf5c0287e90170e01ec8eeaa
SHA512 0d5606d42183f270fdd8435b8ab53bb137be8b0c69433be038dc7589016391bd08e851985431babe205d03bc2ae54be240f7d4770667aa1fe0793c9d195e2c82
SSDEEP 12288:DGsEmG7vrm05XEvGdXEvG6IveDVqvQ6IvYvc6q:CsERu6X1dX1q5h3z
TLSH
T1DB456B168DB7AEB6E13935F44033413DD18718F9F2E6518DA6388E90EDE6DB0DC92287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aoioli32.exe

Path C:\Windows\SysWOW64\Aoioli32.exe
Size 1.1MB
SHA256 a19d444e2763cc2b18bb91b2ed844f1a274938d966243fad1dd6512be62ad49e
MD5 3babc1a7bff952de72a633c4d309ef14
SHA1 6afe06ee6ea5587479a3bc0ad16d931c4ccfb9e9
SHA512 6fbf96564fa53b87700d26c507f2db1943a4f987387b386d4abaad37944d14e0a2f4f2fb6f8d0efbdae9f490e0025c017d61a92aed7a72cd760d78c9c84a9acb
SSDEEP 12288:z86pQjfvhm05XEvGdXEvG6IveDVqvQ6IvYvc6q:R6X1dX1q5h3z
TLSH
T126456B168D366EB6D23935F44032813DD18718BEE6E651ED97288FE0EEE6DF4C092247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bhmbqm32.exe

Path C:\Windows\SysWOW64\Bhmbqm32.exe
Size 1.1MB
SHA256 b559bc5b58c01c6f37d11fb8fd5fc530b54dfed5f25b5c5f1841337f4e33a980
MD5 aeafa5bd3e0b5d7468de26f10204eb4d
SHA1 d6e8126a363c6ebeb0c35c0f7f289c30ab8caa08
SHA512 f65edb81308ea82fdd9ab5e1e9a0f9484338786a2675262bbcfed8e4f1423cf516e5a016e6e2048cbc91a8dffac0a0653c09abd1b90fb1f52b36f0267bb630c6
SSDEEP 12288:ytvMm05XEvGdXEvG6IveDVqvQ6IvYvc6q:yH6X1dX1q5h3z
TLSH
T11E457B178D35EEB6D27437F19432013ED1CB1879E2E69589D6388E90EDE6EB4C093287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bkphhgfc.exe

Path C:\Windows\SysWOW64\Bkphhgfc.exe
Size 1.1MB
SHA256 9bc5dde65d906ba0979d3fd9cb4f9899b098f0c11985773aa21658eb8ef9a353
MD5 2bdc451bd96d6c877af7029ad1f51f29
SHA1 ed00d3c4a4f21d811d6eb9c185ca5aa130d34036
SHA512 bbae4b8d096f4709c57c33f8fd1e002f09c520a3cd815327969c9de3e8178cc1121a503f3e72e91822bd3be35e69ed91f25f490d70742b970b478cd02712dae3
SSDEEP 12288:mLvpm05XEvGdXEvG6IveDVqvQ6IvYvc6q:76X1dX1q5h3z
TLSH
T1D6456B1A8D36AEB6C13935F44472493DD14B1CF9E6E6A28D96388F90FDE6DB0C052387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cglbhhga.exe

Path C:\Windows\SysWOW64\Cglbhhga.exe
Size 1.1MB
SHA256 33742f1a54eea66d085d90592f1764a2af1f41062aea38950b522e0cc4adc05d
MD5 859df619d0397bca2d4f4bc42aaef7cb
SHA1 6347a15fcf36d29c18fd34cfd445f7fe1553525e
SHA512 436ce97aa683fabb8740887a764959e343edd1b9c13620390b21bde11691d2f69125e608b72a4d17c2f0693777368609efae440956fcc72e41913efd3c25120f
SSDEEP 12288:ULTv8m05XEvGdXEvG6IveDVqvQ6IvYvc6q:ULx6X1dX1q5h3z
TLSH
T18D455A168E36AEF6C23935F44072413DD68718F5EBE7908997388E90DDFADB4C092A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cocjiehd.exe

Path C:\Windows\SysWOW64\Cocjiehd.exe
Size 1.1MB
SHA256 0b4486b92eb5da2dbfbbbe28fd58d8594f13b97f9747448cd85d1873139dcaf7
MD5 7d982446b89dc0f9ff2f102bf6878d2f
SHA1 94fda263cf3acd215e97876b172a8b09b6c03912
SHA512 21a0d13ed88b57b32d3d2ebd873fdf03327855f16db30dd48951e359d9fe10f8afb83cc22505cda4fc475ac95be07765426e2536f8b98ec35b2bb0fbbd3ca07b
SSDEEP 12288:3aB/byMMXzmv5m05XEvGdXEvG6IveDVqvQ6IvYvc6q:3aB/uMMXz36X1dX1q5h3z
TLSH
T13A457B178E37BEF6D23835F4447241BDD18718BDE6E6908D96388E90EEEADB0C052647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Coqncejg.exe

Path C:\Windows\SysWOW64\Coqncejg.exe
Size 1.1MB
SHA256 c6f8129813989276867b236b1606d32d0663b82e0dbeb119967fe69abd97fa2a
MD5 945c26108eb58716ddbc3ac3ce534f7c
SHA1 7427bb1e07388ede2ea8eab38b6cec962fb74ab2
SHA512 8f79abe15511085ba9961317445a4c111bbed29697b8ab15b7302fd23057708914e385c8047a772716e91fb2f069318df381382722ffd7d597cf93bceb0accc9
SSDEEP 12288:2JNvDm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Ok6X1dX1q5h3z
TLSH
T1DF457C178E36AEB6D13935F24473413DD1831979F6EA80CD96388E9CEEE6DB1C092247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dafppp32.exe

Path C:\Windows\SysWOW64\Dafppp32.exe
Size 1.1MB
SHA256 54bbdd3f10cbb7c4701b48e8b7d4f149767c64ef5530e5abf91c5f206d6a76fc
MD5 4e96b3569e6ae6155f2432b732f30f98
SHA1 f2fc5bfa4f6ef6fcd2c8496c80970f27f7741daf
SHA512 46e80f307a47db122bb2defa693ac6a0499aca4657fb18e00130daf630aeb7fb4ae0723fe1b067162b8678156933cb92c5594f0e1638bb264e94962270b028b0
SSDEEP 12288:o133yvfm05XEvGdXEvG6IveDVqvQ6IvYvc6q:4t6X1dX1q5h3z
TLSH
T105457C17CE359DB6D13A35F2C032413DE183187BE2E650899A78AE90FDE6DF4C852663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dbocfo32.exe

Path C:\Windows\SysWOW64\Dbocfo32.exe
Size 1.1MB
SHA256 77193d6d3fb6424b8430d21deb610be8da1f017227085f270e300fda86134d83
MD5 b6e1f47f3508abe10f7515e2081457a7
SHA1 9eb3c71a0e768200e7ab0d2a772009ef507bc3cb
SHA512 ddf0b521be96595d8e7ac4c8dbcf57a8dd4b5d6ad16c879a3a9efdd06e16a4baf640f2b49836a489417031bef2dd100541597746eaedb5f7d6a304b4ecd79d9f
SSDEEP 12288:2tvhm05XEvGdXEvG6IveDVqvQ6IvYvc6q:96X1dX1q5h3z
TLSH
T1FB457B1A8DB6ADF6C13839F44432413DD1831CF9EAEA51CD96388E90DDEEDB6D092643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Doagjc32.exe

Path C:\Windows\SysWOW64\Doagjc32.exe
Size 1.1MB
SHA256 cb9bf169cbf9ff4e444b35538170ac7774416b76541fd66d4471a0dedf901cda
MD5 0cc3c163a11a3e44b030f150d7c7a605
SHA1 53beedc51fc2ec2cc1f5da17dac806e99bfb33f9
SHA512 2e3425d10f56ee701f46fa58c2c2698873770fd7a184990f57ccf9c9f5c9dbab6c150242424f9601530a44937b5af63be8d6e9d90f8931eef1273b8534ff4f3a
SSDEEP 24576:HbTqiiPiiLiiPiiPiidiidiidii9Fiiiiiiiiiikyiiziiiiii9B6X1dX1q5h3z:HS67K
TLSH
T16D457C2A8D367EB6C13937F44432013DE18318F9E6E655E9A678CE90DEF6DB0C092647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eqgmmk32.exe

Path C:\Windows\SysWOW64\Eqgmmk32.exe
Size 1.1MB
SHA256 8baddc2ca3febe1c64ee3ee3b7935da11f2b59d7c2f05577548b8133fab5b315
MD5 a54003a3012a6aa09b80ab39c9e604b0
SHA1 449c1e0807f671e72ab0125ba6b0ff4461bd1dad
SHA512 415d7abc0d2b661c8231ac473f8702f42ebd1de785b1f4214ffe783811743ef4828174107bdfec8101efaead4e73bdd42e12a72cbc283313252bd8afa2e7036d
SSDEEP 12288:r+TWvmm05XEvGdXEvG6IveDVqvQ6IvYvc6q:r+TU6X1dX1q5h3z
TLSH
T16A456A168D76DEB6CA3835F4443A413CD19718BDF2E680AD96388E90DEE6DF4C392247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fbgbnkfm.exe

Path C:\Windows\SysWOW64\Fbgbnkfm.exe
Size 1.1MB
SHA256 6ffc0ad43dfc6237fd8a422d5df110ca1bccf548703913c1c683606c30ddbf52
MD5 0fb52655969e33f0cc50a8f12b5c3d96
SHA1 670c955d3805ed897e04cfdd0e2295c3f9b3ca5e
SHA512 4602a4a43b8f959d3be7e526bbb0c758fb2fdfcd3d189c4a731dc74c155ddcd44a22d5528c9935a52c0d70f3ce17402fab7929975036560807023327d0e313f8
SSDEEP 12288:MgQivCm05XEvGdXEvG6IveDVqvQ6IvYvc6q:MgB6X1dX1q5h3z
TLSH
T1A4457C178D769EF7D93935F44432413DD147187AE2EA808E9638CE90EEEADB0C093667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Feenjgfq.exe

Path C:\Windows\SysWOW64\Feenjgfq.exe
Size 1.1MB
SHA256 1bbd97b2d66c960b502c60d54ec66a6c1c3c800ba35ff14412b7f037a49ed011
MD5 0132fbf6e3affe8c0a76d2c52dfabb94
SHA1 95cd6a3e3642ec55e518429750cb049b31da7c3e
SHA512 c851cef6d65a0c92ddc66fc7ecd64160a51b0647fb10ccfd389a99aa67f418ae2ae9a402f2a6d99d94f33a098c7df15420eb0189943666a5a551712869248657
SSDEEP 12288:SMFLgvcm05XEvGdXEvG6IveDVqvQ6IvYvc6q:SMFLk6X1dX1q5h3z
TLSH
T1EB458C178D37AFB6C13935F0447A413DE1839879E2E692CD96398E92DEE7CB4C092247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fiqjke32.exe

Path C:\Windows\SysWOW64\Fiqjke32.exe
Size 1.1MB
SHA256 8734fddd501b96bee8e3ee18b6545308d5e6ce520f05f4757738c896ac02446f
MD5 5fe1b5ffbc545b399bd3b6abd315ac95
SHA1 afec63c29d002f24edf9e5bcd4a92470183d2733
SHA512 496653737beaaa07f845240f23c316d653c61fe1ea01e45d9fd129492447b914f206297b49146870a8cb40d0c24e8dee937fcdaf811d76629dced044d632c75a
SSDEEP 12288:vQi/vIm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Jh6X1dX1q5h3z
TLSH
T1B6457C178D359EBAC23D35F08472413DD1832879E6EA718D96388E90DEF6DB4C1A26C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkjmlaac.exe

Path C:\Windows\SysWOW64\Fkjmlaac.exe
Size 1.1MB
SHA256 1f01674172ec451526fa479926b2f7ecdadfd830c38e8f2c3546dfdd4e0101ec
MD5 636907a07001ddba7603481e154006cf
SHA1 f1cdd40341bbd92fa7f4179c754959b14c6682d8
SHA512 02a40cc443e30565daafed7295bf064188e3f99a36147c1f4c607ce57c24ef505c8b1ff8917e130c07dca6f031cf4ba7429e8c5750b3ae03c6ff57e1ae86bea4
SSDEEP 12288:Stkuvvvm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Stk36X1dX1q5h3z
TLSH
T17D457B278E36BDB6D13935F04432413DD1A75879E6EA5189A6388E90DEFEDB0C0923C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkmjaa32.exe

Path C:\Windows\SysWOW64\Fkmjaa32.exe
Size 1.1MB
SHA256 9d4bf18230a18538dc28e434ec6ae8aac649e58a1481a455db4d92ee0f93789b
MD5 2f07f292b4d83149edaf9b764b4ff0c9
SHA1 6e4203cddddbf289c70cee97f9bdf84ac9e8ecc3
SHA512 600ddb438c811b41e47074bfc288c7d54cecfdc129798dfeb310d3d47a38ef767a7fbe36c4485c00fba25bfb79ec841acff29ee3b85434ab6ee76c27db8e4807
SSDEEP 12288:yp8B+vpm05XEvGdXEvG6IveDVqvQ6IvYvc6q:g8BD6X1dX1q5h3z
TLSH
T1B3457C1A8DB79EB6C1B435F08436213DD1431879E2FA41CCA7B48E91DEEAEB4C062747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkofga32.exe

Path C:\Windows\SysWOW64\Fkofga32.exe
Size 1.1MB
SHA256 d3cce7eb0613ed39d71ddf5127d0354684b2b86e9462be13066ed50d35107058
MD5 17c1b061d1f4e3ab5ddf9409e1b1fb6b
SHA1 77a1aac24d4e2832b2f926038c7612da74dbe566
SHA512 1cb41cd1a0d2a67623a8065564b353a96e541ddeee1928e1dd36d446ff8c93f490d062fe881df4a54b67883da3ec975179c1bda3542fb1dfdb81c7080cc870fc
SSDEEP 12288:0javmm05XEvGdXEvG6IveDVqvQ6IvYvc6q:p6X1dX1q5h3z
TLSH
T1BF456B168D36AEFAE13C35F44032413DD24B1879E2F6518D9638AED4EEE6DB0D093687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fofilp32.exe

Path C:\Windows\SysWOW64\Fofilp32.exe
Size 1.1MB
SHA256 073f3b4c43a17efa005074b179e1ac2ee4100e84914230a5f532ef1b852f2d5b
MD5 8558e68a6b98f4b19e8fd6c575770300
SHA1 39bbb42bfb159288dd477c6ab67e3e29314fb5b9
SHA512 9d360976ed14da83d5bc7c46aebecc72eda2aac7d3a49d929af379b315d76862230a8ec0e6a1bfbf016a30c55846b970a658bed5a11b1cda45631ed6f4c021be
SSDEEP 12288:AhBRypvmm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Acd6X1dX1q5h3z
TLSH
T178456A178D37AEB7C33935F44432813DE1431979E6E6D18C9628CE90EEE6DB4C09A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fohfbpgi.exe

Path C:\Windows\SysWOW64\Fohfbpgi.exe
Size 1.1MB
SHA256 8dddc4bd9610b143eff91e4bf8d851cb04ee66107cb14bf69cf84522457500dd
MD5 dcb475f3e07c6f818464a9d9dda163f7
SHA1 c0d63cd0f1ce53226ccd2d9569db46781ad6b3d4
SHA512 aea77188425e79db718afac8edb0cb52d6ed394d0ba38bb7f380c8bcc26ee9322d56b94a153dad76a596682c09adf760b3b87d24d2c8b7c34958991772d2b3f8
SSDEEP 12288:E1DZv0m05XEvGdXEvG6IveDVqvQ6IvYvc6q:EV6X1dX1q5h3z
TLSH
T13F456A169D379EB6D13935F44872413DE1C318BDE2E6908D96388EA0EEE7DB8C0526C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fqeioiam.exe

Path C:\Windows\SysWOW64\Fqeioiam.exe
Size 1.1MB
SHA256 c5ac2038d52c5f562e7ef685c5ce26f42b37055bee7e65bbf3cd41fa0d2bc3a2
MD5 59fc685bcf775a6de93197f335f96863
SHA1 dac5a2e78167fbc4b992095a6bed330ac4468cad
SHA512 ab347213c7f6ebf6c76ebf69634980c0b14e80da54354c54791befa3cb7b989694ddabfdb567ae69759f7d25560ca903a3e65eca62944a4fc8f6399d75251b6a
SSDEEP 12288:JVh4xvZm05XEvGdXEvG6IveDVqvQ6IvYvc6q:au6X1dX1q5h3z
TLSH
T15D456B1A8E3A5EF7C1B935F44832893DE1871875E6E690CD963C8E90FDE6DB4C092247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Galoohke.exe

Path C:\Windows\SysWOW64\Galoohke.exe
Size 1.1MB
SHA256 7e1b3c01beb6c607033935e89f26eb4f712d86465341b3eaab4d4b3d785214f7
MD5 e22da7d2a63aaea80f96d0a8b3f1e7d8
SHA1 29aefe14e1b3fcc1a5f60d5d4ed04112adb2f662
SHA512 00c18281e2aa9a1b6cfc10726a56f3377a49f427d4374ea603afa444bde0fbc9464ea2f513e86e5e39a95f5018879d91468d430ca6cfd181bd17e164e20644cb
SSDEEP 12288:7W8zvEm05XEvGdXEvG6IveDVqvQ6IvYvc6q:7WM6X1dX1q5h3z
TLSH
T1FE457B178D36ADB6C13A36F44072413DD18318B5E6EAD1CD9A388E90EEE7DB5C0A3647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ganldgib.exe

Path C:\Windows\SysWOW64\Ganldgib.exe
Size 1.1MB
SHA256 04e6d38c3ac189ea3cbd779f3131da2dbc648d329b4c65e6f262fe649a289926
MD5 29574bc199e363def3de15edb542ece9
SHA1 a7f653a06538f76b2a33e565e133eb2dc5335277
SHA512 0403fc85e5e0f64cd1d9d9bf02f3e389ed8819f6e52aeebd878c4ee875e936bccb32af2bd8dd9c2b42f8605e1b3deb6be78cf0048befd0502b8c3a84ca936263
SSDEEP 12288:vfVPvqm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Xx6X1dX1q5h3z
TLSH
T1C7456B1B8DBD6DB6C13A35F44032413DD34319BAEAE660CD9A788E90DFEADB4D052247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gaqhjggp.exe

Path C:\Windows\SysWOW64\Gaqhjggp.exe
Size 1.1MB
SHA256 5efbf4eb471f01cc80135c87920936402b68e564941d97fd4c18f1feb0b6b5cb
MD5 f0c7034d29ff0818be192bd56aeb0a5a
SHA1 d173f41cdb260557eacf56c722917144bb09809f
SHA512 7f2d769425564e4f5264513abb3cc8356a0d77b7006e956d62d2a78078392877a11647dae8ecd28c8eca9e4c6638a61ca958477711b9ee88e2b52da793bbc9ed
SSDEEP 12288:oddvSm05XEvGdXEvG6IveDVqvQ6IvYvc6q:Y6X1dX1q5h3z
TLSH
T117458D16CD35AEB6C13835F44832413DD18718B9F6E641ED96388E98EDE6DF8C0A364B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbnhoj32.exe

Path C:\Windows\SysWOW64\Gbnhoj32.exe
Size 1.1MB
SHA256 542eb7e47784a4e38930f3eb254db275472bd21a21f2c551e62d9427523c4144
MD5 db4cce267df46710c48a0f92efd2e957
SHA1 01aafab6b71cabfa104fb45b5aff8ed346c5faca
SHA512 a4a4f51493e8ca47c2dee792de2690f447c1b6901d96298a88793f5bba21437b372c4d4c8b4c5039372f05be353f0bc4158db7cd561c3131c7f312d4ca9b9015
SSDEEP 12288:15Cv4m05XEvGdXEvG6IveDVqvQ6IvYvc6q:366X1dX1q5h3z
TLSH
T173457C178D36AEB6E13A35F44433013DD24398B9E6EE518D96388E90DEFACF4C162257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gegkpf32.exe

Path C:\Windows\SysWOW64\Gegkpf32.exe
Size 1.1MB
SHA256 7b434860287e4ffab7cb7424c0550838115950ea6ed5cdb8761ed1cf6ec48a50
MD5 80aa79864b79be31ba151f0c9ce6b253
SHA1 ed2834cc58a84314ebe7a898cae133b65053752f
SHA512 b82cf67174dfebd3236505141e66aeb7c4bf88e7c1b55fd38af65cc583e3f1b926fb3dce77ad3467e00f8405d4c54a3edf4e680199acbad634d16c381d1ed186
SSDEEP 12288:PGw7Zvqm05XEvGdXEvG6IveDVqvQ6IvYvc6q:97d6X1dX1q5h3z
TLSH
T10445591ACE76DEB6D23935F44473413DD2831875E2E6908D9638AFA0EEF6DB0C092647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ggfglb32.exe

Path C:\Windows\SysWOW64\Ggfglb32.exe
Size 1.1MB
SHA256 c9aeffa09013e325823cb975a208869ab64b9817c74f0b1b5373f54728b4cec9
MD5 1d79abfa5ee9ff1a4e6346334b1cd533
SHA1 941c22c5257f6a4461d8cb81f33d6ee881795710
SHA512 e5fdf7ccf78bdd24400c3321b50dace786c5c5908e40ea4c23f89c704f168126e65d2edfcff0e1492bd91d7bf12051be14833ea4a560929abc43deb1c08bf1a5
SSDEEP 12288:9TvJm05XEvGdXEvG6IveDVqvQ6IvYvc6q:9M6X1dX1q5h3z
TLSH
T1E5456B968D75ADBBC23C35F48473413DD1831876E6EAD08DD6788E90EEE6DB1C06224B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Giecfejd.exe

Path C:\Windows\SysWOW64\Giecfejd.exe
Size 1.1MB
SHA256 882521c78ae51bd248e604a140b6332bb1b7d60214e1bab963949305a16b5c34
MD5 95f42b912aa7f720124c1f6623fb49b5
SHA1 1ab97b99b900acc93880d8748ca75c331f067d6f
SHA512 bf5693bf8fe62172f38e51bc5f834e37694404c4446006129b5ad8b0c4da20a8b92a7816cd9feb41909860e699e3b1804f6199c57716579c2de6b0a48ed29160
SSDEEP 12288:J3PvNm05XEvGdXEvG6IveDVqvQ6IvYvc6q:J306X1dX1q5h3z
TLSH
T1F7458C1B8D36AEB6D23935F44473413DE14318BAE2EE51CC96388E90EEE6DB4C592347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gkaclqkk.exe

Path C:\Windows\SysWOW64\Gkaclqkk.exe
Size 1.1MB
SHA256 da91de70b4aa7c83a300c08dab15a80d0056bff5ea080c45e759f9a555ac164c
MD5 38e196c65f25d7dfc7bd24b7edc1162c
SHA1 57ebf4877ceed9aab4394d22c980430532a57401
SHA512 5231ddb9cf97d54868337b58943354c9ece11df5a5b8e1f6be217858a1955d95a287d247c411da36701559401734797cb72254f23745487ae068b78eba8c70fa
SSDEEP 12288:LtPvZm05XEvGdXEvG6IveDVqvQ6IvYvc6q:LtY6X1dX1q5h3z
TLSH
T15F456B16CD359EB6C1B935F44832613DE24318F9E6EA418D9A788E90EFF6DB0C052A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gnnccl32.exe

Path C:\Windows\SysWOW64\Gnnccl32.exe
Size 1.1MB
SHA256 be7601e61ef830391e1868b91d1aa6fc34050c7b152a0042a66ff0e585c89466
MD5 0a1b50fa3b2ce327f0038efa680007fe
SHA1 28380fe984b3d79377d83e3c69213e435e73c050
SHA512 44957756f838098ff1e9f12283f226fc355029d8ff0954a3a7d3ff5d0088ba3005c25632549f4bcddbf8359c2b3a8b8107b7de115572a2a2e769690e2904f24d
SSDEEP 12288:vbItv6m05XEvGdXEvG6IveDVqvQ6IvYvc6q:vbIJ6X1dX1q5h3z
TLSH
T1A9458C278D367DB6C23835F85432413DD18B2879E6EAD5CD96388E90DEF6CB0D292247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gnpphljo.exe

Path C:\Windows\SysWOW64\Gnpphljo.exe
Size 1.1MB
SHA256 e48f40f1cbe595d038b3a97f1b54ad32380d9b00b0a9da20817c31c556f94d3c
MD5 5b9f028bf1728c572c2a6b429c6aae24
SHA1 d221583b7cc9b415be7b9262ed7ff2e6e78f226c
SHA512 517a7b662de273d60e0a7d8ff1b433f2cfef3f8cfed54b6b3db5de5dd733b8222b0f05e8d0a0f859b1eb36301520deff75a6149cae59a084958861e0076b0691
SSDEEP 12288:ORWhvOm05XEvGdXEvG6IveDVqvQ6IvYvc6q:J6X1dX1q5h3z
TLSH
T17B458DA78D3D9EB6C93835F44072413DD15719B9E6EA90CC96388ED0DEE7DB4C0A2A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gpolbo32.exe

Path C:\Windows\SysWOW64\Gpolbo32.exe
Size 1.1MB
SHA256 7302a656b7c0d8ef9aa89b74ed686879d7e28f73dceff648138d9c8f267d74d8
MD5 33394e5cdb201615eb970f086c92a4a5
SHA1 5209aa4335be655dd40141c6c2d2c9c2a96b011f
SHA512 86b840cf73393d3f66e0fa7d1d54683623869a11d46ac12926efee51f51a11a9bf18028bf40e0f6678893773ff063305a5b234b932fb660a636a7ba6ef92be36
SSDEEP 12288:BLWnvIm05XEvGdXEvG6IveDVqvQ6IvYvc6q:9M6X1dX1q5h3z
TLSH
T19E456B268D35ADB6C23D35F444724A3DE143187AE6E691CDD6388E98EDE6DF0C0E2247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-69-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/376-437-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/440-364-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/544-117-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/628-214-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/832-238-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/864-133-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1292-262-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1492-382-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1532-96-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1540-121-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1628-443-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1692-298-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1752-322-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1776-222-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1820-246-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1968-158-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1980-370-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1992-400-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2056-316-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2064-280-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2092-340-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2132-358-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2144-85-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2180-449-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2392-406-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2400-268-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2428-412-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2500-346-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2524-61-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2636-254-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2660-413-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2880-394-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/2924-304-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3028-376-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3132-40-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3132-580-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3344-292-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3384-105-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3408-94-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3412-419-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3468-274-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3544-573-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3544-32-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3572-310-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3644-206-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3688-8-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3688-547-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3732-73-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3788-328-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3892-425-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3896-538-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3896-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3896-1-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/3912-286-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3964-17-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3964-559-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3976-48-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/3976-587-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4080-166-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4156-334-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4212-174-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4388-388-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4440-566-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4440-25-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4544-455-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4548-198-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4628-150-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4668-352-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4816-142-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4820-182-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4836-190-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4872-431-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4960-230-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5132-461-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5172-467-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5212-473-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5252-479-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5292-485-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5332-491-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5372-497-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5412-503-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5452-509-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5492-515-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5532-521-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5572-527-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5612-533-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5652-540-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5696-546-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5736-553-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5780-560-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5820-567-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5864-574-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5908-581-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5952-588-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5996-594-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads