berbew | 3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe
Size 411KB
Sample260827-vexatsycnf
SHA256 3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a
MD5 19cc5f37fce654a0ae420b7eca98c546
SHA1 a870434d35b5319b358765d76dacdf6e7e3c4fe7
SHA512 1b744c0d5f0e5e397610703a3f201c9b2f3e11720c13aa705fca15eb7d4c57496ce484c77ae91d0ecbf29f6053a5e94df9e0c2c533c8deaac0a7f6c13342d7e6
SSDEEP 6144:6LpH9bPXPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:6Lp12/NcZ7/NC64tm6
TLSH
T1C19493F78DA26F9FD41FE274C577CAE2519AD06F48A6F14A26306CD2696E0813CE0D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpdgqmnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnhgjaml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgeenfog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dafppp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oanokhdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caojpaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogcnmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcgcqab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfkqjmdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apodoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogddd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdgnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohlqcagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phonha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojajin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmfimga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akkffkhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nagiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onmfimga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmjkic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmjkic32.exe

Executes dropped EXE 64 IoCs

pid	Process
432	Mjcngpjh.exe
4104	Nfjola32.exe
2408	Njhgbp32.exe
3952	Nncccnol.exe
2032	Nmfcok32.exe
3512	Nqbpojnp.exe
1136	Npepkf32.exe
640	Nglhld32.exe
3176	Nfohgqlg.exe
3876	Njjdho32.exe
2244	Nnfpinmi.exe
3720	Nmipdk32.exe
3304	Nadleilm.exe
4668	Ncchae32.exe
4348	Ngndaccj.exe
4024	Njmqnobn.exe
3620	Nnhmnn32.exe
4220	Nmkmjjaa.exe
4128	Nagiji32.exe
904	Npiiffqe.exe
5096	Nceefd32.exe
2500	Ngqagcag.exe
976	Ojomcopk.exe
872	Onkidm32.exe
1852	Omnjojpo.exe
3892	Oplfkeob.exe
1152	Ogcnmc32.exe
3804	Offnhpfo.exe
3568	Ojajin32.exe
1916	Onmfimga.exe
4780	Oakbehfe.exe
1156	Opnbae32.exe
5088	Ocjoadei.exe
2008	Ofhknodl.exe
1824	Ojdgnn32.exe
4164	Onocomdo.exe
3328	Oanokhdb.exe
2556	Opqofe32.exe
1912	Oclkgccf.exe
2496	Oghghb32.exe
2804	Ojfcdnjc.exe
4160	Onapdl32.exe
464	Omdppiif.exe
3296	Oaplqh32.exe
4476	Ocohmc32.exe
4272	Ogjdmbil.exe
1320	Ofmdio32.exe
4056	Ojhpimhp.exe
3712	Omgmeigd.exe
4628	Oabhfg32.exe
2220	Opeiadfg.exe
4604	Ohlqcagj.exe
1452	Pfoann32.exe
3032	Pjkmomfn.exe
2664	Pmiikh32.exe
2300	Paeelgnj.exe
3552	Ppgegd32.exe
1092	Phonha32.exe
4016	Pfandnla.exe
1276	Pnifekmd.exe
3448	Pmlfqh32.exe
1080	Pagbaglh.exe
5128	Pdenmbkk.exe
5168	Pfdjinjo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nfjola32.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Dhhmleng.dll	Ojhpimhp.exe
File opened for modification	C:\Windows\SysWOW64\Pmiikh32.exe	Pjkmomfn.exe
File opened for modification	C:\Windows\SysWOW64\Adcjop32.exe	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Gdlfcb32.dll	Akdilipp.exe
File created	C:\Windows\SysWOW64\Caageq32.exe	Cocjiehd.exe
File created	C:\Windows\SysWOW64\Hgncclck.dll	Coegoe32.exe
File created	C:\Windows\SysWOW64\Nfohgqlg.exe	Nglhld32.exe
File created	C:\Windows\SysWOW64\Okddnh32.dll	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Ecpfpo32.dll	Bhmbqm32.exe
File created	C:\Windows\SysWOW64\Ckbemgcp.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgibkpc.exe	Dahmfpap.exe
File opened for modification	C:\Windows\SysWOW64\Dgeenfog.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Npepkf32.exe	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Onmfimga.exe	Ojajin32.exe
File created	C:\Windows\SysWOW64\Qedegh32.dll	Onapdl32.exe
File created	C:\Windows\SysWOW64\Nnahhegq.dll	Oaplqh32.exe
File created	C:\Windows\SysWOW64\Gaagdbfm.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Phlepppi.dll	Aopemh32.exe
File created	C:\Windows\SysWOW64\Hlfpph32.dll	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Gdglhf32.dll	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Npiiffqe.exe	Nagiji32.exe
File opened for modification	C:\Windows\SysWOW64\Ojajin32.exe	Offnhpfo.exe
File created	C:\Windows\SysWOW64\Oanokhdb.exe	Onocomdo.exe
File created	C:\Windows\SysWOW64\Hhblffgn.dll	Qhhpop32.exe
File opened for modification	C:\Windows\SysWOW64\Conanfli.exe	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Lelgfl32.dll	Cponen32.exe
File created	C:\Windows\SysWOW64\Ppcbba32.dll	Pffgom32.exe
File created	C:\Windows\SysWOW64\Ojhpimhp.exe	Ofmdio32.exe
File created	C:\Windows\SysWOW64\Ohlqcagj.exe	Opeiadfg.exe
File created	C:\Windows\SysWOW64\Qdoacabq.exe	Qpcecb32.exe
File created	C:\Windows\SysWOW64\Dllfqd32.dll	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Phonha32.exe
File created	C:\Windows\SysWOW64\Ppolhcnm.exe	Palklf32.exe
File created	C:\Windows\SysWOW64\Mfgomdnj.dll	Aphnnafb.exe
File created	C:\Windows\SysWOW64\Oeeape32.dll	Bgpcliao.exe
File opened for modification	C:\Windows\SysWOW64\Oanokhdb.exe	Onocomdo.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Olaafabl.dll	Cammjakm.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Mjcngpjh.exe
File created	C:\Windows\SysWOW64\Ncchae32.exe	Nadleilm.exe
File opened for modification	C:\Windows\SysWOW64\Panhbfep.exe	Pmblagmf.exe
File opened for modification	C:\Windows\SysWOW64\Aonhghjl.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Bobabg32.exe	Bgkiaj32.exe
File created	C:\Windows\SysWOW64\Bpkdjofm.exe	Bahdob32.exe
File created	C:\Windows\SysWOW64\Hikemehi.dll	Ckbemgcp.exe
File created	C:\Windows\SysWOW64\Cnhgjaml.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Omgmeigd.exe
File created	C:\Windows\SysWOW64\Cjceejee.dll	Paiogf32.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Ahfmpnql.exe
File created	C:\Windows\SysWOW64\Boenhgdd.exe	Bgnffj32.exe
File created	C:\Windows\SysWOW64\Nmfcok32.exe	Nncccnol.exe
File created	C:\Windows\SysWOW64\Njjdho32.exe	Nfohgqlg.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ngqagcag.exe	Nceefd32.exe
File opened for modification	C:\Windows\SysWOW64\Qobhkjdi.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Mjcngpjh.exe	3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe
File opened for modification	C:\Windows\SysWOW64\Nmkmjjaa.exe	Nnhmnn32.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Cdkifmjq.exe	Cponen32.exe
File created	C:\Windows\SysWOW64\Nceefd32.exe	Npiiffqe.exe
File created	C:\Windows\SysWOW64\Cpkgohbq.dll	Adcjop32.exe
File created	C:\Windows\SysWOW64\Kbqceofn.dll	Bgkiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Ncchae32.exe	Nadleilm.exe

Program crash 1 IoCs

pid	pid_target	Process
8136	8048	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngndaccj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nceefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pagbaglh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmblagmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Boenhgdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cponen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chkobkod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjcngpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojomcopk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onmfimga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oanokhdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgegd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjola32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnmopk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdmdnadc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dafppp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nadleilm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmqnobn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aagkhd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Coegoe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npepkf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oplfkeob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Palklf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chnlgjlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dahmfpap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqbpojnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paiogf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppolhcnm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aogbfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnoddcef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddllkbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omnjojpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cocjiehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oaplqh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfiddm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Akblfj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adkqoohc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apaadpng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmjkic32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bpkdjofm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conanfli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phonha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apmhiq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgelgi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdmfllhn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njjdho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogcnmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Paeelgnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfandnla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhhpop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhjmdp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjiipk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qodeajbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmiikh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ahofoogd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apodoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bobabg32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkgohbq.dll"	Adcjop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lielhgaa.dll"	Apodoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiebgmkm.dll"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahofoogd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchkcb32.dll"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caageq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onocomdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apgnjp32.dll"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojjhjm32.dll"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baiinofi.dll"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgni32.dll"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bhmbqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmihfl32.dll"	Conanfli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chkobkod.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adnbpqkj.dll"	Bacjdbch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oabhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdoacabq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apmhiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njjdho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phonha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cggkemhh.dll"	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kioghlbd.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gikgni32.dll"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlobem32.dll"	Cdimqm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaplqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepmqdbn.dll"	Aogbfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbjqfjb.dll"	Npiiffqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpicj32.dll"	Onkidm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglbla32.dll"	Oakbehfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojomcopk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pffgom32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 432	876	3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe	85
PID 432 wrote to memory of 4104	432	Mjcngpjh.exe	86
PID 4104 wrote to memory of 2408	4104	Nfjola32.exe	87
PID 2408 wrote to memory of 3952	2408	Njhgbp32.exe	88
PID 3952 wrote to memory of 2032	3952	Nncccnol.exe	89
PID 2032 wrote to memory of 3512	2032	Nmfcok32.exe	90
PID 3512 wrote to memory of 1136	3512	Nqbpojnp.exe	91
PID 1136 wrote to memory of 640	1136	Npepkf32.exe	92
PID 640 wrote to memory of 3176	640	Nglhld32.exe	93
PID 3176 wrote to memory of 3876	3176	Nfohgqlg.exe	94
PID 3876 wrote to memory of 2244	3876	Njjdho32.exe	95
PID 2244 wrote to memory of 3720	2244	Nnfpinmi.exe	96
PID 3720 wrote to memory of 3304	3720	Nmipdk32.exe	97
PID 3304 wrote to memory of 4668	3304	Nadleilm.exe	98
PID 4668 wrote to memory of 4348	4668	Ncchae32.exe	99
PID 4348 wrote to memory of 4024	4348	Ngndaccj.exe	100
PID 4024 wrote to memory of 3620	4024	Njmqnobn.exe	101
PID 3620 wrote to memory of 4220	3620	Nnhmnn32.exe	102
PID 4220 wrote to memory of 4128	4220	Nmkmjjaa.exe	103
PID 4128 wrote to memory of 904	4128	Nagiji32.exe	104
PID 904 wrote to memory of 5096	904	Npiiffqe.exe	105
PID 5096 wrote to memory of 2500	5096	Nceefd32.exe	106
PID 2500 wrote to memory of 976	2500	Ngqagcag.exe	107
PID 976 wrote to memory of 872	976	Ojomcopk.exe	108
PID 872 wrote to memory of 1852	872	Onkidm32.exe	109
PID 1852 wrote to memory of 3892	1852	Omnjojpo.exe	110
PID 3892 wrote to memory of 1152	3892	Oplfkeob.exe	111
PID 1152 wrote to memory of 3804	1152	Ogcnmc32.exe	112
PID 3804 wrote to memory of 3568	3804	Offnhpfo.exe	113
PID 3568 wrote to memory of 1916	3568	Ojajin32.exe	114
PID 1916 wrote to memory of 4780	1916	Onmfimga.exe	115
PID 4780 wrote to memory of 1156	4780	Oakbehfe.exe	116
PID 1156 wrote to memory of 5088	1156	Opnbae32.exe	117
PID 5088 wrote to memory of 2008	5088	Ocjoadei.exe	118
PID 2008 wrote to memory of 1824	2008	Ofhknodl.exe	119
PID 1824 wrote to memory of 4164	1824	Ojdgnn32.exe	120
PID 4164 wrote to memory of 3328	4164	Onocomdo.exe	121
PID 3328 wrote to memory of 2556	3328	Oanokhdb.exe	122
PID 2556 wrote to memory of 1912	2556	Opqofe32.exe	123
PID 1912 wrote to memory of 2496	1912	Oclkgccf.exe	124
PID 2496 wrote to memory of 2804	2496	Oghghb32.exe	125
PID 2804 wrote to memory of 4160	2804	Ojfcdnjc.exe	126
PID 4160 wrote to memory of 464	4160	Onapdl32.exe	127
PID 464 wrote to memory of 3296	464	Omdppiif.exe	128
PID 3296 wrote to memory of 4476	3296	Oaplqh32.exe	129
PID 4476 wrote to memory of 4272	4476	Ocohmc32.exe	130
PID 4272 wrote to memory of 1320	4272	Ogjdmbil.exe	131
PID 1320 wrote to memory of 4056	1320	Ofmdio32.exe	132
PID 4056 wrote to memory of 3712	4056	Ojhpimhp.exe	133
PID 3712 wrote to memory of 4628	3712	Omgmeigd.exe	134
PID 4628 wrote to memory of 2220	4628	Oabhfg32.exe	135
PID 2220 wrote to memory of 4604	2220	Opeiadfg.exe	136
PID 4604 wrote to memory of 1452	4604	Ohlqcagj.exe	137
PID 1452 wrote to memory of 3032	1452	Pfoann32.exe	138
PID 3032 wrote to memory of 2664	3032	Pjkmomfn.exe	139
PID 2664 wrote to memory of 2300	2664	Pmiikh32.exe	140
PID 2300 wrote to memory of 3552	2300	Paeelgnj.exe	141
PID 3552 wrote to memory of 1092	3552	Ppgegd32.exe	142
PID 1092 wrote to memory of 4016	1092	Phonha32.exe	143
PID 4016 wrote to memory of 1276	4016	Pfandnla.exe	144
PID 1276 wrote to memory of 3448	1276	Pnifekmd.exe	145
PID 3448 wrote to memory of 1080	3448	Pmlfqh32.exe	146
PID 1080 wrote to memory of 5128	1080	Pagbaglh.exe	147
PID 5128 wrote to memory of 5168	5128	Pdenmbkk.exe	148

C:\Users\Admin\AppData\Local\Temp\3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe
"C:\Users\Admin\AppData\Local\Temp\3cfe4827c34cbd68dae38de4e1b569faef46eaa433d00e137c2c57143bef1d7a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\SysWOW64\Mjcngpjh.exe
  C:\Windows\system32\Mjcngpjh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\SysWOW64\Nfjola32.exe
    C:\Windows\system32\Nfjola32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\Njhgbp32.exe
      C:\Windows\system32\Njhgbp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        41⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        54⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        57⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        63⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        65⤵
        Executes dropped EXE
        
        PID:5168
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        66⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        67⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        68⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        69⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        76⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        79⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        80⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5852
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        84⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        85⤵
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        86⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2364
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        90⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1184
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        91⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        92⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        93⤵
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        94⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2864
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        96⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4264
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        97⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        98⤵
        Drops file in System32 directory
        
        PID:2996
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2448
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3156
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        102⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        103⤵
        System Location Discovery: System Language Discovery
        
        PID:5232
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        104⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        105⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        106⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        107⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        108⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        109⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        110⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6224
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        111⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        112⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        115⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        118⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        120⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        121⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6704
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        123⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        124⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        125⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        126⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        127⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        129⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        132⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        133⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        134⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        136⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        137⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        139⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        141⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4800
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        143⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:3472
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        146⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        148⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        150⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        151⤵
        Modifies registry class
        
        PID:4696
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        152⤵
        Drops file in System32 directory
        
        PID:5520
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        154⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        156⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        157⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        158⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        159⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        160⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        164⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        165⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        166⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        167⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        170⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        174⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        175⤵
        System Location Discovery: System Language Discovery
        
        PID:7488
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        176⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        178⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        180⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        183⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        184⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        187⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7968
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8008
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        189⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 400
        190⤵
        Program crash
        
        PID:8136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8048 -ip 8048
1⤵
PID:8112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Mjcngpjh.exe

Path C:\Windows\SysWOW64\Mjcngpjh.exe
Size 411KB
SHA256 897c8a7b015c324d610d2b8d801ab4e10e400d98aa45c3a58217c8b3e8aebb9f
MD5 bd8bc8750fe7278ea0c2b33d47732139
SHA1 71ad5d0b9356f81f96183947ecc12d3840de99a6
SHA512 6e1bdeb819f55522be7fb256e315ce3316ac913f12e624cd686b7aa30c255749820b083fb5736e321389c48c0cad26f9bf5aefc66ae0b42a05906d6001d39899
SSDEEP 6144:UwLLs6a7nPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:BLLs6P/NcZ7/NC64tm6
TLSH
T1659493F35DA26F9FE82FE2B49477DAE151D9C06F48A6F14A2A306CD5656F0813CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nadleilm.exe

Path C:\Windows\SysWOW64\Nadleilm.exe
Size 411KB
SHA256 931edbf0928dc773eaa13781b52ec93d9665614ca8286522e8b7b585ffdbedb5
MD5 5f380038ebd48280b59cfdbece5d22c5
SHA1 9497f1bcd1ffd74f90469b95752ae6b9a1cc90d4
SHA512 c2b9800d77f762a5eb38a469152a25487e466242587f6eadca957ada1305ab5979e677d85a48e2ff69d43ce855b4236e54007aecdfce0a8f5e609dc3f4efbd55
SSDEEP 6144:c3mvLyO5PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:Ms+/NcZ7/NC64tm6
TLSH
T19A94A4F79EA26F9FD80FE3748477CAE55199C06F48AAF14A26302CE5656F1813CE4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nagiji32.exe

Path C:\Windows\SysWOW64\Nagiji32.exe
Size 411KB
SHA256 5087875d202fdb416cf0a5b025ee53199452708118b506c3ecbe0fdf1fe31ff2
MD5 13228b3912fbe715269d5c51d524f1a1
SHA1 67a75f6161700a26f566ab6a2d089f723fc32419
SHA512 346baaa2dc41b3ff37af73384db2e98521c69fdc7652f3c640ff5c00a5a506e76708b2358a0d2f5913110e9ee72bc3ce273711828297ea34cc7af55f1e3b0053
SSDEEP 6144:RGpenFnI1PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:8p06g/NcZ7/NC64tm6
TLSH
T1199482F35DA26F9FD81FE2748477DAE19199C16F48A6F14A7A301DD1A96F0823CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncchae32.exe

Path C:\Windows\SysWOW64\Ncchae32.exe
Size 411KB
SHA256 247633ea8029629c2297150164500c2ac127d05bfdb071c39ea43b68258a32c3
MD5 80bad4fd8852420278905ade04a4e231
SHA1 e66d8762895c4bc942f2174c8becae6167a9479f
SHA512 559ff7caa27c17f03bf2612601fbf099b517069f17818d5189005024c58d71039f6a7767e96ed8b25a7aaf7d3373b4105ae7688d1787c96c91fb0c701f0f641d
SSDEEP 6144:iWL3UM5OxMHIhgJPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:iqb5Ox6yv/NcZ7/NC64tm6
TLSH
T1209484F75DA26F9FD41FE2748477CAE15199C06F49AAF24A2A341DE1A56F0813CE0E0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nceefd32.exe

Path C:\Windows\SysWOW64\Nceefd32.exe
Size 411KB
SHA256 e3314e97bad3add7c5b9b55c626ecb22eacf968ffcf80df10382f714c91dc976
MD5 8d9be828d24c58ed90b5eed217f6a9e3
SHA1 c66760895a9e3767d67109f1c1a51bb33cdf2557
SHA512 6339bd58bb72fa6bbe1019d16ab17ea34102aaab2e2306fb282c5bd57e3ff3811945ce7fa5d86a7d1b6bae67e5e9fa4c345cf87829ade5f8334335750d0d69cc
SSDEEP 6144:dGMRUiaPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:kiH/NcZ7/NC64tm6
TLSH
T1D49462F79DA26F9FD81FE3B48467CAE25199C06F48E6F18A2A301DD5656E0813CE0D4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfjola32.exe

Path C:\Windows\SysWOW64\Nfjola32.exe
Size 411KB
SHA256 e5d1079d36b95ca5a5873ad8220b32b735188351877eacda0a078fc6121842fc
MD5 e330ae6626a30c3edeebd4275a115e46
SHA1 f510cfe08d0e8c5df063f117259d9971794455a2
SHA512 f0f639deb0117f56554ff652576b21b1c5ae82442289cc566ff2902b5f93622ce310480c7c3e9d57ca63111c3044e32b8c8cae220d74f2267ac689b1dd6781f6
SSDEEP 6144:NV4B8PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:N+//NcZ7/NC64tm6
TLSH
T120946FF74DA26F9FD41FE2748077EAE19199C0AF08EAF54A26301CDA656F0817DE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nfohgqlg.exe

Path C:\Windows\SysWOW64\Nfohgqlg.exe
Size 411KB
SHA256 4f2a456bd439c5314b3350ddbaa0bba9b5fc670c2c055f62db8cd1156f6f2d50
MD5 29ac3769748e095892a701b9e31c0328
SHA1 a802abc753c3d85d4140e64d2cbcef1f39a96618
SHA512 d95ee6822eca818c6d07606e6af6d85a103d3603ce2f1f64fea3854a2fae7e153d0a8015636737cd31344f0fd2e1c27532744b92bb4ff64af3ae6ea54f669867
SSDEEP 6144:3Vpab8zr9vv1PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:lEbEg/NcZ7/NC64tm6
TLSH
T1B09482F79DA26F9FD41FE274C4B7CAE251A9C16F48A6F14A26302CD5666F0913CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nglhld32.exe

Path C:\Windows\SysWOW64\Nglhld32.exe
Size 411KB
SHA256 67ac9d41af12d93d9b7c68c3b4f396d1c896f3845fa01e07679e04f14e4c972b
MD5 3de446d2a2642717ed680a2fc314101d
SHA1 c9ca2cb31579302809308934fde5e49a5ff39cd1
SHA512 335fd1d24d7721a038a09d6053d97703554907752b916009c39bdad77edb819a375faa34dc26dc679f71c5e60d9a6b2331be2418205e3c351d6da9d560ed924e
SSDEEP 6144:jXLpIue1CBPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:jXtIX1h/NcZ7/NC64tm6
TLSH
T13D9482F39DA26F9FE50FE2748CBBCAE19199C06F49A6F14A27305DD1656E0813CE0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngndaccj.exe

Path C:\Windows\SysWOW64\Ngndaccj.exe
Size 411KB
SHA256 6eda4f7afe302dd696f078e4574eaa4cfd85ffb6050e4e6173c79db7b473b361
MD5 ce3ca655b076c657f0584565e3eab243
SHA1 e818f2d6fc73d12e43c75bba649df6aed7ebd3d6
SHA512 5a1fbe81d15fce9ad98012d4dccfbc5c6f154040588f9ed02913ab2493a2bb385aa7f7a8038112b3798f3454c4c02e3a08538bae18993455fa4385fecdfc851f
SSDEEP 6144:Et0qK4tRC3RDDvZkPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:u7K4aDDvv/NcZ7/NC64tm6
TLSH
T1FC9493F79DA26F9FD81FE2748077CAE1919AC06F48B6F18A66301CD1A56E0853DE4C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ngqagcag.exe

Path C:\Windows\SysWOW64\Ngqagcag.exe
Size 411KB
SHA256 a35749dc97f77cccc491760cf6d22cd1066233e338885108a731a9af78f2d06a
MD5 213c7ed5c34be4a4bb41eac497bbfe6b
SHA1 e5ea43d00673c6ef069d460fa65b539f8a419eeb
SHA512 617c2e611fe69eada6b66f10465b84885e09280a6cc747e1385e3391fac454a0f90c71d24d43270528c494799093d999dd18a2d3142ac21b6019c7ec80b3c5c9
SSDEEP 6144:GeAKn1fcW2aPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:5n7i/NcZ7/NC64tm6
TLSH
T1909493F75DA26F9FD42FE2749477CAE1919AC06F49A6F14A36302DD16A6F0813CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njhgbp32.exe

Path C:\Windows\SysWOW64\Njhgbp32.exe
Size 411KB
SHA256 80dbc4891f3b0973f6365adf015e395e3693baecef89618bd3ab1f106630a5f6
MD5 c97adc84610cca6ce0638d8678e6749d
SHA1 7e6ae00f292357cbbb154247eb917565bc2889b3
SHA512 59c9ea1c0b489755a05b148c7e422add1340fceb5b4466b9a3afa86b1b642bc461012b64945e587f3df120fc729abfa2f94e1c9d806ccb891026f7db0f0c7930
SSDEEP 6144:Ke8peCu+PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:K7By/NcZ7/NC64tm6
TLSH
T1909460F39EB36F9FE81FE2748467CBE15199C06B48A6F14A3A342CD5656E0813CE4D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njjdho32.exe

Path C:\Windows\SysWOW64\Njjdho32.exe
Size 411KB
SHA256 492ad78de888dec8c143dc99020cd8330bedab245b86eab492cccf6f696396cc
MD5 298a396c48978bc6fc8b406672c652c8
SHA1 e03876f5ec2498e4a09af864db0255257d54b53e
SHA512 610072199482fd6c6c672fd95fc6dea410ff0cc56bfc3919f22086d91a883b007818ff627f3b24080c2b463cae919d250d9d83fa067f36c860f50524b9cfddce
SSDEEP 6144:+R2lJeyvLOPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:bp//NcZ7/NC64tm6
TLSH
T14A9493F39DA26F9FD41FE3788477CAE1529AD06F48A6F24A6A305CD1656F0853CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Njmqnobn.exe

Path C:\Windows\SysWOW64\Njmqnobn.exe
Size 411KB
SHA256 08102065167ad607295797d4c1483299435e448d2f1366b74a3074728c845fd9
MD5 51a151c195b96162e904e3a24d8dbcaf
SHA1 8557688999c383c27e4b993cd7cd32e35a0aac42
SHA512 0642a2c54c0df141b58f19d3a1dc4cf1ed6aa2bb76adcd63a4cf5969a17d43dbd4a7673fc974f6051b615c1280c28abe90f0d25cf1d915b97f05333eb94ebac3
SSDEEP 6144:MdpuIEjWPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:59/NcZ7/NC64tm6
TLSH
T1B19493F38DB26F9FD41FE274817BCAE1519AC16F49A6F18A26305CE5656F0823CE0D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmfcok32.exe

Path C:\Windows\SysWOW64\Nmfcok32.exe
Size 411KB
SHA256 b4f88f0aeed97edf3acbd80a3617888b52a0dd5eb3ede9006234fb6f908d2d56
MD5 b4a2bbc8c0ec4d24ed8d734c8ee28b8d
SHA1 2fb847006935d812db37202898b63a027d13780a
SHA512 cff8a8a8b7bf40a9b46f8d99dffa3ce43175968dc6f705bfe0853c7afdfd35beae23aceb88186ae4b9c6bd428de5eddfdaf2ebc18a3687c2b432d469d4ea2867
SSDEEP 6144:5IVaqwwyOWPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:BwyS/NcZ7/NC64tm6
TLSH
T19594A5F79DA26F8FD51FE3B88577CAE15095C06F48AAF14A2A342CD5696F0913CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmipdk32.exe

Path C:\Windows\SysWOW64\Nmipdk32.exe
Size 411KB
SHA256 140d69733c95f0b69d7d31a891dfe188d3f34d12775beb64a543534669ccad32
MD5 ec9c9e73fda8df3ec1aac4f5e73f0575
SHA1 2ef48e10a4e6e66ea4c37de871786cce6576a4a0
SHA512 68c4845b18048ec49c146ff6b8360634a18646b09d6866223091829b5bacd7bfb95115a1b6cc5945de1f956f1c9992d7caac0f61ffdee63a2d7be7dfadeb60e3
SSDEEP 6144:mflrPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:oo/NcZ7/NC64tm6
TLSH
T1479494F39EA26F9FD41FE2748477CAE161D9C06F48A6F14A2A306CE5656F0913CE4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nmkmjjaa.exe

Path C:\Windows\SysWOW64\Nmkmjjaa.exe
Size 411KB
SHA256 bfb64b93bdacf946e268ac2bc10e2df7cfc6626378d12f7424664b030ab245e7
MD5 60dcc1eebe3d11c77f1cd02b2bc806e6
SHA1 23409b6f1ce49fe444ae8454cd815f3d8281da2b
SHA512 89f2ee4d08e97d099a320e6d437864c54e36c2ee981eb5fa04d48d76b88085ee7ca780e6f64f86d3efea22b13b6824abacdbfa1d28b6d7070666c13cf04759d4
SSDEEP 6144:qdnqKYZ1cPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:qdqTj/NcZ7/NC64tm6
TLSH
T19C94A4F75EA26F8FE81FE3758877CAE19199C06F48AAF14A26301DD1656F0813DE1D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nncccnol.exe

Path C:\Windows\SysWOW64\Nncccnol.exe
Size 411KB
SHA256 17ff9587253e0fc5172a0a828b69439a23736929166c9823116e37bed46e7a32
MD5 61efd65acbaccb4dfcb6af42032e28ff
SHA1 fe1023920b3bc47a8bbcce71467b51cf950ed375
SHA512 d5ea959a10f17ca01769ed6cf650528c468e6c81f901a54ad4fe7f27a073b7a459f343e90a17768239d467940eb9f2318dffe8955218d38c7a6dc3daa312bec4
SSDEEP 6144:+1b+bFMPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:XbP/NcZ7/NC64tm6
TLSH
T12A9461F34EB26F9FD41FF278C8A7DAE19199C06B48B6F14A2A341DD5656E0813CE0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnfpinmi.exe

Path C:\Windows\SysWOW64\Nnfpinmi.exe
Size 411KB
SHA256 2cd79070f23e886adc42250d127655a4911e5cb44bf41cb98354b3525a95393b
MD5 443d7a59b9fa574fe6b9c117bb934d2d
SHA1 abe5f8ec3fc818b1673f7058f4c15a737f7b3fc4
SHA512 b8be7ef3d165e14d8117edb48910d0be81b0adcb4f8b3a94227efb0d507412953d52f9d99154b88c281f00d1d7e40a80766907646120bd91314bfe41555743ff
SSDEEP 6144:2daHpAmqPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:yaHT/NcZ7/NC64tm6
TLSH
T1D09493F75DA26F8FD81FE774847BCAE154D9C46F48A6F24A6A305CD1656E0823CE0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nnhmnn32.exe

Path C:\Windows\SysWOW64\Nnhmnn32.exe
Size 411KB
SHA256 1c20c7c0ab371937b5a81d228e3612c52f0a7e5d08307c495b0aeaef96c7ffac
MD5 3f5d7fa354d143c1d51383756370f8cd
SHA1 0a79f4cb9a1ba3c7cbad1b66c2bbf358a1748826
SHA512 329dbee149903c598a28f553db126ff4af906453ea586282ce4c054f6931f49421a4e007ad9d5a56e03c2c6ebae698caaf5b25401f3c2e40251d82b6f9c80fb9
SSDEEP 6144:EmeRq+PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:/eRC/NcZ7/NC64tm6
TLSH
T1379493F39DA26FAFD85FF274807BDAE15099C06F48A6F18A2A305DD1656F0913CE0D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npepkf32.exe

Path C:\Windows\SysWOW64\Npepkf32.exe
Size 411KB
SHA256 60d8980e1ac9d6f5aeffa90ed97f3f0e45cc3763595e3fb67d1117556247a03c
MD5 2bb41d7d3e1117d7ab9e16f3c76df9e8
SHA1 532470128a2b314546b26c308e2f4a24d1b6e079
SHA512 96778677a003c6f7dcc6274d3576f3c468d3d782cf0ec4c929b04428774af1ecbf1de11fa963355b8e9259b27e04d3a7f84d7874e83723654bb06816b2eb5e1c
SSDEEP 6144:CA7UCn04VPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:CAQC0j/NcZ7/NC64tm6
TLSH
T13A9495F75DA26F9FD41FE274847BCAE161D9C06F58A6F14A2A311DD169AF0823CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Npiiffqe.exe

Path C:\Windows\SysWOW64\Npiiffqe.exe
Size 411KB
SHA256 61f94bd6c98a99d8c10aa1281e45936f7c9db4428ec4f4b95a4054c8b1a02979
MD5 beea7c9afb73779162b85570ec3cb7dc
SHA1 a940b6891ebeeee4a23d4c7e4be1ca90a23a7c14
SHA512 51236f0d94df287c3de58b3f099896dff16acad20617f92661eaea6f89b72705bb9590a423a29b48881d09a18dd3b53dd4999d36f1b90b09fe2ce862352a4c06
SSDEEP 6144:feEs2PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:GX/NcZ7/NC64tm6
TLSH
T1439482F74DA26F9FD40FE3B4846BCAE594DAC0AF48A6F54A26341CD5656F0813EE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nqbpojnp.exe

Path C:\Windows\SysWOW64\Nqbpojnp.exe
Size 411KB
SHA256 4dca88dc3fb240b089481a5e15fdbad6d7baa17d5a92a85a2cc625ce9731e72c
MD5 1d95276baa1b9b0ff7ef9ee5876d94ec
SHA1 34b1a43c1e0512679a228cafcdadb708228c0084
SHA512 dab1bf7252047f6945f583f634994fd88111164a264bcb442a1badbaa83370b36ad6bf6cff10c49f0fc63a9d3f666b48ef94792e3d8892c2e10c5f0591490deb
SSDEEP 6144:EB8F5UlnPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:Eyl/NcZ7/NC64tm6
TLSH
T1E59472F75DA26F9FE81FE274847BCAE1519AC06F49B6F14A2A341CD5B56E0813CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oakbehfe.exe

Path C:\Windows\SysWOW64\Oakbehfe.exe
Size 411KB
SHA256 78e7df8bd5580203f71aef4d5f547fa900128e2d64a1d14f8bfdf64c20843e2b
MD5 d1fa27b13e49156b0caaa42fa683e77e
SHA1 dd19b169335b68f057aa6c0e910298a1a551b42c
SHA512 ebcc9ae93c725d669853fef96f6478724a2f5486077d6d3f4010a873879a17a69d4f04923ed8f66a5d2c8b5c8dfce5de3bb29d6fd930bc8ac498aed618a20530
SSDEEP 6144:LnmrPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:LT/NcZ7/NC64tm6
TLSH
T1EF9493F39DA26F9FE95FE3748067CAE1619AC06F48A6F14A36315ED1656E0813CE0D0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Offnhpfo.exe

Path C:\Windows\SysWOW64\Offnhpfo.exe
Size 411KB
SHA256 b1d4745ccd56c1e1d65ecb329b7003ad87fcf354d4a8b8141afb55c32fc36ab2
MD5 fd9f0408cab09dd7d49c8986103324e6
SHA1 84e2ec95a4b4cee8df62f75b469a106912518e71
SHA512 f556368b3821e473f66c82797b9e13fd7d811e4f021c773d5bf4a0c6aa1786df61180202067581c5e3cc30036c8025c6a003a976c81374d49327cd09bf6af498
SSDEEP 6144:3jzgx1MDF6JSSPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:Tzgf6YJm/NcZ7/NC64tm6
TLSH
T17094A4F79EA26F8FD80FE2748477CAE15199C0AF49E6F15A26302CD5656F1823CE0D09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ogcnmc32.exe

Path C:\Windows\SysWOW64\Ogcnmc32.exe
Size 411KB
SHA256 01480027895d7816eca6f89457283c2242b139fec3f49eb736c28db03f95460d
MD5 30d8b646fa597f50767b8f6fda0ff156
SHA1 f600f5b1366f771f4397d08b99dc7d84702c9834
SHA512 f704feeb663214d491ea7707fde9fc9f250885d2a249360a7bebd6cd8851e84dd40baf775d3c515ee57fdca52479d279ce1f63f12bfdb04fde51c36a2f1c80d1
SSDEEP 6144:xgFANPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:xC/NcZ7/NC64tm6
TLSH
T18A94A3F79DA2AF8FD81FE2788477CAE151D9C06F09A6F18A26301DD165AF4813DE4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojajin32.exe

Path C:\Windows\SysWOW64\Ojajin32.exe
Size 411KB
SHA256 2a8a054743bd71c3b12e8ad48ccdc91b5833058486611b94ee8beb8194e7c2b0
MD5 bae0a3f1210c7d3fa2f1a50e8d730123
SHA1 182f4b02d55fbb9e88d74d4f48ddef2c45aa2755
SHA512 7878ea34a13b3048ffc4eb9dc64f2882c530089ddfc7517bd5ac3bdcc4a5fa805f5ce16f5d24e6fe93852899ed2b40bd0c9f96bf6207c6ee6d500008c126f2ff
SSDEEP 6144:EJ8lP+ugtPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:E2ltj/NcZ7/NC64tm6
TLSH
T1319495F75DA66F9FD42FE2788477CAE151E9C06F48A6F14A26302CE6656F0813CE4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ojomcopk.exe

Path C:\Windows\SysWOW64\Ojomcopk.exe
Size 411KB
SHA256 7721c98bab5dec6505709389bfc32310c8fb5197d0f3bd3930983efa5f888ad2
MD5 6e40411509981f8a9f1a7ad4ced5b920
SHA1 331ed24c4745fc66a918d3658996bddad2fabc75
SHA512 1845552adb9754284c77d78061b99d8f06e234800bdcf3221e3ae8685e2eadd063448aa7bd9281770bd9e7b8ce80d912444806900937643a8ccface876048884
SSDEEP 6144:sHkXs4PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:1+/NcZ7/NC64tm6
TLSH
T1D99482F79DA26FAFD40FE3748477CAE1619AC06F49A6F18A2A301DD5656F1813CE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omnjojpo.exe

Path C:\Windows\SysWOW64\Omnjojpo.exe
Size 411KB
SHA256 016ef14ee707f02c652b71e88afe118a3ba1cf7699ebd24b6127b90ad00b7c17
MD5 89f6f4cb2cff489ff0962c5ba63ca9bc
SHA1 8bbcd231b6fec316d797bea0e7a104006e377a2e
SHA512 dab033071c86cdbe2e19d5a736f488cadeed87a3ab02068ee25e8ae9765e5485c5fc9545fbef467a2e47aaf3cf3bb9307e273138e29ea1d4191319170e6aacd5
SSDEEP 6144:08N1rD6PQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:0Odz/NcZ7/NC64tm6
TLSH
T10F9482F78EA26F9FE81FE2748477CAE55099C06F58E6F14A26306CD5656F0813CE8D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onkidm32.exe

Path C:\Windows\SysWOW64\Onkidm32.exe
Size 411KB
SHA256 74dada011c2f69ec3be18bbc451150974c784217708df6f899b20c1e57869b50
MD5 648ad2c995c0b8e31817d107052d9ce7
SHA1 65a78d2422b0314a21abe6edf9d64cbaa46cfe4b
SHA512 9e6b90b458dda35cea7c1db58029344edfc5db8a1453076ec07e1449fc4d0fea9050e5616046373eb7d31f111a623292bcfd0627c6a2311202f98d701728a41b
SSDEEP 12288:+1uhNzyH6Q8yvNcEKxOS/NcZ7/NC64tm6:+1uhN+H6Q8yvNcEKxOFZh
TLSH
T1B99493F79DA26F8FE41FE274C477CAF19199C16F48A6F14A2A302DD1656E0813CE0D89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Onmfimga.exe

Path C:\Windows\SysWOW64\Onmfimga.exe
Size 411KB
SHA256 c4d40e274f0018d67f52f4792d4ce56774fcb24bf6180ee45c4cae6aa36c001f
MD5 e2e03826faa8bfc9e9b6d9319a74b845
SHA1 541704ce1770f146c596d688c117edd0b0292f28
SHA512 621113864655adc0c54e9be13e6fdd4cc2a9ba95f0997d536dc104bfbb81338b6c487269e97686d40df25f485872d443c7b8f52383b8111cb25987aa0e57bab1
SSDEEP 6144:AdhNt75HX9dMPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:AP59f/NcZ7/NC64tm6
TLSH
T17C9481F79DA26F9FD81FF274846BCAE19199C16F48B6F14A2B301ED1652E0853DE0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oplfkeob.exe

Path C:\Windows\SysWOW64\Oplfkeob.exe
Size 411KB
SHA256 df3e5bb014acbd2c3d5f93184795cc492555511adac5797c6c776ec571790157
MD5 aa1c1757e7589a50a74ae39e8eda11b1
SHA1 bfb59dc96280fafd7b186fc39a9c8816faf72c1b
SHA512 aefe771d0fabc9847dbbba58258ed1ff68abcdbc3882fbba8a1dd3a88901a79dae09ec8f06004eaafb273afbd8472323128eb1193b30a7b0766be59714dccf7c
SSDEEP 6144:jt8jEPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:jtO/NcZ7/NC64tm6
TLSH
T1BC9482F79EB26F9FD81FE2749477CAE1529AC06F49A6F14A26302CD5656E0813CF0D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Opnbae32.exe

Path C:\Windows\SysWOW64\Opnbae32.exe
Size 411KB
SHA256 33f8f4a161d2562552ba92b2db6b421e2351ab7e81e1cc250c3e900a27723dee
MD5 4facddd1342e8a1b6633b5bc97bee603
SHA1 7799274c0ca0f38fa52bc41ae7bff1ade9449c33
SHA512 e31d9aaaec825630fd0ca65e5a767b60673bb4b4a67233b23ebeea6404564dfd413de5823716312648d064dec51801001008850742f72c56a199d120be90d918
SSDEEP 6144:92gPBFkhp2RPQ///NR5fLYG3eujPQ///NR5fqZo4tjS6:9A/NcZ7/NC64tm6
TLSH
T1A39484F75DA26F8FD51FE2B48467CAE551E5C07F48A6F18A26302CE1A96F0853CE4D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/432-556-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/464-327-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/640-69-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/872-197-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/876-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/876-543-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/876-1-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/904-165-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/976-189-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1080-441-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1092-417-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1136-61-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1152-221-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1156-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1184-608-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1276-429-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1320-351-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1452-387-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1824-279-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1852-205-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1912-303-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1916-245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2008-273-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2032-583-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2032-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2220-375-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2244-93-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2300-405-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2364-602-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2408-570-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2408-30-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2496-309-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2500-181-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2556-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2664-399-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2804-315-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3032-393-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3176-77-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3296-333-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3304-109-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3328-291-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3448-435-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3512-54-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3552-411-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3568-237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3620-141-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3712-363-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3720-101-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3804-229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3876-85-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3892-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3952-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4016-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4024-133-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4056-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4104-16-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4104-563-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4128-157-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4160-321-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4164-285-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4220-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-345-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4348-125-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4476-339-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4604-381-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4628-369-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4668-117-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4780-253-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5088-267-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5096-173-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5128-447-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5168-453-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5208-459-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5248-465-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5288-471-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5328-477-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5368-483-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5408-490-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5448-495-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5488-501-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5528-507-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5568-513-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5608-519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5648-525-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5688-531-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5728-537-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5768-544-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5812-550-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5852-557-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5892-564-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5936-571-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5980-577-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6024-584-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6064-590-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/6108-596-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads