berbew | 46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
Size 112KB
Sample260830-1xwd5san21
SHA256 46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968
MD5 a6b863677d1f5a2db1ed3931e68d4510
SHA1 50b6487349e36a804faec3380fcd4c8ae62aa234
SHA512 cba2b0a98c4bcdefc4693d4bdb320302aef35acd389e2b3bb6cbf418508aed6867764806642ef1441df9424d98e2f3c3bf481cde4a66d5b1ebb45cada91cc2d7
SSDEEP 1536:TfhEQ3PxOXXSFDbfH/YkMyHp6bn4CmoEEw+nkTgo3+/F1gUph3M5eR3:qWbfpJ6bn2hJ+nygo3whr3M5eR3
TLSH
T182B35947E5B45E9EE4B568F027311372C6ECC4B6DEB2E16C27A1DA445AFB372808B04D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidinqpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljdai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oonlfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjjmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjnnbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqjbddpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbhgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiphjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiikpnmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpqggh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laiipofp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Legben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Momcpa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjfdfbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeapcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhplpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcclncbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhenai32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqmojd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbafoge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbhmbdle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loofnccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oblhcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcjjhdjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcclncbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pplhhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfiokmkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlljnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kadpdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhqefjpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjnnbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofegni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oifppdpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflmnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Johggfha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jimldogg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lakfeodm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakdbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpnjah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojmcdgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljpaqmgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lckboblp.exe

Executes dropped EXE 64 IoCs

pid	Process
4852	Ilkoim32.exe
956	Iojkeh32.exe
3028	Ihbponja.exe
2196	Ipihpkkd.exe
1216	Ilphdlqh.exe
4580	Iondqhpl.exe
4452	Jidinqpb.exe
4380	Jlbejloe.exe
2188	Jldbpl32.exe
1760	Jocnlg32.exe
4652	Jaajhb32.exe
4616	Jemfhacc.exe
1964	Jihbip32.exe
876	Jlgoek32.exe
2792	Jpbjfjci.exe
1996	Joekag32.exe
3872	Jadgnb32.exe
2352	Jeocna32.exe
3716	Jikoopij.exe
3828	Jhnojl32.exe
32	Jpegkj32.exe
2856	Johggfha.exe
4984	Jbccge32.exe
3976	Jeapcq32.exe
3516	Jimldogg.exe
3792	Jhplpl32.exe
2084	Jpgdai32.exe
892	Jojdlfeo.exe
4456	Jbepme32.exe
4708	Kedlip32.exe
1828	Kiphjo32.exe
3616	Khbiello.exe
2260	Kpiqfima.exe
3964	Kbhmbdle.exe
1128	Kakmna32.exe
3368	Kefiopki.exe
4892	Kheekkjl.exe
4664	Klpakj32.exe
2656	Koonge32.exe
3744	Kcjjhdjb.exe
4176	Keifdpif.exe
3552	Kidben32.exe
2708	Khgbqkhj.exe
1612	Kpnjah32.exe
64	Koajmepf.exe
4264	Kapfiqoj.exe
5012	Kekbjo32.exe
4724	Kifojnol.exe
4300	Klekfinp.exe
1556	Kpqggh32.exe
472	Kcoccc32.exe
4992	Kabcopmg.exe
2076	Kiikpnmj.exe
1212	Klggli32.exe
4576	Kpccmhdg.exe
4796	Kofdhd32.exe
1420	Kadpdp32.exe
3232	Lepleocn.exe
1948	Lhnhajba.exe
2788	Lljdai32.exe
3896	Lpepbgbd.exe
2080	Lcclncbh.exe
3824	Lafmjp32.exe
3960	Lindkm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Loacdc32.exe	Llcghg32.exe
File opened for modification	C:\Windows\SysWOW64\Mpclce32.exe	Mhldbh32.exe
File opened for modification	C:\Windows\SysWOW64\Nhhdnf32.exe	Nfihbk32.exe
File created	C:\Windows\SysWOW64\Nnndji32.dll	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Blcnqjjo.dll	Piapkbeg.exe
File created	C:\Windows\SysWOW64\Dahkpm32.dll	Jidinqpb.exe
File opened for modification	C:\Windows\SysWOW64\Jlgoek32.exe	Jihbip32.exe
File created	C:\Windows\SysWOW64\Mnknop32.dll	Jadgnb32.exe
File created	C:\Windows\SysWOW64\Lpjjmg32.exe	Lhcali32.exe
File created	C:\Windows\SysWOW64\Emkbpmep.dll	Niojoeel.exe
File opened for modification	C:\Windows\SysWOW64\Lhqefjpo.exe	Lindkm32.exe
File created	C:\Windows\SysWOW64\Nmdkcj32.dll	Lfiokmkc.exe
File created	C:\Windows\SysWOW64\Ijcomn32.dll	Lcmodajm.exe
File opened for modification	C:\Windows\SysWOW64\Momcpa32.exe	Mqjbddpl.exe
File created	C:\Windows\SysWOW64\Joekag32.exe	Jpbjfjci.exe
File opened for modification	C:\Windows\SysWOW64\Klekfinp.exe	Kifojnol.exe
File created	C:\Windows\SysWOW64\Mpclce32.exe	Mhldbh32.exe
File created	C:\Windows\SysWOW64\Gflonn32.dll	Oihmedma.exe
File opened for modification	C:\Windows\SysWOW64\Pafkgphl.exe	Piocecgj.exe
File opened for modification	C:\Windows\SysWOW64\Jaajhb32.exe	Jocnlg32.exe
File created	C:\Windows\SysWOW64\Lhnhajba.exe	Lepleocn.exe
File created	C:\Windows\SysWOW64\Pfagighf.exe	Pbekii32.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pjcikejg.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jpgdai32.exe
File created	C:\Windows\SysWOW64\Kakmna32.exe	Kbhmbdle.exe
File opened for modification	C:\Windows\SysWOW64\Khgbqkhj.exe	Kidben32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Ojqcnhkl.exe
File created	C:\Windows\SysWOW64\Deaiemli.dll	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Benibond.dll	Jojdlfeo.exe
File created	C:\Windows\SysWOW64\Mcaipa32.exe	Mpclce32.exe
File created	C:\Windows\SysWOW64\Alapqh32.dll	Nblolm32.exe
File created	C:\Windows\SysWOW64\Kiphjo32.exe	Kedlip32.exe
File created	C:\Windows\SysWOW64\Mhjhmhhd.exe	Mfkkqmiq.exe
File opened for modification	C:\Windows\SysWOW64\Mjidgkog.exe	Mablfnne.exe
File created	C:\Windows\SysWOW64\Jadgnb32.exe	Joekag32.exe
File created	C:\Windows\SysWOW64\Kedlip32.exe	Jbepme32.exe
File created	C:\Windows\SysWOW64\Ahfmjddg.dll	Kofdhd32.exe
File opened for modification	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Jldbpl32.exe	Jlbejloe.exe
File created	C:\Windows\SysWOW64\Jbepme32.exe	Jojdlfeo.exe
File created	C:\Windows\SysWOW64\Mjliff32.dll	Lhqefjpo.exe
File created	C:\Windows\SysWOW64\Lhcali32.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Defbaa32.dll	Lhenai32.exe
File created	C:\Windows\SysWOW64\Nhhdnf32.exe	Nfihbk32.exe
File created	C:\Windows\SysWOW64\Nijqcf32.exe	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Dkjfaikb.dll	Ofegni32.exe
File created	C:\Windows\SysWOW64\Qejpnh32.dll	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Npmknd32.dll	Jlbejloe.exe
File opened for modification	C:\Windows\SysWOW64\Lhenai32.exe	Legben32.exe
File created	C:\Windows\SysWOW64\Lnpckhnk.dll	Noblkqca.exe
File opened for modification	C:\Windows\SysWOW64\Ookoaokf.exe	Ommceclc.exe
File created	C:\Windows\SysWOW64\Ebdpoomj.dll	Ockdmmoj.exe
File created	C:\Windows\SysWOW64\Fpnkah32.dll	Nbbeml32.exe
File created	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Dblamanm.dll	Ppikbm32.exe
File created	C:\Windows\SysWOW64\Abbqppqg.dll	Kedlip32.exe
File created	C:\Windows\SysWOW64\Mmdaih32.dll	Kabcopmg.exe
File created	C:\Windows\SysWOW64\Lakfeodm.exe	Lomjicei.exe
File opened for modification	C:\Windows\SysWOW64\Lfiokmkc.exe	Lckboblp.exe
File opened for modification	C:\Windows\SysWOW64\Njgqhicg.exe	Nbphglbe.exe
File created	C:\Windows\SysWOW64\Njogfipp.dll	Ncbafoge.exe
File opened for modification	C:\Windows\SysWOW64\Niojoeel.exe	Nfqnbjfi.exe
File created	C:\Windows\SysWOW64\Jikoopij.exe	Jeocna32.exe
File created	C:\Windows\SysWOW64\Kpikki32.dll	Opbean32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6168	3000	WerFault.exe	257

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjnnbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keifdpif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcclncbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lojmcdgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nofefp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Padnaq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfagighf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pafkgphl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kedlip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpepbgbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhjhmhhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcfbkpab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhegig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqmojd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbnlaldg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppikbm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcaipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njgqhicg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nijqcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbafoge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbejloe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jadgnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbccge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khgbqkhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhenai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loofnccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Niojoeel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppgomnai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqfima.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ljpaqmgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lakfeodm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nqaiecjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocgkan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqmhqapg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojhiogdd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ppnenlka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Joekag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiphjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpnjah32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lepleocn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Legben32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Obgohklm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojnfihmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ookoaokf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jocnlg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpjjmg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfenglqf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlofcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqklkbbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Piapkbeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjaleemj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kakmna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kabcopmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhnhajba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckboblp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jihbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jeocna32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lindkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loacdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjidgkog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpeiie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocnabm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jldbpl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiikpnmj.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blcnqjjo.dll"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnknop32.dll"	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jimldogg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiciojhd.dll"	Khgbqkhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kapfiqoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lepleocn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mleggmck.dll"	Lafmjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pninea32.dll"	Mjnnbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjphcf32.dll"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhmjl32.dll"	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kafkmp32.dll"	Jihbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fegbnohh.dll"	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbnlaldg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfiokmkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcdeeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgccelpk.dll"	Mlljnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjbog32.dll"	Jhnojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Defbaa32.dll"	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhegig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclnjo32.dll"	Njjmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emkbpmep.dll"	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pencqe32.dll"	Pplhhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mneoha32.dll"	Jhplpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaajhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmcfjdp.dll"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Picoja32.dll"	46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfgko32.dll"	Lljdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqhfoebo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knnele32.dll"	Kiikpnmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcmodajm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhjhmhhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iheocj32.dll"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcfpl32.dll"	Njbgmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhoped32.dll"	Padnaq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepleocn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdcajc32.dll"	Mcfbkpab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oblhcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Joekag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmgilf32.dll"	Mfenglqf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Padnaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpgdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kekbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mledmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnpn32.dll"	Mpeiie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Likage32.dll"	Omdieb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oflmnh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4852	1632	46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe	84
PID 4852 wrote to memory of 956	4852	Ilkoim32.exe	85
PID 956 wrote to memory of 3028	956	Iojkeh32.exe	86
PID 3028 wrote to memory of 2196	3028	Ihbponja.exe	87
PID 2196 wrote to memory of 1216	2196	Ipihpkkd.exe	88
PID 1216 wrote to memory of 4580	1216	Ilphdlqh.exe	89
PID 4580 wrote to memory of 4452	4580	Iondqhpl.exe	90
PID 4452 wrote to memory of 4380	4452	Jidinqpb.exe	91
PID 4380 wrote to memory of 2188	4380	Jlbejloe.exe	92
PID 2188 wrote to memory of 1760	2188	Jldbpl32.exe	93
PID 1760 wrote to memory of 4652	1760	Jocnlg32.exe	94
PID 4652 wrote to memory of 4616	4652	Jaajhb32.exe	95
PID 4616 wrote to memory of 1964	4616	Jemfhacc.exe	96
PID 1964 wrote to memory of 876	1964	Jihbip32.exe	97
PID 876 wrote to memory of 2792	876	Jlgoek32.exe	98
PID 2792 wrote to memory of 1996	2792	Jpbjfjci.exe	99
PID 1996 wrote to memory of 3872	1996	Joekag32.exe	100
PID 3872 wrote to memory of 2352	3872	Jadgnb32.exe	101
PID 2352 wrote to memory of 3716	2352	Jeocna32.exe	102
PID 3716 wrote to memory of 3828	3716	Jikoopij.exe	103
PID 3828 wrote to memory of 32	3828	Jhnojl32.exe	104
PID 32 wrote to memory of 2856	32	Jpegkj32.exe	105
PID 2856 wrote to memory of 4984	2856	Johggfha.exe	106
PID 4984 wrote to memory of 3976	4984	Jbccge32.exe	107
PID 3976 wrote to memory of 3516	3976	Jeapcq32.exe	108
PID 3516 wrote to memory of 3792	3516	Jimldogg.exe	109
PID 3792 wrote to memory of 2084	3792	Jhplpl32.exe	110
PID 2084 wrote to memory of 892	2084	Jpgdai32.exe	111
PID 892 wrote to memory of 4456	892	Jojdlfeo.exe	112
PID 4456 wrote to memory of 4708	4456	Jbepme32.exe	113
PID 4708 wrote to memory of 1828	4708	Kedlip32.exe	114
PID 1828 wrote to memory of 3616	1828	Kiphjo32.exe	115
PID 3616 wrote to memory of 2260	3616	Khbiello.exe	116
PID 2260 wrote to memory of 3964	2260	Kpiqfima.exe	117
PID 3964 wrote to memory of 1128	3964	Kbhmbdle.exe	118
PID 1128 wrote to memory of 3368	1128	Kakmna32.exe	119
PID 3368 wrote to memory of 4892	3368	Kefiopki.exe	120
PID 4892 wrote to memory of 4664	4892	Kheekkjl.exe	121
PID 4664 wrote to memory of 2656	4664	Klpakj32.exe	122
PID 2656 wrote to memory of 3744	2656	Koonge32.exe	123
PID 3744 wrote to memory of 4176	3744	Kcjjhdjb.exe	124
PID 4176 wrote to memory of 3552	4176	Keifdpif.exe	125
PID 3552 wrote to memory of 2708	3552	Kidben32.exe	126
PID 2708 wrote to memory of 1612	2708	Khgbqkhj.exe	127
PID 1612 wrote to memory of 64	1612	Kpnjah32.exe	128
PID 64 wrote to memory of 4264	64	Koajmepf.exe	129
PID 4264 wrote to memory of 5012	4264	Kapfiqoj.exe	130
PID 5012 wrote to memory of 4724	5012	Kekbjo32.exe	131
PID 4724 wrote to memory of 4300	4724	Kifojnol.exe	132
PID 4300 wrote to memory of 1556	4300	Klekfinp.exe	133
PID 1556 wrote to memory of 472	1556	Kpqggh32.exe	134
PID 472 wrote to memory of 4992	472	Kcoccc32.exe	135
PID 4992 wrote to memory of 2076	4992	Kabcopmg.exe	136
PID 2076 wrote to memory of 1212	2076	Kiikpnmj.exe	137
PID 1212 wrote to memory of 4576	1212	Klggli32.exe	138
PID 4576 wrote to memory of 4796	4576	Kpccmhdg.exe	139
PID 4796 wrote to memory of 1420	4796	Kofdhd32.exe	140
PID 1420 wrote to memory of 3232	1420	Kadpdp32.exe	141
PID 3232 wrote to memory of 1948	3232	Lepleocn.exe	142
PID 1948 wrote to memory of 2788	1948	Lhnhajba.exe	143
PID 2788 wrote to memory of 3896	2788	Lljdai32.exe	144
PID 3896 wrote to memory of 2080	3896	Lpepbgbd.exe	145
PID 2080 wrote to memory of 3824	2080	Lcclncbh.exe	146
PID 3824 wrote to memory of 3960	3824	Lafmjp32.exe	147

C:\Users\Admin\AppData\Local\Temp\46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe
"C:\Users\Admin\AppData\Local\Temp\46266bf89ae19a56eda5745b7df37f60af1011d8c088f00545b1fef559b7f968.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\Ilkoim32.exe
  C:\Windows\system32\Ilkoim32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\Iojkeh32.exe
    C:\Windows\system32\Iojkeh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\SysWOW64\Ihbponja.exe
      C:\Windows\system32\Ihbponja.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:32
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:892
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        34⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4300
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        56⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:656
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4180
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        71⤵
        Drops file in System32 directory
        
        PID:4972
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3260
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        73⤵
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        77⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3376
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4460
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2564
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        82⤵
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2388
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        84⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        85⤵
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        87⤵
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        88⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        89⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        91⤵
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        92⤵
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        94⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        95⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        96⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        97⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        98⤵
        Modifies registry class
        
        PID:5360
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        99⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        102⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        103⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        104⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        105⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        110⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        111⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5920
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        113⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        114⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        116⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        117⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        118⤵
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        119⤵
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4552
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        122⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        123⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        129⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        131⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        132⤵
        System Location Discovery: System Language Discovery
        
        PID:5568
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        134⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        135⤵
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        136⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        138⤵
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        139⤵
        Drops file in System32 directory
        
        PID:1776
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4360
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        143⤵
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3020
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        146⤵
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        147⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        148⤵
        Drops file in System32 directory
        
        PID:3096
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        149⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5704
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        154⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        156⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3624
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        158⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        159⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1232
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        161⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        163⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        165⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4728
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        167⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4584
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        170⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:988
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        174⤵
        Drops file in System32 directory
        
        PID:524
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        175⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 400
        176⤵
        Program crash
        
        PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3000 -ip 3000
1⤵
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ihbponja.exe

Path C:\Windows\SysWOW64\Ihbponja.exe
Size 112KB
SHA256 145c5f1665f4ff54a808e83fcaddd7dcfb5b33949a5727acf7cca6086ac7690f
MD5 f2311307dc11da10d8fb32a889ee1cdd
SHA1 6b494494fbf775b59d4e0e8184f62c51c3cb1b94
SHA512 5452e93b7f07ef5312ec6e931ba1b50683fe174e198fed8592c629bfc056a18f16455099b1a08b441704c200afaac725a9f2ced3d43c0292d65b86a2ed14ae42
SSDEEP 3072:YReYkyGkrozgPo2hJ+nygo3whr3M5eR3:JYkynEzgPo8Unygo3whrc5eR3
TLSH
T1B0B36A11E9F54E8ED8BD61B498351BF5D1EDC0AADD66236C2BBCD2C46BEB141B0C3242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilkoim32.exe

Path C:\Windows\SysWOW64\Ilkoim32.exe
Size 112KB
SHA256 21c98dfb91a8e4f3fad0105a2213af9a687b12fc342539d0e9fa09d56b99e901
MD5 dc0ad814e7c5eb5f3d643288f0059df6
SHA1 044d623389fffc0edf2b8829aeeb1bc75f6c0c0a
SHA512 093e0eef4434595784fb81c4454c483239e8f5abcb6ed74461d23001264090eca891109678969c8dcac8e5ffebfd7047441fa8d700486c8802fbf3a2188cf1cc
SSDEEP 1536:T1DTTkDd6+W46yZTOSzflLRUO/M2i6MC4CmoEEw+nkTgo3+/F1gUph3M5eR3:JfTMGGUOjMC2hJ+nygo3whr3M5eR3
TLSH
T158B349C5D1B48E9ED47C32F45865AF7E82E5C07AE93221EC6BB0D287B6EF05684C3245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ilphdlqh.exe

Path C:\Windows\SysWOW64\Ilphdlqh.exe
Size 112KB
SHA256 f01ebcd38f0d2a160c463bb36ebbfcc9ec885f44e49bdce4c7b91d0ccd83efc0
MD5 03ddc20eee2e9a4ddd8a89c1797b7f79
SHA1 b7e3597fe1539463ac96dcfbb02948949814f4f7
SHA512 aa7f355ebab87988594b8b6cb1d4c55a8a719f1fd3b408138d2f2f62da697d250ce4e5a920072193a6cc730d50ee2ecc0bcf8dee7634b6d174b74b0020b6dea9
SSDEEP 1536:TwC7bk12G9NZKb2cBYDmR4CmoEEw+nkTgo3+/F1gUph3M5eR3:kkaDvK6OR2hJ+nygo3whr3M5eR3
TLSH
T1D0B33812EAF4BE4EC4B9D0BB306617778DE4C36EF122E4AC57A1D28457F709685C3A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iojkeh32.exe

Path C:\Windows\SysWOW64\Iojkeh32.exe
Size 112KB
SHA256 b2070c5b121ad6d9c688428c9ff32a3e79d3dd7b629105bace95456e322eb70c
MD5 a96656d8f2d933cb9f0831c1dd76d902
SHA1 3421b8c127d59ab6c71f915676f8b3eba489e37f
SHA512 eb37801c127d2ed793e4cf25da50a3a77d4afd9c56b85402c47ed096cc0ef753bd11d61e3a567944cba706e1cc8f47a8addc7ed877c6d04f11c3f827fc6573c1
SSDEEP 1536:Tmu8GmXiFgHHNqi83axxEIRjlPb+omvja4CmoEEw+nkTgo3+/F1gUph3M5eR3:4WgHAlYH/56a2hJ+nygo3whr3M5eR3
TLSH
T1B8B3285EEEB5CA9EC4FCD1B5442A1736CEF1C87AC01A275DA7A1D28396FB055C4C3282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iondqhpl.exe

Path C:\Windows\SysWOW64\Iondqhpl.exe
Size 112KB
SHA256 4d39b6c2b39a4147d776c490a767a282baa854bdb3649b37b6a5184d863158ec
MD5 f44930a6fe57df3957081b27eae908de
SHA1 eda13397b2a411b1fa66777d2881ce67fad66987
SHA512 f250378c4247be50404be35244497babce2ef78a03f9d0ddb7c4e8f607898fe2d314cd24d1887108f8e20c66daf72726cbe31d6116f9ddac47c616123fca3ee0
SSDEEP 1536:TmwORsksqdUziFIHvQa5lvefq4CmoEEw+nkTgo3+/F1gUph3M5eR3:6wp6IHTluq2hJ+nygo3whr3M5eR3
TLSH
T15DB35A82D9B4799FC5F92DBAD42E1736C2D2C376DC3E10BC6BA5D25B52E704284C3A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ipihpkkd.exe

Path C:\Windows\SysWOW64\Ipihpkkd.exe
Size 112KB
SHA256 1e77f1641610b31aed04c6c7cbe94a3fb0b2c5909efc12c2a78f0ca205b12d8c
MD5 0440682efe5180ba786d8cfb790547e6
SHA1 97856a910a5eaa79f5e61c687d2edd107539c039
SHA512 6c79888d29cfcc0c14829ce18bdf24bb2827dd95fb62086ec211d667049aef17ba85347f899aeef82b15d0f9545784bfa2162fd45463ee9f3eb32b57800540ff
SSDEEP 1536:T8b9QPK6BA+fmTMDGH2YdO4CmoEEw+nkTgo3+/F1gUph3M5eR3:Qb9QPPFfmMDMO2hJ+nygo3whr3M5eR3
TLSH
T174B32961E5B0DE5EE8B95DB5183663B2C2DCC0AAD76275DC27A8C3C482EB156C4C39C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jaajhb32.exe

Path C:\Windows\SysWOW64\Jaajhb32.exe
Size 112KB
SHA256 388af47d6562d7609be47f68bbd98acd09738620ad550ceafc3da8cae497e2f4
MD5 1c3492d4c5957d79f4093756e780982f
SHA1 6784643ae3d6a64bcdfaac858c7099e0deb73f10
SHA512 94126133d6cc477cffd7e6ca2f19e9cab7a07145facb30f01911a4da92e9307e56922008ba468e79483acc7f12f127948ee692ac29100619e65410f6fe2acebb
SSDEEP 1536:TOH93AeHG6xZ/ZakOT4CmoEEw+nkTgo3+/F1gUph3M5eR3:+Tt5ZGT2hJ+nygo3whr3M5eR3
TLSH
T13CB35A35F6B18EAED43961B85825577EC1D2C7B6F1375C2D1BA0C28912FB1C289B32B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jadgnb32.exe

Path C:\Windows\SysWOW64\Jadgnb32.exe
Size 112KB
SHA256 79fc6f7f1c4bf862077e0f5dbffa327c778df282e7d0cd5c0d5dd6fd5635ed26
MD5 e33db17774f4f2bd178429e2cd56f071
SHA1 f3c381806bccee8ba335a366d5fc98902c32fcdd
SHA512 cfbcaf2bedd748a42e51bf00a92e773447e7935239a81bfee7809d551c2c1808fbab43d993c533d270214925040871569be607b2ff8c06c820031cb9e2ecd1b2
SSDEEP 3072:MCrGZ1k60k7c5yi2hJ+nygo3whr3M5eR3:MCA1p0k7hi8Unygo3whrc5eR3
TLSH
T121B32791F6B58EBFC87921719439B372C5E0C57AD3E2AF6C6BA4C38B96EB05080C7541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbccge32.exe

Path C:\Windows\SysWOW64\Jbccge32.exe
Size 112KB
SHA256 04047dff97b49a8a8b00b518189d81bce69a068e495acb2cab2ab8487cb2808f
MD5 5e2a6b82dab146a7d81121d628f31324
SHA1 2642bc1199ccb552cf6d3cdccf6a017b2f657188
SHA512 6fcf9785820a3a7cbed166c3ff32f92ffa511d5d713333fff4e3b2f5d4efd6f7ac0795e51197ee6c64c441c75e0f19a5766dab997764644aa84230c2be956c50
SSDEEP 3072:1zvczxuOAFpwnYuXBM2hJ+nygo3whr3M5eR3:qxuOapXAM8Unygo3whrc5eR3
TLSH
T1CBB31610EAB0B9BDC47C11BF1325273699E3847EC0E2606C27A0D6986AFB156D8C7D7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jbepme32.exe

Path C:\Windows\SysWOW64\Jbepme32.exe
Size 112KB
SHA256 9c25d03f425b45f16929ef8432329c01468822832c2fdf0935219deccade2469
MD5 8c4d06a6e03875b834e27631ef64d9de
SHA1 58e66c6b0b6cd6a4b4fd7d2fdb099c080d13ca54
SHA512 bdf54d006ac8d217162932aa553523cb73b1552428dcce89f2a7ea9c6e323fb60c35dbb15594e9494ab4e53001000b950c1bacaebf2c9c17c6f73f0b53939745
SSDEEP 3072:VU9EaybAt/GXyL8SsG0n0W2hJ+nygo3whr3M5eR3:VU9Eay2/5L8390W8Unygo3whrc5eR3
TLSH
T121B33844EAB44E8ECC7855B1D464E3F2B2E1C07AE11E33FF6BA1D69756EB01294836C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jeapcq32.exe

Path C:\Windows\SysWOW64\Jeapcq32.exe
Size 112KB
SHA256 d02af417fc5d8ebd12959bebe257e2d0be7415825392786c9eb9748f2bff012a
MD5 ee5cb4d93371891ff815d5197b4e48a4
SHA1 131f3a2967fea202ec2d4866f47486216b3333d7
SHA512 4049e4e7da9cf2af5b9725234823136de64f980d40f572c044107b3e06cab626d39d16cd21c067f1217bbadecf540e7473573c7bf4dd9c88fa234526d6fb6ba4
SSDEEP 3072:bG0qHn4CNCauCw2hJ+nygo3whr3M5eR3:lqHHUSw8Unygo3whrc5eR3
TLSH
T121B33915E4F48E8FC4FA22B02562677685E1C97BDDA7B1AC6F64C2809EEB24680C35C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jemfhacc.exe

Path C:\Windows\SysWOW64\Jemfhacc.exe
Size 112KB
SHA256 7fe10696671b27ea1d0543f88a7399be04d0a4ded84e8a727b6e246c2274a84e
MD5 a94edebb47eb77c58ab66039b6c56ed0
SHA1 d3fd3b8b34b70b00dd9a7f12f7c9ccd7b582743a
SHA512 a104ff7e305aa239ad3da3a70cc197b75f4442177705f2cf2e4ecebd43e47de6e1a10534685918615163a284cb50cf4608058a9f611be981e61f024a526784ec
SSDEEP 3072:hK+cC23ti5cpMIt2hJ+nygo3whr3M5eR3:hK+cC23ti5cp1t8Unygo3whrc5eR3
TLSH
T11CB36983D5B97E8EC47861B15731537AC1E0C0BEE227289CE7A0D68B62FB09587DF581
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jeocna32.exe

Path C:\Windows\SysWOW64\Jeocna32.exe
Size 112KB
SHA256 4260b685b1396829a069d13aff5e16c68f20ef62f7d11f15f8aca40a143ceb8e
MD5 8a8bb7790551fa6cad095fb11d25054b
SHA1 f6c4cc037c48e329aef3925274fe42e683afdda5
SHA512 ede83629e1fa8a222525916f220a38be95c2cdedf4bf5d8c0707176e05d11fb7bac0fdf6656b83d5ce869f1d1e4ab2a4de4b2384b92ccce6ff2d977bbe8f51d9
SSDEEP 1536:TzWogyxOC6liif4CmoEEw+nkTgo3+/F1gUph3M5eR3:7gyxtif2hJ+nygo3whr3M5eR3
TLSH
T1C5B3060FE6B97E4EC87853B5142A5F7281E0C06BEF23699C67D0828552E71BE84D7F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhnojl32.exe

Path C:\Windows\SysWOW64\Jhnojl32.exe
Size 112KB
SHA256 06d8a70fb007d24a203a48a6026aaa510c7e1664fcf8ce4785f75854f81e8762
MD5 0f1472258341d0c67e1239935650a586
SHA1 4d41a4158ade5ec470fa0e9dd455893b4182723a
SHA512 4aa1a35b5f5f263acdcdac4bcd96075040db6929f617afa716aaedabdb3bbaaf3dcea748594b276db0746ba3e4b03ec050c7464c0b1accac66b2b523f13d64cf
SSDEEP 3072:my7e1ZvctxQwtv47O6y2hJ+nygo3whr3M5eR3:VqGtbwi6y8Unygo3whrc5eR3
TLSH
T15BB3285CE9BD4EBEC4B561B4182253B5CFE1F0A9D123A2DC2FA4B6445AE70D1838F543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jhplpl32.exe

Path C:\Windows\SysWOW64\Jhplpl32.exe
Size 112KB
SHA256 b9c4f2e81a0e598bc7427ae5d122306fe6d9ba349b2e0b726d7c59148c6ef993
MD5 e3f9336a9d73ab31039449887dd2a0db
SHA1 7fd0f3dba5a5e34365cb4cb438737ed8f75643a0
SHA512 0113156cfaf642671dbca550b1df2777ce8ca0c8cf320c23b9484a047f906139184771b26ac378a448a2b4207706acaf4ffd80fdea949c2355a12f7007b1ac20
SSDEEP 3072:h5V3zKmFvFZVTv8Q9v2hJ+nygo3whr3M5eR3:p3Xxlo6v8Unygo3whrc5eR3
TLSH
T17AB3381EF6BD9EBEC87511FA10311B32B5E0D46AD0E2A16C3FB5E75996E704480C398E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jidinqpb.exe

Path C:\Windows\SysWOW64\Jidinqpb.exe
Size 112KB
SHA256 4f0ab5fdd43ff93ec9a2e71a206869b32dd9c0e25fd1d4e934982fde828ff336
MD5 2cf82f67657e98bf8eac8d5399177b60
SHA1 0f972dfa54ebd92a3660620eb6fe60cf1f3a0d2c
SHA512 3e9022beaba3bc7c51e5601fb68ea99dea0824df575d4f1c410398043a3d1ca33794b247fcaa63589cb29e69e3a82b802284fed47e882304a8d1e6f7b6d8ffa1
SSDEEP 3072:1BKOfjf/JyD7sxfi82hJ+nygo3whr3M5eR3:3KGjf/Jycxa88Unygo3whrc5eR3
TLSH
T1F5B32749E5B9CA4ECBFB55B598B543B282E0C026E4336158EBECCE4476FB056C4C3786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jihbip32.exe

Path C:\Windows\SysWOW64\Jihbip32.exe
Size 112KB
SHA256 64252de2614aa26c7d056e14e369709db9750697f0354821044de8135f130fb4
MD5 c1e89f5f66c23fa05c5db74ef4c653e0
SHA1 41a18374c336d2450707fcbdbb3d226faca64231
SHA512 1069fde36059fd35dfadd68e9b4c76eb605548e02c77e399acba87fef2c043e8d14af0f03b2f854be51588ea0f13f2a3a3cd78b015df24e949d09f5b94fd04b6
SSDEEP 3072:PubykCW7xqaTMs99w6yZDRKU2hJ+nygo3whr3M5eR3:Pubyko6yZDgU8Unygo3whrc5eR3
TLSH
T1BAB36CC2F9BA4EFEC4B822B5D436173D81E0C5BEF26261AC67A0E24572FB51694C314D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jikoopij.exe

Path C:\Windows\SysWOW64\Jikoopij.exe
Size 112KB
SHA256 1614a362ac11ef04b14843b7025f960d79980c5701b572b0f99b1853f51e0553
MD5 e6371eca08fd0325b950c606dd765786
SHA1 fddf632404f8564f56a9c1be098de361c91373f0
SHA512 3bdb925f9f6f1393d6d2b344ad6baed3d1fa078e96e13eb02525e96de51669b3990c9b63739f9e8e88dfdec331cc241c49b96b0ad794f1b968ca7c7b38ee4a4b
SSDEEP 3072:78q3o+41cCL4+SS2hJ+nygo3whr3M5eR3:o2IcD+SS8Unygo3whrc5eR3
TLSH
T1A9B34811E5B48E8EE4F861B01A712372D2E0C1EBE262F16E37A4C68856FB1579CF3741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jimldogg.exe

Path C:\Windows\SysWOW64\Jimldogg.exe
Size 112KB
SHA256 679dd8e5e5a9f8260dced60c0d460722a0a9200796bb8375f52adfe422d7231a
MD5 337f52d01dc332f4ce1eee379e9ad4c4
SHA1 f1ac10f8e2322a40f3afdac9c1b0d70ab69a2ba5
SHA512 59a2e0171752661e3ea9b01c73cf4e78ca1647b256503643441c58010a273177f89c7dd52d7ebd03c9281f0482769d7dd2b403b0eec67d108c7b7b07a69bb0d1
SSDEEP 3072:BIOI+lYkaZZjWO5eZ5sNNoy2hJ+nygo3whr3M5eR3:BdldOf5eZ5sNNoy8Unygo3whrc5eR3
TLSH
T170B35C19E5BB5EAEC43861B594362F7FB1E1F1F6D02760AC5BA1C284E7F70968083D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlbejloe.exe

Path C:\Windows\SysWOW64\Jlbejloe.exe
Size 112KB
SHA256 28dbdf91fdf2bd8e26cd2fcb76b9769c285e082853d9ae2a5e6c91b839d094ac
MD5 faaacf9ab3e495c6e94d5b92ca63b3b1
SHA1 d27d81fc8be2c3940869b25d19a7c3f1f60a2bc6
SHA512 1b55901c53a4f385967ad4314885658d3a3af6ee728d62d3e999b4465787911fe902a4d84793eb87fcbe5afb277c1242b480c86050977b6557b339a9bff99c2e
SSDEEP 1536:TtEf1ILE3uDUH31sqD7HkpnpNL4CmoEEw+nkTgo3+/F1gUph3M5eR3:IzeDOFsy7MnvL2hJ+nygo3whr3M5eR3
TLSH
T162B3586AE1BB4EBEF5BD62B414329F31C2E1C5A7D572505C7FA1D25A8AE70418CC30B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jldbpl32.exe

Path C:\Windows\SysWOW64\Jldbpl32.exe
Size 112KB
SHA256 bb2d278d87f28713e5e818b57265efcde6d9211e49243dbe512b1e1b7ceb10a6
MD5 959f0cc2bab219beb5353f137a4fb03b
SHA1 d15e5e4c69d1eb511fc20d687ff55af62df96982
SHA512 e79ee7e03d9c2913a1fa3adf7c2575858016dad81919b94cf3f0cf4af74bd2b35d1895372c9d79d6d3abd774657a32c753c461b350cea6ea46e378c6c6a40dd2
SSDEEP 3072:xjXvsqpJ6bMKth2hJ+nygo3whr3M5eR3:xWbMKth8Unygo3whrc5eR3
TLSH
T16EB35A14E4B48EBEC8386DB550B55B72C2E6CC7AE1A7147E3BB5DE806AFB40684C7143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jlgoek32.exe

Path C:\Windows\SysWOW64\Jlgoek32.exe
Size 112KB
SHA256 eb083a665a799f0f3450a2ff46c944789ad3e88a9e866a9aa3f04ba38b68f2a5
MD5 825c363d4f3deab2ff398eb83db33cfc
SHA1 d6859fe05c5acbf8da1d57019edd46852f8b390f
SHA512 c88e82021dfbc1cbda6b1457a9d54e017042068884205898035f73701accf0e2c4327a3845807ac02a84e80b75ccbfbaab408fbe43326066a5f4036921f07d09
SSDEEP 3072:njnFWCf794/SvzJGr2hJ+nygo3whr3M5eR3:njjR4sQr8Unygo3whrc5eR3
TLSH
T18DB35942D9F58E9FCBF911B9C7665375C1E5C0BAD027A89C27E1D2A48AFF00980C7E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jocnlg32.exe

Path C:\Windows\SysWOW64\Jocnlg32.exe
Size 112KB
SHA256 25bee839505e3d8eca548f95fd258a1e0eedbd79a86117465e7a026a25eb64e3
MD5 b5409546a5a9103f73f5d7d8a017e0ad
SHA1 a5953cc343f162ea3fe6620d80d8b601fbff3adb
SHA512 5a4a211609c338927541cabfeb2e8aa8d4685912379be1ead7cf8f5ebee2a5737920214e7f74fb5830a377656f2d434a1d2bd7f789677229ece0504c21520d33
SSDEEP 1536:T+7ZGGNsOFGA3Ou8aJRELEV44CmoEEw+nkTgo3+/F1gUph3M5eR3:i7ZG4wm56LEV42hJ+nygo3whr3M5eR3
TLSH
T1B9B33816E5B88B8EC8B91DB404729F7581E1F5BBC263615C7FE0E28786FB15688D32C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Joekag32.exe

Path C:\Windows\SysWOW64\Joekag32.exe
Size 112KB
SHA256 bdfc0485d29fe68d5886f6c2c410eb8b982341fbb5ba7eea860c26a89a704742
MD5 3fcac1fb62bfeecfb4204e368c79b7e2
SHA1 33f25b5dd61061fbe311db08c6778686488a8ee8
SHA512 4181ce394f8b3f98890847da310ee68a0e1b0560e1334985849dd0d9381900babdf0df81459c3f2ab0661cad5b7304b912c090e92c01a4ff94fb7456f6bb9b1f
SSDEEP 1536:Tx1W+MXDgBaSirnQHF5nLfJk4CmoEEw+nkTgo3+/F1gUph3M5eR3:l1PJosTndk2hJ+nygo3whr3M5eR3
TLSH
T17FB3E31DEAB0BE8EC4BC21B11F21E7B5C2E484B2DC6F986867D5C69496FB11DC09F580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Johggfha.exe

Path C:\Windows\SysWOW64\Johggfha.exe
Size 112KB
SHA256 6af2657198d1bf34d4712fafa778fc136c6770938510a7deeb718e9fc79ca612
MD5 7a79f2b9dcf165464172df70ee97f2e3
SHA1 55326c9be6a00e48f5d390c9835ed45148eee3b0
SHA512 935ed41e5ebdde325a14ab7b2f0d08451dbb9cfe40a8c294b52d66a335390a438950d913673de8d900c0fcb85ce89edf67cf88eb525d011280df82060967de87
SSDEEP 3072:LqJ/Yc5MANR6wXuEH23JlIhw2hJ+nygo3whr3M5eR3:LqJ/35MANR6wXuEHkJlsw8Unygo3whrh
TLSH
T1D2B33871E5B85E8EC47C51B70C36273595E1C46AD522E0AD63AFB2F567EB01CC083E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jojdlfeo.exe

Path C:\Windows\SysWOW64\Jojdlfeo.exe
Size 112KB
SHA256 fc9b4e4ddfc1e76fb5fe2e8f3ccc3cfd472b8cf76e66729c305dac323e9244d6
MD5 0a6feae9eb485fa0efde55e29bf10503
SHA1 1efee49df941528f134200fec375d7a7e510b65f
SHA512 77f8348e7c575a2495edab7ab5950f4dd05924ef62c2f05322299eea0ab48593baf509ee8737e6ef9f1486c4dc68b84cfbd95dad21457d9ed555a7a55a19cf57
SSDEEP 3072:7VbNR2AdGlyHaD2hJ+nygo3whr3M5eR3:xbNRdbaD8Unygo3whrc5eR3
TLSH
T1FDB33931F5B45E5EC1BCD0B8A9A42336C2E4C0BAD0E6619C3B60D25856FBD6584FF683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpbjfjci.exe

Path C:\Windows\SysWOW64\Jpbjfjci.exe
Size 112KB
SHA256 6ec841c49027d0f2d5d8192596bce407f9ef51e98b9f9f094ff12baedb2faf35
MD5 97b9830a6b59be8685ecd595505ac7bb
SHA1 790e496e36ceb839b7531d1f4deb341870bd6534
SHA512 b9026bc09cde2ef3f71ab955a39d16b16d3fb6a8a6f770e32cfdce239a98d1ba6005df3e80315aa7d2a09327895a4f24addfe1f33d881bf7a142bffd4531badb
SSDEEP 3072:UwVDwb9v5BdkKbZH2/2hJ+nygo3whr3M5eR3:5yxBdT8/8Unygo3whrc5eR3
TLSH
T17AB31676D6F48E9DC47A61B4D3E1B337C1E1C4AAF1D3619C6BADC28853E706A8087193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpegkj32.exe

Path C:\Windows\SysWOW64\Jpegkj32.exe
Size 112KB
SHA256 07463a0b936f18a10131376216d2672f6f0446b45eb3e553516a8580bfb240e8
MD5 bcd464850a59478e92af9f8e2aef2841
SHA1 5b35d077e13337d3852975e718c294c744b07861
SHA512 7c4991aad49503f10b395aa16a943192121e2d9880da5099a3dd241a51e044e9e0a3f36d9cd1efc6618856163609086847e24e1c8a20b7d64e1310d63b60a1fd
SSDEEP 3072:Y1cw3EQpWsAkIr2hJ+nygo3whr3M5eR3:43EQpWYIr8Unygo3whrc5eR3
TLSH
T10BB36B19E9B45E8ED4F561B450F61BB6C1E0C07BD237615CEBA5C284DAE70BB8CC3982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jpgdai32.exe

Path C:\Windows\SysWOW64\Jpgdai32.exe
Size 112KB
SHA256 95342bc093dbc6d17a63c9b94e274a2e4ac780987fe38b9684c8961997d30aed
MD5 56212906a87d40471020f12338dcf910
SHA1 4635ec53d7ce7277897f6fffd5edcbdb0f41dea1
SHA512 0517d1628ee4fbed0fcf290b9eb4bc6cabe83574d0a3b6d480cda182a9af5bdf759a3bcfd04bd12ece6a4144c5cd0042dfd1afbb19a635d9edc83dcaa1e107e1
SSDEEP 3072:bBGHdaoHrk3UgX6U2hJ+nygo3whr3M5eR3:bYroUgX6U8Unygo3whrc5eR3
TLSH
T125B36B41E5B05E9EC4B962B054760736C1E1CD7AEC72B05C7BA9E299CBFB1598CC3AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kedlip32.exe

Path C:\Windows\SysWOW64\Kedlip32.exe
Size 112KB
SHA256 fa7fbcd7548e98ce87ed7e78bd52e352b16ab925f44fc85449f9d18ea6d5b93b
MD5 b9c9d76f4a12006f4112cafd123941da
SHA1 9fa24e6a068c6b3d9fc6232ce9646d27b1654a50
SHA512 b4dafbb95dfc69f415ea05378e03f690b1a8599623ca146e3434d0597b23d34419e4b7c0fcab7df424ea95851ef9d74064eea70e604541b699c0be2b983b417d
SSDEEP 3072:qigq6y638ICaLaiIkHL2hJ+nygo3whr3M5eR3:qu6x/CzijHL8Unygo3whrc5eR3
TLSH
T136B33924D6B40AAEC9FB11BD632557B2C3D4C866C236629CEBA1C645DEFFC1680F3541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Khbiello.exe

Path C:\Windows\SysWOW64\Khbiello.exe
Size 112KB
SHA256 d6316eaf1a9c78cbac0dc2b75f0421952c7331ad811c7053b0d969736477d08f
MD5 a6bbc3de46de41c0d4262199b77ee795
SHA1 7a8edc8d97b48acf0980da7cc7fa71c045a891fb
SHA512 0fe06f7614b513e82d49c4d5c025a93878db3027ace22fb368d4fdc9f44120ae954a5de9a947d615d81bd4b7d3412a1875a538a8cb432ae0da6a8b57822b340c
SSDEEP 3072:fJ6pH3r/HnQxwwFG++2hJ+nygo3whr3M5eR3:fG6k++8Unygo3whrc5eR3
TLSH
T16DB33811F8B35F4EC4FA62F11C35AFB6C1E0C8B6F16E656C67A0C294A6E701690F7642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kiphjo32.exe

Path C:\Windows\SysWOW64\Kiphjo32.exe
Size 112KB
SHA256 59b8cb02594b2481a43c9668d2cde01595c6d5bb775414979cde0ee2c3fcb923
MD5 1a0d0f9b301b6d9230b0fd9702ec9771
SHA1 58ba5a5660c6ec73659fcb2b8ffceecb5956f829
SHA512 a10495d91c7ac42871ecd45b792918f811090f528abfa4e5008cb291f5b39002e44cf85e77c1bc5d5bb01077f720c10420e34866dcd537e02b24746ccb6eb29e
SSDEEP 1536:THiRx/tV7nVQGCXrCbkbU74c4CmoEEw+nkTgo3+/F1gUph3M5eR3:LYV74XGbko4c2hJ+nygo3whr3M5eR3
TLSH
T10BB33821E5F4CE9ECB7D20B55C222376C2E8CC7AF52269EC67A7C25846FB05AC4C3951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Omfekbdh.exe

Path C:\Windows\SysWOW64\Omfekbdh.exe
Size 112KB
SHA256 51b5186f34864cfafb4ea70c3b02c9a82bc4939b5763d4cc1578d8e181158208
MD5 456104c9740154915fb66b45abd04d87
SHA1 dd2b55ef738fa5b3650ef926d3389c5fab8ab9d8
SHA512 bd51c51832509583b67403156f68c1848a438ca6e8e92a640b7fa49a246e4866a0ef4c2a3505a29e2a1300de75838dd9e37b95fe57346ba088ef29f4dfdc32e1
SSDEEP 3072:Urd+zv/aNNNNNNNNNNNNNNtNNNNNNG7NNNNNN4qu5A2hJ+nygo3whr3M5eR3:y8/aNNNNNNNNNNNNNNtNNNNNNG7NNNN1
TLSH
T1C5B32790DAB49A9EF4B972F214E10B7585D1C4B6C06223DCF7F6DE8D52EBC5A81832C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Piapkbeg.exe

Path C:\Windows\SysWOW64\Piapkbeg.exe
Size 112KB
SHA256 b338bbad42002efb0834e0a02503ef45945f9fbbae325faacb43c8ed80bd45ee
MD5 aa10328d3a5e315ac28cab3f911d397f
SHA1 c0a498c69363f1c6b6c16b0ba56cc9efc63d05ec
SHA512 b02873de2b58f3a07496c6953cf9c23b858f2e187fb210b122de353fe83680814d524fcbbc50792f0f70c2073be845f9cb3b82b7976901b4e6e9233bc01f109d
SSDEEP 3072:i3lGi3aL2XzoqJqrGstaaaabQ2hJ+nygo3whr3M5eR3:WlGgaL28qJqXQ8Unygo3whrc5eR3
TLSH
T172B32802E9F18EDEC5BA22F664255371C1EDC77AE536326CBBE4C28456EB04783C7582
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pjaleemj.exe

Path C:\Windows\SysWOW64\Pjaleemj.exe
Size 112KB
SHA256 5203ad97402c1b5c03325755e14fc68b7cccbe806cd16aa7c0257943379ac150
MD5 b0d29935216f99a6fbd5dcb5477d7562
SHA1 144a88927c48db013c55de8efec1109685a5b5f1
SHA512 c9fecd5ee0fa5860bd188ead442df6b602dc3ef730d769f6057140c3d175c5ff72f42d07895669769e4c2b84b7f1fc910620d9985fd2159195e3301504e7a1a1
SSDEEP 3072:KixS318DTj1e/d99sZYD2hJ+nygo3whr3M5eR3:9Sl8DVS99smD8Unygo3whrc5eR3
TLSH
T1D0B36C13E9B48F8EDC7960BA1875137AC2E1C8F6D16362DCF7A1C69855FB01781C368A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ppikbm32.exe

Path C:\Windows\SysWOW64\Ppikbm32.exe
Size 112KB
SHA256 eab4065e75dbeb32fe9a84e8ed982f0bd483252f608bd4e25ea6d4b661bb6c6a
MD5 29cbf6ca1235f51aa3189378e9c2ddf2
SHA1 98305a74b10ece5401918735d45b030b7dbf2efa
SHA512 fe32fc43518fab7908ce5f73a3881b645c969fa653597ea07caff2fdf2b0fd50305415d050fbe029de7997c77a6c554cd7f17f1c889a322aef3e9a3ec80f1a63
SSDEEP 3072:JKyiqVfs/qHSaMF1MW72hJ+nygo3whr3M5eR3:wzV/qHSaMFeW78Unygo3whrc5eR3
TLSH
T199B34A80EDF04E9EC47839B828F557F682D0C8BED136527D6BE2D279A6EB09D84C3541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-173-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/64-339-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/472-375-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/656-459-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/876-117-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/892-229-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/952-570-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/956-16-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/956-563-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1104-471-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1128-279-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1212-393-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1216-583-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1420-411-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1468-465-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1556-369-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1612-333-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1632-543-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1632-5-0x0000000000432000-0x0000000000433000-memory.dmp

Download

memory/1632-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1760-85-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1828-253-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1948-423-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1964-109-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1996-133-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2076-387-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2080-441-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2084-221-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2188-77-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2196-576-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2196-33-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2260-267-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2352-149-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2380-525-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2388-564-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2564-550-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2576-590-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2656-303-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2708-327-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2788-429-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2792-125-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2856-181-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3028-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3220-557-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3232-417-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3260-495-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3300-584-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3368-285-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3376-531-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3424-544-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3516-205-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3544-519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3552-321-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3616-261-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3716-157-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3744-309-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3792-213-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3824-447-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3828-165-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3872-141-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3896-435-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3960-453-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3964-273-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3976-197-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4100-597-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4176-315-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4180-477-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4264-345-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4300-363-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4356-513-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4380-603-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4380-65-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4452-596-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4452-57-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4456-237-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4460-537-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4496-501-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4568-507-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4576-399-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4580-53-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4616-101-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4652-94-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-297-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4708-245-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4724-357-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4796-405-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4852-556-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4852-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4860-577-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4864-483-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4892-291-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4972-489-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4984-189-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4992-381-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5012-351-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5508-1190-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5888-1181-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads