berbew | 3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9.exe
Size 91KB
Sample260910-sb53fsdp5x
SHA256 3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9
MD5 0cdaae71a9c6a3700ce3693f4186a185
SHA1 8c01e9b9d454408221cac26449ed5f7a6e67fa03
SHA512 fed0423238275777f946ab97feea3e9c188128ddb426493d858f851997e824b79652b33ba2c11299a94d4edd5b155a701a35e06a3451fd8a4c2d06164b30be58
SSDEEP 1536:1uaDHHtoijRG5+QF3fi3MgqUqmmD2LFJTN7DqQfV5I+GCmBhjFW+JCYTDP0:1ZN/O+UgFVwQ9bGCmBJFWpoP0
TLSH
T1F7934AEE75390FB2C18D0272513B55C6F7EA40AED23B86801478CCAC3767E6C52B6799
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery berbew persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm

Signatures

Family: Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikhghi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbhka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkldg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kokbpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hahlnefd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hipdpbgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijkdkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpenmadn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncecioib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndgpnogo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hadcce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpgalc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liabjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmccnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmfhjhdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcbmlbig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikcmmjkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hleneo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hafpiehg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkqhpmkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhnkppbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmccnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiajck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkflpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbmlbig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbecljnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iameid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbieebha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjbjlpga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kicfijal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhiaepfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmfaafej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gehice32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hocjaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjefao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcbded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpinac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcicma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncbfcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhkecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hembndee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hipdpbgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkcfch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcknee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhjcbljf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbedaand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmmedi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gahcgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gajpmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kicfijal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcikfcab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmkbeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmfaafej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nipokfil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmpdgdmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoefgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjlmbnof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjinjnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkmijf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gahcgg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hebkid32.exe

Executes dropped EXE 64 IoCs

pid	Process
4952	Fhkecb32.exe
2136	Fkiapn32.exe
1504	Ghmbib32.exe
4724	Gaffbg32.exe
2808	Gbecljnl.exe
4848	Gahcgg32.exe
3032	Giokid32.exe
4528	Ghbkdald.exe
4536	Gkqhpmkg.exe
3292	Gbhpajlj.exe
2500	Gajpmg32.exe
2560	Giahndcf.exe
4244	Glpdjpbj.exe
3208	Gooqfkan.exe
4092	Gammbfqa.exe
3532	Gehice32.exe
220	Ghgeoq32.exe
1356	Glbapoqh.exe
540	Gkeakl32.exe
396	Gclimi32.exe
2276	Gaoihfoo.exe
4636	Gekeie32.exe
2380	Hhiaepfl.exe
976	Hleneo32.exe
2936	Hkgnalep.exe
1832	Hocjaj32.exe
3116	Hcofbifb.exe
2340	Hembndee.exe
2280	Hiinoc32.exe
1428	Hhlnjpdi.exe
2208	Hlgjko32.exe
4756	Hoefgj32.exe
4516	Hcabhido.exe
2140	Hadcce32.exe
556	Hikkdc32.exe
3264	Hhnkppbf.exe
4004	Hklglk32.exe
4996	Hohcmjic.exe
4820	Hafpiehg.exe
4836	Hebkid32.exe
1996	Hhpheo32.exe
3128	Hkodak32.exe
2428	Hcflch32.exe
4920	Hahlnefd.exe
3744	Hipdpbgf.exe
3824	Hhbdko32.exe
4332	Hkaqgjme.exe
3336	Hommhi32.exe
1648	Hakidd32.exe
4684	Iibaeb32.exe
1012	Ilqmam32.exe
4120	Ikcmmjkb.exe
4968	Icjengld.exe
3176	Iameid32.exe
3544	Ijdnka32.exe
4668	Ilcjgm32.exe
1352	Ioafchai.exe
920	Iapbodql.exe
1844	Ieknpb32.exe
4352	Ihjjln32.exe
3436	Ikhghi32.exe
3284	Iocchhof.exe
1392	Iabodcnj.exe
3936	Ijigfaol.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hleneo32.exe	Hhiaepfl.exe
File created	C:\Windows\SysWOW64\Pdmgmj32.dll	Jcmkjeko.exe
File created	C:\Windows\SysWOW64\Miikdm32.dll	Ljephmgl.exe
File opened for modification	C:\Windows\SysWOW64\Nbefolao.exe	Ncbfcp32.exe
File opened for modification	C:\Windows\SysWOW64\Gooqfkan.exe	Glpdjpbj.exe
File created	C:\Windows\SysWOW64\Ndkfpm32.dll	Gaoihfoo.exe
File created	C:\Windows\SysWOW64\Jjpmfpid.exe	Jbieebha.exe
File created	C:\Windows\SysWOW64\Cklmbbeg.dll	Jbnopbdl.exe
File created	C:\Windows\SysWOW64\Ajkkcn32.dll	Mppdbb32.exe
File created	C:\Windows\SysWOW64\Gaffbg32.exe	Ghmbib32.exe
File created	C:\Windows\SysWOW64\Fclddi32.dll	Iofpnhmc.exe
File created	C:\Windows\SysWOW64\Kkdoje32.exe	Kmaooihb.exe
File created	C:\Windows\SysWOW64\Ndgpnogo.exe	Nlphmafm.exe
File created	C:\Windows\SysWOW64\Hebkid32.exe	Hafpiehg.exe
File created	C:\Windows\SysWOW64\Hngakd32.dll	Lmfhjhdm.exe
File opened for modification	C:\Windows\SysWOW64\Lmheph32.exe	Limioiia.exe
File created	C:\Windows\SysWOW64\Nleaha32.exe	Nifele32.exe
File created	C:\Windows\SysWOW64\Mbiiah32.dll	Hlgjko32.exe
File opened for modification	C:\Windows\SysWOW64\Hklglk32.exe	Hhnkppbf.exe
File created	C:\Windows\SysWOW64\Jjbjlpga.exe	Jbkbkbfo.exe
File created	C:\Windows\SysWOW64\Nipokfil.exe	Njmopj32.exe
File created	C:\Windows\SysWOW64\Hadcce32.exe	Hcabhido.exe
File created	C:\Windows\SysWOW64\Kpbljo32.dll	Ikcmmjkb.exe
File opened for modification	C:\Windows\SysWOW64\Iameid32.exe	Icjengld.exe
File opened for modification	C:\Windows\SysWOW64\Gkqhpmkg.exe	Ghbkdald.exe
File created	C:\Windows\SysWOW64\Pmhaae32.dll	Glbapoqh.exe
File created	C:\Windows\SysWOW64\Gclimi32.exe	Gkeakl32.exe
File created	C:\Windows\SysWOW64\Bgbmqpej.dll	Nmpdgdmp.exe
File created	C:\Windows\SysWOW64\Mopabjci.dll	Iljpgl32.exe
File created	C:\Windows\SysWOW64\Jokiig32.exe	Jllmml32.exe
File created	C:\Windows\SysWOW64\Jqfkba32.dll	Ghgeoq32.exe
File created	C:\Windows\SysWOW64\Oqadklae.dll	Ijigfaol.exe
File created	C:\Windows\SysWOW64\Emmdjc32.dll	Jhcmbm32.exe
File created	C:\Windows\SysWOW64\Jcknee32.exe	Jkcfch32.exe
File opened for modification	C:\Windows\SysWOW64\Hoefgj32.exe	Hlgjko32.exe
File opened for modification	C:\Windows\SysWOW64\Hommhi32.exe	Hkaqgjme.exe
File opened for modification	C:\Windows\SysWOW64\Jhqqlmba.exe	Jfbdpabn.exe
File opened for modification	C:\Windows\SysWOW64\Jjefao32.exe	Jbnopbdl.exe
File created	C:\Windows\SysWOW64\Jhjcbljf.exe	Jjgcgo32.exe
File created	C:\Windows\SysWOW64\Kqiibcbk.dll	Jchaoe32.exe
File opened for modification	C:\Windows\SysWOW64\Liabjh32.exe	Lfcfnm32.exe
File created	C:\Windows\SysWOW64\Mmahff32.exe	Mjcljk32.exe
File created	C:\Windows\SysWOW64\Gkeakl32.exe	Glbapoqh.exe
File created	C:\Windows\SysWOW64\Gkfnoi32.dll	Gclimi32.exe
File created	C:\Windows\SysWOW64\Ilgcblnp.exe	Ijigfaol.exe
File created	C:\Windows\SysWOW64\Mfhpilbc.exe	Mcicma32.exe
File created	C:\Windows\SysWOW64\Gbhpajlj.exe	Gkqhpmkg.exe
File created	C:\Windows\SysWOW64\Fnghjd32.dll	Mpenmadn.exe
File created	C:\Windows\SysWOW64\Kdeilm32.dll	Nfhipj32.exe
File created	C:\Windows\SysWOW64\Ajepci32.dll	Gahcgg32.exe
File created	C:\Windows\SysWOW64\Maommm32.dll	Hhiaepfl.exe
File created	C:\Windows\SysWOW64\Qiobpljq.dll	Jjpmfpid.exe
File created	C:\Windows\SysWOW64\Mlmncc32.dll	Kcphpdil.exe
File created	C:\Windows\SysWOW64\Apmfnbao.dll	Kmjinjnj.exe
File created	C:\Windows\SysWOW64\Ekliod32.dll	Mfhpilbc.exe
File created	C:\Windows\SysWOW64\Gemabmdn.dll	Ieknpb32.exe
File created	C:\Windows\SysWOW64\Jhkane32.dll	Jkfcigkm.exe
File created	C:\Windows\SysWOW64\Kbedaand.exe	Kcbded32.exe
File created	C:\Windows\SysWOW64\Lkehlmll.dll	Iabodcnj.exe
File opened for modification	C:\Windows\SysWOW64\Kkmijf32.exe	Kmjinjnj.exe
File opened for modification	C:\Windows\SysWOW64\Gkeakl32.exe	Glbapoqh.exe
File created	C:\Windows\SysWOW64\Ilqmam32.exe	Iibaeb32.exe
File opened for modification	C:\Windows\SysWOW64\Iabodcnj.exe	Iocchhof.exe
File created	C:\Windows\SysWOW64\Iljpgl32.exe	Ijkdkq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	5324	WerFault.exe	264

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkdoje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbnopbdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gaffbg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhpheo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hakidd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ikmpcicg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbnggpfj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mmahff32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mppdbb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hahlnefd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hipdpbgf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iljpgl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfnmcnjn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfqjhmhk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncbfcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlphmafm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhnkppbf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmobii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Komoed32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lihpdj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Limioiia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbcjimda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nbmmoklg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghgeoq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbgafqla.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfbmgo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpdefc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njmopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kkkldg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mpenmadn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndjldo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghbkdald.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glpdjpbj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkgnalep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lckglc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfjlolpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njokei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkodak32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilgcblnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jbieebha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcphpdil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcndab32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmkbeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmpdgdmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkaqgjme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icjengld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfbdpabn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jjefao32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpinac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcnmhpoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nffljjfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gehice32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hohcmjic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ioafchai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Icdhdfcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jokiig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbecljnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gammbfqa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmhlijpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcikfcab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kblkap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfhipj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hhlnjpdi.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggehilne.dll"	Giokid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hakidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obmbfpea.dll"	Iapbodql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihjjln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmhlijpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfejmobh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghbkdald.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikhghi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qiobpljq.dll"	Jjpmfpid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mclpbqal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmmgae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeihnf32.dll"	Hcabhido.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnpjk32.dll"	Ilgcblnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcmmho32.dll"	Kjlmbnof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcndab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqfcbkif.dll"	Mmahff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njokei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbecljnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaoihfoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcphpdil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkdoje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miogkjip.dll"	Lcndab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mflidl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmfaafej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaffbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gahcgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabodcnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jkfcigkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbpkfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blgmmd32.dll"	Lihpdj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lflpmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hakidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnkfonke.dll"	Ilqmam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khjeei32.dll"	Gbhpajlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gooqfkan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikinag32.dll"	Mmfaafej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mbcjimda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gooqfkan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilcjgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cfdfhe32.dll"	Lckglc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdkgi32.dll"	Nffljjfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijigfaol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbefolao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gkqhpmkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gclimi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbbhka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fodbhbhk.dll"	Hebkid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jhqqlmba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hommhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkflpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liofdigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcicma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giokid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbnopbdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjefao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflcnqal.dll"	Giahndcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijdnka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijkdkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfffnphj.dll"	Jmccnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfqjhmhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hklglk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hllcfnhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmjmjebk.dll"	Nlphmafm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghbkdald.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4952	1868	3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9.exe	86
PID 4952 wrote to memory of 2136	4952	Fhkecb32.exe	87
PID 2136 wrote to memory of 1504	2136	Fkiapn32.exe	88
PID 1504 wrote to memory of 4724	1504	Ghmbib32.exe	89
PID 4724 wrote to memory of 2808	4724	Gaffbg32.exe	90
PID 2808 wrote to memory of 4848	2808	Gbecljnl.exe	91
PID 4848 wrote to memory of 3032	4848	Gahcgg32.exe	92
PID 3032 wrote to memory of 4528	3032	Giokid32.exe	93
PID 4528 wrote to memory of 4536	4528	Ghbkdald.exe	94
PID 4536 wrote to memory of 3292	4536	Gkqhpmkg.exe	95
PID 3292 wrote to memory of 2500	3292	Gbhpajlj.exe	96
PID 2500 wrote to memory of 2560	2500	Gajpmg32.exe	97
PID 2560 wrote to memory of 4244	2560	Giahndcf.exe	98
PID 4244 wrote to memory of 3208	4244	Glpdjpbj.exe	99
PID 3208 wrote to memory of 4092	3208	Gooqfkan.exe	100
PID 4092 wrote to memory of 3532	4092	Gammbfqa.exe	101
PID 3532 wrote to memory of 220	3532	Gehice32.exe	102
PID 220 wrote to memory of 1356	220	Ghgeoq32.exe	103
PID 1356 wrote to memory of 540	1356	Glbapoqh.exe	104
PID 540 wrote to memory of 396	540	Gkeakl32.exe	105
PID 396 wrote to memory of 2276	396	Gclimi32.exe	106
PID 2276 wrote to memory of 4636	2276	Gaoihfoo.exe	107
PID 4636 wrote to memory of 2380	4636	Gekeie32.exe	108
PID 2380 wrote to memory of 976	2380	Hhiaepfl.exe	109
PID 976 wrote to memory of 2936	976	Hleneo32.exe	110
PID 2936 wrote to memory of 1832	2936	Hkgnalep.exe	111
PID 1832 wrote to memory of 3116	1832	Hocjaj32.exe	112
PID 3116 wrote to memory of 2340	3116	Hcofbifb.exe	113
PID 2340 wrote to memory of 2280	2340	Hembndee.exe	114
PID 2280 wrote to memory of 1428	2280	Hiinoc32.exe	115
PID 1428 wrote to memory of 2208	1428	Hhlnjpdi.exe	116
PID 2208 wrote to memory of 4756	2208	Hlgjko32.exe	117
PID 4756 wrote to memory of 4516	4756	Hoefgj32.exe	118
PID 4516 wrote to memory of 2140	4516	Hcabhido.exe	119
PID 2140 wrote to memory of 556	2140	Hadcce32.exe	120
PID 556 wrote to memory of 3264	556	Hikkdc32.exe	121
PID 3264 wrote to memory of 4004	3264	Hhnkppbf.exe	122
PID 4004 wrote to memory of 4996	4004	Hklglk32.exe	123
PID 4996 wrote to memory of 4820	4996	Hohcmjic.exe	124
PID 4820 wrote to memory of 4836	4820	Hafpiehg.exe	125
PID 4836 wrote to memory of 1996	4836	Hebkid32.exe	126
PID 1176 wrote to memory of 3128	1176	Hllcfnhm.exe	128
PID 3128 wrote to memory of 2428	3128	Hkodak32.exe	129
PID 2428 wrote to memory of 4920	2428	Hcflch32.exe	130
PID 4920 wrote to memory of 3744	4920	Hahlnefd.exe	131
PID 3744 wrote to memory of 3824	3744	Hipdpbgf.exe	132
PID 3824 wrote to memory of 4332	3824	Hhbdko32.exe	133
PID 4332 wrote to memory of 3336	4332	Hkaqgjme.exe	134
PID 3336 wrote to memory of 1648	3336	Hommhi32.exe	135
PID 1648 wrote to memory of 4684	1648	Hakidd32.exe	136
PID 4684 wrote to memory of 1012	4684	Iibaeb32.exe	137
PID 1012 wrote to memory of 4120	1012	Ilqmam32.exe	138
PID 4120 wrote to memory of 4968	4120	Ikcmmjkb.exe	139
PID 4968 wrote to memory of 3176	4968	Icjengld.exe	140
PID 3176 wrote to memory of 3544	3176	Iameid32.exe	141
PID 3544 wrote to memory of 4668	3544	Ijdnka32.exe	142
PID 4668 wrote to memory of 1352	4668	Ilcjgm32.exe	143
PID 1352 wrote to memory of 920	1352	Ioafchai.exe	144
PID 920 wrote to memory of 1844	920	Iapbodql.exe	145
PID 1844 wrote to memory of 4352	1844	Ieknpb32.exe	146
PID 4352 wrote to memory of 3436	4352	Ihjjln32.exe	147
PID 3436 wrote to memory of 3284	3436	Ikhghi32.exe	148
PID 3284 wrote to memory of 1392	3284	Iocchhof.exe	149
PID 1392 wrote to memory of 3936	1392	Iabodcnj.exe	150

C:\Users\Admin\AppData\Local\Temp\3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9.exe
"C:\Users\Admin\AppData\Local\Temp\3fdbd3de740c9b6deb50138d36733871386ee1009d98190c665d6f936fbd77b9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\Fhkecb32.exe
  C:\Windows\system32\Fhkecb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\Fkiapn32.exe
    C:\Windows\system32\Fkiapn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\SysWOW64\Ghmbib32.exe
      C:\Windows\system32\Ghmbib32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Windows\SysWOW64\Gaffbg32.exe
        
        C:\Windows\system32\Gaffbg32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Gahcgg32.exe
        
        C:\Windows\system32\Gahcgg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\Ghbkdald.exe
        
        C:\Windows\system32\Ghbkdald.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Gkqhpmkg.exe
        
        C:\Windows\system32\Gkqhpmkg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Gbhpajlj.exe
        
        C:\Windows\system32\Gbhpajlj.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\Gajpmg32.exe
        
        C:\Windows\system32\Gajpmg32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\Giahndcf.exe
        
        C:\Windows\system32\Giahndcf.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Gooqfkan.exe
        
        C:\Windows\system32\Gooqfkan.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Gammbfqa.exe
        
        C:\Windows\system32\Gammbfqa.exe
        16⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        C:\Windows\SysWOW64\Gehice32.exe
        
        C:\Windows\system32\Gehice32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Ghgeoq32.exe
        
        C:\Windows\system32\Ghgeoq32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Gkeakl32.exe
        
        C:\Windows\system32\Gkeakl32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Gaoihfoo.exe
        
        C:\Windows\system32\Gaoihfoo.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Hhiaepfl.exe
        
        C:\Windows\system32\Hhiaepfl.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Hleneo32.exe
        
        C:\Windows\system32\Hleneo32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Hkgnalep.exe
        
        C:\Windows\system32\Hkgnalep.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Hocjaj32.exe
        
        C:\Windows\system32\Hocjaj32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Hcofbifb.exe
        
        C:\Windows\system32\Hcofbifb.exe
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Hiinoc32.exe
        
        C:\Windows\system32\Hiinoc32.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Hhlnjpdi.exe
        
        C:\Windows\system32\Hhlnjpdi.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Hikkdc32.exe
        
        C:\Windows\system32\Hikkdc32.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Hhnkppbf.exe
        
        C:\Windows\system32\Hhnkppbf.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Hklglk32.exe
        
        C:\Windows\system32\Hklglk32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Hebkid32.exe
        
        C:\Windows\system32\Hebkid32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SysWOW64\Hhpheo32.exe
        
        C:\Windows\system32\Hhpheo32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        43⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\SysWOW64\Hkodak32.exe
        
        C:\Windows\system32\Hkodak32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Hcflch32.exe
        
        C:\Windows\system32\Hcflch32.exe
        45⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\SysWOW64\Hahlnefd.exe
        
        C:\Windows\system32\Hahlnefd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Hhbdko32.exe
        
        C:\Windows\system32\Hhbdko32.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Hommhi32.exe
        
        C:\Windows\system32\Hommhi32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Iibaeb32.exe
        
        C:\Windows\system32\Iibaeb32.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\Ilqmam32.exe
        
        C:\Windows\system32\Ilqmam32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Icjengld.exe
        
        C:\Windows\system32\Icjengld.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Iameid32.exe
        
        C:\Windows\system32\Iameid32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Ilcjgm32.exe
        
        C:\Windows\system32\Ilcjgm32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Iapbodql.exe
        
        C:\Windows\system32\Iapbodql.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Ihjjln32.exe
        
        C:\Windows\system32\Ihjjln32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4352
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Iocchhof.exe
        
        C:\Windows\system32\Iocchhof.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Iabodcnj.exe
        
        C:\Windows\system32\Iabodcnj.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        67⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2688
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        68⤵
        Drops file in System32 directory
        
        PID:1512
        
        C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        69⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4804
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:2836
        
        C:\Windows\SysWOW64\Icdhdfcj.exe
        
        C:\Windows\system32\Icdhdfcj.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
        
        C:\Windows\SysWOW64\Jfbdpabn.exe
        
        C:\Windows\system32\Jfbdpabn.exe
        74⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        75⤵
        Modifies registry class
        
        PID:4664
        
        C:\Windows\SysWOW64\Jllmml32.exe
        
        C:\Windows\system32\Jllmml32.exe
        76⤵
        Drops file in System32 directory
        
        PID:204
        
        C:\Windows\SysWOW64\Jokiig32.exe
        
        C:\Windows\system32\Jokiig32.exe
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:3276
        
        C:\Windows\SysWOW64\Jbieebha.exe
        
        C:\Windows\system32\Jbieebha.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1204
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        80⤵
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Jkajnh32.exe
        
        C:\Windows\system32\Jkajnh32.exe
        81⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        82⤵
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\Jbkbkbfo.exe
        
        C:\Windows\system32\Jbkbkbfo.exe
        83⤵
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\Jjbjlpga.exe
        
        C:\Windows\system32\Jjbjlpga.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4796
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        85⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1580
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Jjefao32.exe
        
        C:\Windows\system32\Jjefao32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Jmccnk32.exe
        
        C:\Windows\system32\Jmccnk32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Jkfcigkm.exe
        
        C:\Windows\system32\Jkfcigkm.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        92⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Jbpkfa32.exe
        
        C:\Windows\system32\Jbpkfa32.exe
        93⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        96⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        99⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        100⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5672
        
        C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Kbedaand.exe
        
        C:\Windows\system32\Kbedaand.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        107⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        108⤵
        System Location Discovery: System Language Discovery
        
        PID:5956
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Kmmedi32.exe
        
        C:\Windows\system32\Kmmedi32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Kokbpe32.exe
        
        C:\Windows\system32\Kokbpe32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        112⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        113⤵
        Modifies registry class
        
        PID:516
        
        C:\Windows\SysWOW64\Kicfijal.exe
        
        C:\Windows\system32\Kicfijal.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:412
        
        C:\Windows\SysWOW64\Kmobii32.exe
        
        C:\Windows\system32\Kmobii32.exe
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Windows\SysWOW64\Kblkap32.exe
        
        C:\Windows\system32\Kblkap32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:1188
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        119⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        120⤵
        Drops file in System32 directory
        
        PID:584
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        121⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        122⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3288
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        123⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Ljephmgl.exe
        
        C:\Windows\system32\Ljephmgl.exe
        124⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5384
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        127⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Lflpmn32.exe
        
        C:\Windows\system32\Lflpmn32.exe
        128⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        129⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Lmfhjhdm.exe
        
        C:\Windows\system32\Lmfhjhdm.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        131⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        132⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        133⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Windows\SysWOW64\Lmheph32.exe
        
        C:\Windows\system32\Lmheph32.exe
        135⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2296
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        138⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Liofdigo.exe
        
        C:\Windows\system32\Liofdigo.exe
        139⤵
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1640
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        142⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        143⤵
        Drops file in System32 directory
        
        PID:1192
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4208
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        145⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        146⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        147⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        148⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        150⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Mjcljk32.exe
        
        C:\Windows\system32\Mjcljk32.exe
        151⤵
        Drops file in System32 directory
        
        PID:4144
        
        C:\Windows\SysWOW64\Mmahff32.exe
        
        C:\Windows\system32\Mmahff32.exe
        152⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2164
        
        C:\Windows\SysWOW64\Mppdbb32.exe
        
        C:\Windows\system32\Mppdbb32.exe
        153⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\Mclpbqal.exe
        
        C:\Windows\system32\Mclpbqal.exe
        154⤵
        Modifies registry class
        
        PID:4340
        
        C:\Windows\SysWOW64\Mfjlolpp.exe
        
        C:\Windows\system32\Mfjlolpp.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:4404
        
        C:\Windows\SysWOW64\Mihikgod.exe
        
        C:\Windows\system32\Mihikgod.exe
        156⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Mmdekf32.exe
        
        C:\Windows\system32\Mmdekf32.exe
        157⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Mcnmhpoj.exe
        
        C:\Windows\system32\Mcnmhpoj.exe
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\Mflidl32.exe
        
        C:\Windows\system32\Mflidl32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Mmfaafej.exe
        
        C:\Windows\system32\Mmfaafej.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\Mbcjimda.exe
        
        C:\Windows\system32\Mbcjimda.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        163⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ncbfcp32.exe
        
        C:\Windows\system32\Ncbfcp32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        165⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Njmopj32.exe
        
        C:\Windows\system32\Njmopj32.exe
        166⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Windows\SysWOW64\Nipokfil.exe
        
        C:\Windows\system32\Nipokfil.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1668
        
        C:\Windows\SysWOW64\Ncecioib.exe
        
        C:\Windows\system32\Ncecioib.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:648
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        169⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Nmmgae32.exe
        
        C:\Windows\system32\Nmmgae32.exe
        170⤵
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Nlphmafm.exe
        
        C:\Windows\system32\Nlphmafm.exe
        171⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Ndgpnogo.exe
        
        C:\Windows\system32\Ndgpnogo.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Nffljjfc.exe
        
        C:\Windows\system32\Nffljjfc.exe
        173⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Nmpdgdmp.exe
        
        C:\Windows\system32\Nmpdgdmp.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\Npnqcpmc.exe
        
        C:\Windows\system32\Npnqcpmc.exe
        175⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Ndjldo32.exe
        
        C:\Windows\system32\Ndjldo32.exe
        176⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\Nbmmoklg.exe
        
        C:\Windows\system32\Nbmmoklg.exe
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Windows\SysWOW64\Nfhipj32.exe
        
        C:\Windows\system32\Nfhipj32.exe
        178⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\Nifele32.exe
        
        C:\Windows\system32\Nifele32.exe
        179⤵
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        180⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 400
        181⤵
        Program crash
        
        PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5324 -ip 5324
1⤵
PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fhkecb32.exe

Path C:\Windows\SysWOW64\Fhkecb32.exe
Size 91KB
SHA256 caa757ef77db458bcbc44bf2b9ce9ca396c024c56aca05bc5cf940799bd9438b
MD5 d8a847bf7b55d45f44fa650d8ee4d68c
SHA1 410729683b2343ba3897d4ce2b1716bfcc69bf1a
SHA512 c2017c1992d9f00aa5da998d99fe27fd5c810ea04cc98c77718392fcb652a431b45218219daff9a2cebd990cbf6e8051cc7655b247167e36f5c32d1e2bdf9578
SSDEEP 1536:aascEcfA+6SINjasS22LFJvdN7DqQfV5I+GCmBhjFW+JCYTDP0:ajcEcfD67UsSbFbwQ9bGCmBJFWpoP0
TLSH
T12B936D6BB3960FB2C1D10273215B1BD2E36E81BAD2B9C59068E8C5CD1277E5CD2F9391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fkiapn32.exe

Path C:\Windows\SysWOW64\Fkiapn32.exe
Size 91KB
SHA256 14ca98c99979b43431977476db4adbd79adbf7747f3c313f99e00ddc6f5b162c
MD5 c47eba7d89af878f5bca27f23242ff60
SHA1 3bf14a63053240cd6e8f7f6fe0c219c616973222
SHA512 cf017bcc44d2bb3bc40b853122a61d6855da955b861cb7be72367220cc93bd31c161e31626f72e81e5092478442fc0163b7d1e3d16ac439c088287e69388c1b0
SSDEEP 1536:uFIslBsOKQL4qx8LmpM/ljgix4+R2LFJozN7DqQfV5I+GCmBhjFW+JCYTDP0:uFIslGOKQLV8Lmmpx4+qFswQ9bGCmBJQ
TLSH
T1CE935C6BA2151FA2C18112732E7BF4C2F329707C537A8988D468C01DD3EFE5987B6799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gaffbg32.exe

Path C:\Windows\SysWOW64\Gaffbg32.exe
Size 91KB
SHA256 e0edd68c672d6615fc74504dacda69f21b8421f183d5c65c37053f476a5ce489
MD5 062da09e93b71dab1e31600c65a4d8dd
SHA1 3ce36b339e9964441345e1192e747e25c4c90d0a
SHA512 397621dc31d2c83c093d0ca34c3525e9a2efa52b91afca437f0ed28c14c20bd88406be1bdaba3a97f43e7394fdcd2b7cbddee25c267a8ba24d8407440d916836
SSDEEP 1536:8l4lMaVgYtLdUdZvbCrzRHsVpTpTgknYd6UO7I2LFJREN7DqQfV5I+GCmBhjFW+M:tlMaVgYtBUzvO5HsvTpTgknYd639FUwM
TLSH
T19B935B1F31262BBDCDC60272E29A04D7FB39C77A536AC14558BC810D12B7E5592FEAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gahcgg32.exe

Path C:\Windows\SysWOW64\Gahcgg32.exe
Size 91KB
SHA256 8237c4cf365407fd8e567ff35109f444f6dad07ab8d9b9f3d6bb147f69890635
MD5 f02ee814ab68eeb7bcf5e5b7e88e41fe
SHA1 a6042b6a6c3cd9933d0ef7e7575613e6834ffc49
SHA512 97ce77b75b30cdfc3504616ebd3237e23943771229758bc17e3c9fd7ea4694b58a05fd46697535637c67d5153e90c94422d2225d44a19fdbd17e504ba84467dc
SSDEEP 1536:5KwzOs/dhnqn8zxcPz2FHxrJt2LFIN7DqQfV5I+GCmBhjFW+JCYTDP0:NlmYqPSFHxrQFIwQ9bGCmBJFWpoP0
TLSH
T18D933A2BEE661FE2C1B6C275FC5A16D2F61E853B037E95705868802C326BD5CC1FA385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gajpmg32.exe

Path C:\Windows\SysWOW64\Gajpmg32.exe
Size 91KB
SHA256 11803d56fc026d0f77c8e14af23857bee44af6e4395d383e4b90c357bb32045d
MD5 45542ee553ce272b8af6c57aa47e52aa
SHA1 b93eac022aa2f7ff92d10c4654b4cb7c217904a6
SHA512 cdcd39156024a8e3861af41c47fe6c1fa9f2f0465a4b98ae0b9cdad3d5412ac78ffe5dff00591e02d82ae84b9cb9dce1bc5123fd379e7277f3f99b4dee466b53
SSDEEP 1536:/F62v5ZvAIZhj9vKZeJw3q7IqVIe2vM6ZW2LF4N7DqQfV5I+GCmBhjFW+JCYTDP0:N75F7rtKx3q7IqV4MWF4wQ9bGCmBJFWd
TLSH
T1A9936CEFB2641F6EC29302F525FE19F3B3194C6A5375CD981818810D1233A58B6BF2B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gammbfqa.exe

Path C:\Windows\SysWOW64\Gammbfqa.exe
Size 91KB
SHA256 698fe01d62ebfafe05dbfbedcef8a279bc9c4740ed2366659403b8ef8cf52a72
MD5 00ef4ab1f22c6d5b540c4f2777ddda30
SHA1 d24ff56fce9fb5fdfe826270990331bfa0fe7132
SHA512 b9ffbdde7ef4dfbbeb7b4c1b1ca1268c66a2a599910bd3ca65e4ec21dcc87c68f2989a83a882fbfcc2be24a454196369737c1b3d923e85a8ee98eec21b4a79f2
SSDEEP 1536:43z3f7Xj4purJ5DWYISL12LFwN7DqQfV5I+GCmBhjFW+JCYTDP0:43Lf7Xj4purJ0kmFwwQ9bGCmBJFWpoP0
TLSH
T17D935C1E76371FB3C1860376356E79C5E666436E33268E852FDCC80C2277929C6B7298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gaoihfoo.exe

Path C:\Windows\SysWOW64\Gaoihfoo.exe
Size 91KB
SHA256 1fadcb7f12f85dc7f99b102b047e9f8f7b980f89d0b25c9decc2f7bfa1ba05ff
MD5 9c1a1dd4395e22e3b786680d9b7d017c
SHA1 e81d8a031b2256463e6b8b4576d76013af6deef1
SHA512 78926b50268cb708c9aa04d8d16cfcef95d9d4d946e14b3f3b1d9c9b8e415a483ae5d48fa8b541e1798959b9deeac1a2d131565fff82cd16f2e7a4516751ed3b
SSDEEP 1536:VUwijsEdLJK9jyr2zy85+pf8X12LFJwN7DqQfV5I+GCmBhjFW+JCYTDP0:VBijsELOyr2zy85ZXmFOwQ9bGCmBJFWd
TLSH
T196934B3BB5591F73D281027D275774F6FFE9567E1269C2BC2828C08D1263A24C2BB798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbecljnl.exe

Path C:\Windows\SysWOW64\Gbecljnl.exe
Size 91KB
SHA256 79351aef3e82ee1f22801a9aec30698cbba12b15e50eac0bb3c32cfb269571ad
MD5 4285303dec07628f3083cccee2186681
SHA1 cbeffa0d4744012e1088387adb25a44120d58d93
SHA512 3e6b76eef3d4e7ab6eddafe7479238e237696e94fa5ab71a7c1d6a0d0eb7b71e3e4ee81d56229e79e8b92472a9fe58b2885e61e1c107630c3b15eb92aff4dff9
SSDEEP 1536:0ApG7ZPjYoRt8M5ll2Q9z2LFzN7DqQfV5I+GCmBhjFW+JCYTDP0:wZ7Pr8DRFzwQ9bGCmBJFWpoP0
TLSH
T108936C1AA2281FF3C1C10375215F45E6F329447FE3AAD6C5D8A8C24D22B6E7ED2B5784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gbhpajlj.exe

Path C:\Windows\SysWOW64\Gbhpajlj.exe
Size 91KB
SHA256 1ff6f1e804862ad7c6218e501f068ae1fa17579a1bfd2ed1ef0ec370ba8dccc7
MD5 fdc46d41f1ba1ba7ce6fb5505d15b2a1
SHA1 8a199f42eaee4ec7a580bd418ff7ade6d429b1dd
SHA512 3946756e023e9eff69968b641e22b0a8b005afb3e5d6bd0a0550ead705ce675004eb6152d6d72674ca158b20d6c2cf8cc1a1c926eb02625dec0fb63b2d00268c
SSDEEP 1536:zud7AxfLL1kDQi+OxypVTFqRbap9Y2LFyN7DqQfV5I+GCmBhjFW+JCYTDP0:CdAL1kBRk7FYbcFywQ9bGCmBJFWpoP0
TLSH
T115935D1A75175B62C686327F3147A6E2F3FE857E6FF5B490246CB00C1E2FBA88176241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gclimi32.exe

Path C:\Windows\SysWOW64\Gclimi32.exe
Size 91KB
SHA256 087c123067d7102526942da567c326055ad0dcbf72b75b3f4728b82381b234be
MD5 1ee40bb85b097e75a07f8afa88b7887c
SHA1 83117c1c8c32ad668c11261d2f87d534b7ae38c9
SHA512 b499928c2adb9857aeb2cb8b023bb509ae4b2ae6e36f76cbfcee3d57d770c06d8eeb9750dd0c85b3b6960f91b3a682bb5ffc65da061dfbcabb9c1de235d1187d
SSDEEP 1536:qW1qdBGX9y5s7wU8BbGgEAadP68sFBDdsb2LFJz0N7DqQfV5I+GCmBhjFW+JCYT4:q4AI9GspAaFABDa4FiwQ9bGCmBJFWpo8
TLSH
T143935B7B6255CBFEC2C2D271116A27C6E61940AE5FFB85C26578C01C6333B6982B76F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gehice32.exe

Path C:\Windows\SysWOW64\Gehice32.exe
Size 91KB
SHA256 ae4c495769faaf0516f9b54a1fb9b50dc4906c3867229a31839343c58380282a
MD5 abedd00c0b24c36c1d3492a6df2e7a93
SHA1 1cafcdf886072b691e23583bf0c668e667fd70ba
SHA512 43391db2a12345b3681a55fb13dff7d7f20892b8a6252a0ba3f0878798ae4f0cbb29f7350625fdbee39b172019dbe5d36bef9847b74159e43c75b7207556b13d
SSDEEP 1536:qmIZW8H33UGyEYSL7enlIp2HBk2LFJlN7DqQfV5I+GCmBhjFW+JCYTDP0:qmIZW63UGyEFL7elIs3FLwQ9bGCmBJF2
TLSH
T1FA934A16666DCB72C1C503B2F44B19E7FE2A81F9B33585811CA8D01C1F77E6982BA6CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gekeie32.exe

Path C:\Windows\SysWOW64\Gekeie32.exe
Size 91KB
SHA256 db5c219b1b7008775c56624acb0b836d8dc41a1390e67238a1c244afba431675
MD5 8cc92b27b3de3cf0c91505c1790252c7
SHA1 e777a7b580c029f69905b16048a5f56af8dafeb2
SHA512 f07c730bb8004ff13358311f8945f09cc246d6dab3a335a460a08b882a26b104947e52a6166dd2adf012ed0c7e5cd7c215236394920bf2fc283a749cc30ab66d
SSDEEP 1536:Ny8rlL9oIKCy8QzDbdqfYF6CR7uWd+SUw2LFJ1N7DqQfV5I+GCmBhjFW+JCYTDP0:A8rlL9HK19U0FR7BRuF/wQ9bGCmBJFWd
TLSH
T15E935C2BB36D0FA3D1D103B1216E55D2B32990A95E67CE7C186C815D3377D2882BBBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghbkdald.exe

Path C:\Windows\SysWOW64\Ghbkdald.exe
Size 91KB
SHA256 a0b30347e7c003b7c4d590a11b389f9c76830a02a6b9be97cdfdeebb29c410fd
MD5 d20d3daef3cab8652669269d7bb3b71a
SHA1 996106124aa17f60cdff8bd6593af5a15ce5e1ef
SHA512 ef55882664788e576a4f2d5414fb623f98b9c5bae0d1fa57e87c8b5e2c7a09bba3c4830d91185bb10f48532eb054c296ef32ac9a5c305f44ccddcebca869c9f0
SSDEEP 1536:SIovvOaqR33Bjb+yqbg2LFJTN7DqQfV5I+GCmBhjFW+JCYTDP0:Ho7Wl6fbRFNwQ9bGCmBJFWpoP0
TLSH
T1ED935B2FA1A51F72C2850E72271B9CD2FF6A407D27EBA1909468D09C3727F2D81B67C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghgeoq32.exe

Path C:\Windows\SysWOW64\Ghgeoq32.exe
Size 91KB
SHA256 42c53322028adeb699485c3eee58ece1ed9d74193cd479f745db02f32280e364
MD5 73f89cfce1a2919c1a9ce4fe7bd2473c
SHA1 18f404f5d1578745287e95eed79d19c1bfbaa0fb
SHA512 93461dcad06f14e13f0fff187aa864a694d8c78844d4e6ad784bd81e0e07d3d4a68ec43ae4885c38acfd830943bf7cff862009cb533fa22ae9e611e163d84117
SSDEEP 1536:1N3Ye1fQT67znD4ZDhL2LFPN7DqQfV5I+GCmBhjFW+JCYTDP0:1ByT6vD4phoFPwQ9bGCmBJFWpoP0
TLSH
T19A934B2FE2AE2FB2C24103773C9A1AE2BB1A05BDD365C59514F8805D3373959C2BB681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghmbib32.exe

Path C:\Windows\SysWOW64\Ghmbib32.exe
Size 91KB
SHA256 fac7ccf25836c74b2220c599972ded0ed4cecdae7a47be7a95bb3c4cfa02238b
MD5 7b610ab94e66c7a220f90511ea69aec8
SHA1 6927fb474cef6aa9c90577e6c71d9830f2302be5
SHA512 f9ce0b112b93a9ec4320f82ea584c7aaf26b1fccd77c78537f61ffa90a232553b8c3eb2ab3d48f9abf9cf0bfce2f198d1aa088d4785cc215e68919270399c22e
SSDEEP 1536:KdOD+kOfAZdKEfyKyz0iCFUN8nml8x2LFJSN7DqQfV5I+GCmBhjFW+JCYTDP0:B+kff3yYhBQFowQ9bGCmBJFWpoP0
TLSH
T16D934B1EB359DF72C17202F2DC5A4DD2E2DA4C7652B2BD4464E4C08D1723E688FBAE94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Giahndcf.exe

Path C:\Windows\SysWOW64\Giahndcf.exe
Size 91KB
SHA256 b606c130c5c6ea68c0d3d4037e18d2a7c867dfde1074e0b755cb1395081ab313
MD5 682ba259ffd31d6b2c880db1db5850ee
SHA1 689aeceb6fd17a3672aa82b300144be43ed04877
SHA512 c20e3d3256f0124f78bcaf907736a8db3a5dfd6b4235a7ec56a22862090c7c36b7124b036cd697ec4cf5cd294be7dd9d97cc678e35d99df6a4e445f5901e39de
SSDEEP 1536:+4aiRlXwqCqxhl8CF1zzaYFXLjL7PxZT8D2LFJJN7DqQfV5I+GCmBhjFW+JCYTD8:+ERlWqxhp1SYFXLTPxF8gFnwQ9bGCmBy
TLSH
T155935B5BB5369FB6C38032322257D5E1EE39406EC2B5C1865864C63C127FE688EB63DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Giokid32.exe

Path C:\Windows\SysWOW64\Giokid32.exe
Size 91KB
SHA256 980bd8803da806d8612b86afd0ce9c0d1fae80fb56e3823cc8866d64ad26919d
MD5 a98b6b70335b0d973f4f62a1a0fbb5c5
SHA1 079d407a109b69949261bc365496ac3d8c0dd1da
SHA512 c6e77270193a84ec4652cad32572a6e7bdef5dcc453a83d94bd96ca81e751319babc2ba004cda0720a4d7807ec1a32d77cd2f25d5b82b52060235834499d7280
SSDEEP 1536:TJUHkgZmvd7V66wibtmH3ld2LFJwN7DqQfV5I+GCmBhjFW+JCYTDP0:uEgZA7wUFGwQ9bGCmBJFWpoP0
TLSH
T1AE935C6BF67D2FB2C1F2027DE65704D2F329442A927985941D28C11E2333A6F82776F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gkeakl32.exe

Path C:\Windows\SysWOW64\Gkeakl32.exe
Size 91KB
SHA256 ef560699bca9b0169d98940ef1a1216255324f08e8bf8be3100672e4cdf0d833
MD5 e54d09ed3c6d97bf469636bede90ce00
SHA1 170cc9a531fafc8b0ac7e63b6492ef458bf8941a
SHA512 02d2cfce20599b3a2374a5a3cdd4cb35e1435a7716ae1aa237b77ee5506a7efee715c6c587c8fa0c84190a927340cfd098a048f09aa13c584f18e36f95729377
SSDEEP 1536:+Lcd1/MvA0aTiGuTnUmusIpC3MnZbAXhQ3JQenULH2LFJeN7DqQfV5I+GCmBhjF2:ltMvbEDXmusIpC3MnJ+eULsFAwQ9bGCh
TLSH
T1DA934B0A71660FF1C3820271255B47F1F62A436E5269B6D46868D1DD33F3BAE91BB383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gkqhpmkg.exe

Path C:\Windows\SysWOW64\Gkqhpmkg.exe
Size 91KB
SHA256 443a2c83d9a60dd8ced86bce8ac33dc6a5785151eeead5d16358a599e9c6ba6f
MD5 c80b96c02b489db6d452e90802742bc9
SHA1 212fc2740e28b94687881c50067f789b30c00fdf
SHA512 95290a447b3e6229b83baf29fee2a6c04b639e33cf3299101419c937e42652e7b66f13df977b23a68e28574e6ecf32d3b61b56aed3e69734ed28f5f58bf41e08
SSDEEP 1536:dMfGP0GmNspfN4SQMS7Z2LFh7N7DqQfV5I+GCmBhjFW+JCYTDP0:dMfZNUvbSeFxwQ9bGCmBJFWpoP0
TLSH
T1F7936C9FF2991FB2C5C50376115768D3F31A80AE23368DA458D880DD72B7A5C82FB29D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glbapoqh.exe

Path C:\Windows\SysWOW64\Glbapoqh.exe
Size 91KB
SHA256 d6ed8da4de2bbfb6630d2e71aae6e6c466b536ec7f42f9d357a014f1a493610c
MD5 1b9b9298aea696c52cb13414aa8063c1
SHA1 a8050a64a1c35f3fa05b4a45a52b176f68fd7c17
SHA512 e6fb2912914cd53b87f3457f1b366461f7a5425ea003bba58add7e8a28b46d9c3fe63f0e3691fb36ba07a2ac64715cb5180f5636c618bf647e90ef097c456711
SSDEEP 1536:JfrUeGxlIYe/2TNvDv11YRjY2LFJAgN7DqQfV5I+GCmBhjFW+JCYTDP0:JfrUeGxlIYeIVDvkF7wQ9bGCmBJFWpo8
TLSH
T167935D1BA6D81FB2C5F102BA17BA45D3F32A80FE536685461058C1CC177FA9CC2BAF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Glpdjpbj.exe

Path C:\Windows\SysWOW64\Glpdjpbj.exe
Size 91KB
SHA256 8fabb8b21c9dcf6bd9bbccdaee11f968714762d59946d346608e379901dcc1cf
MD5 f2617b603e184adea618f1ffc395304f
SHA1 1c57d67b345879bc5d6da93d8220cff2e3654d0a
SHA512 9bd1b693b2f2e9182f4d71e1c653a4116cb2c9fcf29090c9c7c64d65bbb8ace0f2938bb7dbb55d7baace70de0acab0de36867c83917b42c2e0a7fb3380ac5720
SSDEEP 1536:+XktHGdq0SdVeENjG00v34Eh07Rp+N/e0q7+EbpSvJ2LFJUN7DqQfV5I+GCmBhjQ:5tmdq0SXde4K07Rpy/eYEdcCFGwQ9bGy
TLSH
T1A7935BFFA2561BE2C182C3F532178DD1F71788761379CE9415A88F0C226F9A8B1B6709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gooqfkan.exe

Path C:\Windows\SysWOW64\Gooqfkan.exe
Size 91KB
SHA256 69cbf19c799b9892323a3aa375f7a6c4714bb926bdf965f7b65c5191ea015730
MD5 7da5e17349f595e13c4ebe6447201504
SHA1 0c9372fcbf98e4312ca3db5af26ab312bd85ecb3
SHA512 4b91c883a3b3639e003156cf041dc782b4798b29206a0be9fe44c6f0068c7fe6e200ff6a76070fe2cbfb829cc6cc5b2ae65c8f192982358bae72959657b47217
SSDEEP 1536:KQ+C30kKX3LtbiqaaaaaaaaaaaaaaBsMN2LFJ6N7DqQfV5I+GCmBhjFW+JCYTDP0:KQ+C30kvVnFAwQ9bGCmBJFWpoP0
TLSH
T1A6935D6F76153FBEC98603F1216A45D1F71A406E1257869F1764C1CF22A3A3CC2BEEA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hcofbifb.exe

Path C:\Windows\SysWOW64\Hcofbifb.exe
Size 91KB
SHA256 62e47153038e204b36c2f6668d1f3ad3280cdb4e159a5a94a779389c17912f3d
MD5 e5725fd534d0dc0b5f281e95ed7b4cb3
SHA1 1b6173fb738247ec58902aad534f62b97bc7d687
SHA512 bedba77ad363cb6328b82f6a82466f01443eb3346a82d0a303ca520fa275a180ea80c92cac498356e657c2716693e752d78c0abc87bb64e099645aa1ddb54233
SSDEEP 1536:Wo5gUI5TUbBBPvVunuHBKBDq8d2O62LFJ+N7DqQfV5I+GCmBhjFW+JCYTDP0:WoOP5TUbBBPvmuhWDJHFgwQ9bGCmBJF2
TLSH
T1D8936E7B77A52FA2C5420332217B2AE6F32989FA1B3595901477C0BC1373A1C92FA7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hembndee.exe

Path C:\Windows\SysWOW64\Hembndee.exe
Size 91KB
SHA256 0856c4320f47766294e4f48c75732d1988290bbf137e9c9b7c279baf9cf53315
MD5 e40ed73aac09ae57dc51b899e52f7c08
SHA1 f8041e5be915a58ee1cfc7e59fbb537de7537190
SHA512 54d69af580f51f14e26d42ca5c37aba70a0c44e0bb64ffe09f0d45cd6ec330a1b02f3a0056ae7c724aab73b1984187c169a7ab86b3699519eca46629ff10c55d
SSDEEP 1536:5EwR9QSC4sp+gnJZyi0pX02LFwN7DqQfV5I+GCmBhjFW+JCYTDP0:5ErSC4sMgJA7p9FwwQ9bGCmBJFWpoP0
TLSH
T152935C7FB7150F71D1D002B5256B49E2F72D8076332D879464A8824C22B3A68BFB7B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhiaepfl.exe

Path C:\Windows\SysWOW64\Hhiaepfl.exe
Size 91KB
SHA256 aecc01be0409dd2b59ccae7d8076a3ce6ee0bf5eee5ccc802d2b9e52dbde29aa
MD5 1cad28ea60970a118d5ea2e3e9ba7c9e
SHA1 52bbf12e51fc339950b49730a990259a1ea0d41c
SHA512 d1f0daa1ff6c1e41332bd04de4f45a63a627294212f1aa8d6b4f761def77d9ee0424082a931616dbd38fe7456f1bf1cbda412ff00c4070120bae5457135c42c4
SSDEEP 1536:F/n9YQxRVpBTo32WJ5h3/Oma2LFzN7DqQfV5I+GCmBhjFW+JCYTDP0:RvTbBoxJ5hvbnFzwQ9bGCmBJFWpoP0
TLSH
T18B935B2FB6396F62D3820232266B54F5E36D416E136DC6B41CBBC17D1273D28827B688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hhlnjpdi.exe

Path C:\Windows\SysWOW64\Hhlnjpdi.exe
Size 91KB
SHA256 5ad5fedc47b15fe029fd7aa51c372a909704c254506a5b38ed4d6dd0226a7823
MD5 d748c1c23ba0dfbd1f542249e684ffe1
SHA1 1e701c9f441468a6a64d89ba99ec1c0c1fdcab4a
SHA512 de9b48ad8770bdace92ab67b236dcc6a262bb088c178ee6a0f3ece8c1622aa80f136b6b2f6f3fe90734e43d909672c54d1efd1a520815d4de70fdcf7ff73e131
SSDEEP 1536:tKflJPBvLdcfzgBcDh8FbT2LFJXoN7DqQfV5I+GCmBhjFW+JCYTDP0:teBvezgBcSF8FuwQ9bGCmBJFWpoP0
TLSH
T12C935D3B73E93BB3C1C5027127A6E9D2F716907F136695A53468800E277F95B42B6EC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hiinoc32.exe

Path C:\Windows\SysWOW64\Hiinoc32.exe
Size 91KB
SHA256 707c1900f37ea037c8e57ccf3a3dfa884df0adfaae155faae531dd1a6e5ab3a3
MD5 3da671f5fc5e62a2b602486eb57a4688
SHA1 3b4cdcd133b2a3eb3e6cb1797a73519e33e84050
SHA512 a727d8291e8f57cfa90480a533a4bc11609e88682d35fd2e1c8adea1a1734763f184843dad4d3fdcad67ac8b63f78eb848f33eece7aa77cc103e8a4f82684ca0
SSDEEP 1536:6XZ8LDi3+jbAU37ut9ISs6kZIkjige4+YYmrdy62LFJefN7DqQfV5I+GCmBhjFWd:0Z8LDxjzLut9ISs6kZIkjigNUmhyHFgr
TLSH
T114936E2B772D1FA2F58233716E2635DBF73E40AE42764680346C9C4D623F92456FAB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hkgnalep.exe

Path C:\Windows\SysWOW64\Hkgnalep.exe
Size 91KB
SHA256 afb94e24f4fd5b0ed7263546ac93b68c63c497ad264dd4ca8a52b877b7c65b75
MD5 a1983b35b119ff39ca8292753d79484b
SHA1 1ff23750d3b2ae4aa4607890f0c887c9f58b6d5c
SHA512 83afe4622e55ed7c206ce22ae05776de7fed1fc59ceb298ed724321a6af4bcb36e99893592a444bbbb41a48f9805698a73b48ad311d6972e6404c9487860aa24
SSDEEP 1536:rxutXJoZibR6CBCQok2LFJiN7DqQfV5I+GCmBhjFW+JCYTDP0:gt5oZCoQo9F0wQ9bGCmBJFWpoP0
TLSH
T19093491B75150BB2D2C702B5252A4CD6F73D812A97B7869C7BACC0DD2333924827A7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hleneo32.exe

Path C:\Windows\SysWOW64\Hleneo32.exe
Size 91KB
SHA256 14a819dfb45c1d74c2ce69b59b0a0cf6814f4f12b37bb9cfa793fe9b42cdfc9d
MD5 06fee04b6ebc1234b272e2321e5155b7
SHA1 361a7f5a2bc20b6bee5362be353d818bc8dee2eb
SHA512 937ffdab7bf0bcc18b4a9e08f92b4ea731231e5af39380690566df37d03eba52740cfcb49181d8a471b1ff27ec75186536e340affc8a005ef8733345c8c2a30c
SSDEEP 1536:NWURo6khguSvoHQ6Mmshwk2LFJ+N7DqQfV5I+GCmBhjFW+JCYTDP0:Np0hguSWQ3w9FIwQ9bGCmBJFWpoP0
TLSH
T18193497FF76B3B6DC1810232257A57C7E6FA9079136699436418C0BF136392C827ABA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hlgjko32.exe

Path C:\Windows\SysWOW64\Hlgjko32.exe
Size 91KB
SHA256 2b1575d88b17e16304ab103a1cf514cfc46a729864dabc17d6a38af8beb45bc9
MD5 b881bac1ef097b1c8042c6ca6000b748
SHA1 372a94feb270deeea1aa71641396082e7d280656
SHA512 e8cb1067cc600de9e7fc98fd4d1da760487a38488e21e262a64f8a885ab02480d63b9cf786a94ebc2df605e4926086539385d32ea176cd9b3d979f4b441cb956
SSDEEP 1536:Fnr91gzktOfsT66EiiVzuO+C5lqSHpduAS4gsVS2LFJ7vN7DqQfV5I+GCmBhjFWd:Fnr91gzW1T/EiTO+C5ISHKnsVfFxwQ9b
TLSH
T194935B2AA115CFF2C28D0275355B5CF6F22980EB366A8587656C801D63F3B68FDB27C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hocjaj32.exe

Path C:\Windows\SysWOW64\Hocjaj32.exe
Size 91KB
SHA256 929588f4aa633d67ee365306c6680a4e0b06fe368b713228c2b0603fe8ba20bc
MD5 b92f69986ef9be88f9350688ae8a6d5e
SHA1 4dd795c8bb6a02e25797967b7681c0539b09c1b4
SHA512 122edf5f65bb69f38f66d3ddd2d1533143c743468929e42815f1787728f2d1ad37dfe37b935eeeb6e51fa902f067aa962373da83cfa1683a5e759f58bca4396b
SSDEEP 1536:P5bhZvhv4sNc6hpIsy0F/SeeM4hP+dn2LF9N7DqQfV5I+GCmBhjFW+JCYTDP0:P5bhZvhvtNVzIsfex+GF9wQ9bGCmBJF2
TLSH
T130934B1EBD2AFF62C1C202B2615B44E6F7FA40ABE3E58585647C830D1377A5CC2767A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hoefgj32.exe

Path C:\Windows\SysWOW64\Hoefgj32.exe
Size 91KB
SHA256 1114fdc79d0006174a03e9ae52a857495af2c3e1c6bfbb83f63b1519a68dc491
MD5 d7551119be84694e4822329cfb43287c
SHA1 37de3f583ae8c52c3394a2851b2d7944abda538d
SHA512 b143ab128d1bcb4305f978c56a101b99aaf01af9f200a21ff997c3a03cb4e1c075327d7df1d1cf95d8901b153d5e85f8a64c28fa26ff466c58e14418f2d345fe
SSDEEP 1536:WUj06Jqn9L5ekBhDJ5o/GGP482LFFN7DqQfV5I+GCmBhjFW+JCYTDP0:D1QSkPJ5oOGw1FFwQ9bGCmBJFWpoP0
TLSH
T18F938EFBB2545F72C152C276215684F2F33954AED37AC2E9B028C09D33E7A1942FA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfjlolpp.exe

Path C:\Windows\SysWOW64\Mfjlolpp.exe
Size 91KB
SHA256 2adba9bc014180c0ef2faf0c5ab438f59d3afa42417a7cc2ba4c3926038c371b
MD5 0c41abdc9ab9efe1f9e8a3cd587d5a2f
SHA1 3732c71376bbe785181e093c91d8a043f1108a3c
SHA512 a7a748118a5cfae02381dac36f6e9b8d0e139ad53c768ba7373c896b618ae1857ba4c1acb0054ed870dea89ef74cb02e1551bbbba05592a14bbe432169533834
SSDEEP 1536:ErOszibKWNcmBuaDVBDGIeXC2LFJON7DqQfV5I+GCmBhjFW+JCYTDP0:b1N7rGIkF0wQ9bGCmBJFWpoP0
TLSH
T14B936B5F71750FB2C1851336355B59D2F72AD4A922A98BB11CE4C08D132FAF9E27BA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mjjbjjdd.exe

Path C:\Windows\SysWOW64\Mjjbjjdd.exe
Size 91KB
SHA256 0c0f053390e3242737c36ead5bb9ae470785a873b8c1ca281ade42b1866ea113
MD5 04ca7d5cf528fc595dd1d7c40762318e
SHA1 fbea6dd80085fc6abc6860d976d41955d7dee780
SHA512 3e48643da9aecb0812b92ba923084286875170f395035fc12de46bc256aa025c46c169d1c9ad472c6f51b5050cfe4d132f6bad0262ccacd4c07cbda4caceaaa3
SSDEEP 1536:AuAiwTSg60d8Jc0E8nO/R6S0fLcAo2LFJ5N7DqQfV5I+GCmBhjFW+JCYTDP0:Augb60wE8nO/R6LfAA5FrwQ9bGCmBJF2
TLSH
T196935CFABDA50BF2C2C60272355B0BD1E338076F1366D595903B84ED2633B5B8B7A254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ncecioib.exe

Path C:\Windows\SysWOW64\Ncecioib.exe
Size 91KB
SHA256 90e946eb2c6185b03c3cb3be23e544bacffb258d3dd168d70b4ada42e33429c3
MD5 ee85afb0eaab4b1eb07ac283c34109b3
SHA1 a93e821a471b5d0d116a454095cb07cf5fd954c0
SHA512 77f3bc96a9cdc5d6d836683976682284ca5e4114dfca117ab02cf21eee642cab689835a6ef59a9307d9610c795083c5180752845052b311264389b8de3da1998
SSDEEP 1536:VmZKBG7BJTwaPZkex4kQfP1l2LFJwN7DqQfV5I+GCmBhjFW+JCYTDP0:QUBG7B5wGH4koPQFmwQ9bGCmBJFWpoP0
TLSH
T1CA935C2B7E1D4FA2C9830372765A5BE2F718C0BA136681FD14AEC24C1367E24CB76756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nffljjfc.exe

Path C:\Windows\SysWOW64\Nffljjfc.exe
Size 91KB
SHA256 68c9688a651c188eef6b6f82177f8322e57268ec8b00284960e2f9620f66a61d
MD5 18d7acbcccace8d285988d68538c0884
SHA1 bb23eb6e40b9a9ed31a3195f219530f8c74af4fb
SHA512 3301f43151fd5f381439fb6df4fa2968dae6f476fd4ddd5ce6c51c67ec9287f1bc9150e4e0d6cf5f70c8db496150fa2cff8567c64804b84e70c3f07bbbcf6fa0
SSDEEP 1536:CwAShHL293/EtAel5of2LFJnN7DqQfV5I+GCmBhjFW+JCYTDP0:C0hHw/Xel5okFNwQ9bGCmBJFWpoP0
TLSH
T18C935E1FAF66CF7AC1860FF3326B18D6F32ED069527781446C6C815D1267A2742BA38C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nlphmafm.exe

Path C:\Windows\SysWOW64\Nlphmafm.exe
Size 91KB
SHA256 e0c1652a87cf4da122fb17d95ea16f1a1a17d8787b28052b0c4703332538a48e
MD5 e7e88d23ed1623ebb880b9bd3bcb510f
SHA1 25a935770157237c3c17765b35068f5a2f7b25b2
SHA512 dd2006b25b51784b220da96f293dc0d384e664f855b41c540f6c39894f194f5b7e303b4366b83b47944b882fc5c4bd578db5c767d2729cc3267a6bbdb1661551
SSDEEP 1536:MQI/voPHt6Zf5T4ciUwpiP7vR183TOupIe2LFfZN7DqQfV5I+GCmBhjFW+JCYTD8:tqf5lx7vYTxIjFBwQ9bGCmBJFWpoP0
TLSH
T175934CEBB2190FF2E181027D215EE5C3F36990D943A7868954A4D00D2372D7995BBFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-515-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/220-141-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/396-166-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/540-158-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/556-280-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/920-419-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/976-198-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1012-377-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1176-317-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1204-527-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1352-413-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1356-150-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1392-449-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1408-533-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1428-246-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1504-25-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1504-566-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1512-467-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1536-540-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1580-587-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1648-365-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1832-214-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1844-425-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1868-0-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1868-5-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/1868-539-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1964-581-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/1996-311-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2136-558-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2136-16-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2140-274-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2208-254-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2276-174-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2280-238-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2340-230-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2372-574-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2380-190-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2428-329-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2500-92-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2560-102-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2676-553-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2688-461-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2808-45-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2808-580-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2836-491-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/2936-206-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3032-61-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3116-222-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3128-323-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3176-395-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3208-117-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3264-286-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3276-521-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3284-443-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3292-86-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3336-359-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3364-560-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3436-437-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3532-134-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3544-401-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3744-341-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3824-347-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/3936-455-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4004-292-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4092-126-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4120-383-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4244-110-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4332-353-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4352-431-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4516-268-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4528-70-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4536-78-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4636-182-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4652-546-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4664-509-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4668-407-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4676-497-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4684-371-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4724-32-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4724-573-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4756-262-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4760-479-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4796-567-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4804-485-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4816-478-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4820-304-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4836-310-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4848-54-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4904-503-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4920-335-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4952-552-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4952-9-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4968-389-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/4996-298-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5152-593-0x0000000000400000-0x0000000000443000-memory.dmp

Download

memory/5192-604-0x0000000000400000-0x0000000000443000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads