berbew | becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afc

Analysis

max time kernel
117s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Size

148KB
MD5

c46b18b08c646586ad885b2c3d6533b0
SHA1

fc8c79e93a050b84641d4863295d45ea5e6638cd
SHA256

becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afc
SHA512

3158c8c4d10ac827cd210c15a118cfb4e13b218f45ff8b021016ab47cd9a6951aa84410af9bbfb7c8061b9a39216c68b52a2c941648d4ba94daab95c36f1fd27
SSDEEP

3072:UIQQFVu/flJoo8+iAMHX+0Y5OdzOdjKtlDoNQQ9wlHOdj+UCRQKOdj+U:UIfWdJLJ0KOdzOdkOdezOd

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emgdmc32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nobndj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mldeik32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhnfckm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadobccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apnfno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aifjgdkj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecnpdnho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogdhik32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgibdjln.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemkle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bogljj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bceeqi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkcfjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecjgio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mopdpg32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldpnoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mokkegmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oodjjign.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odacbpee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phgannal.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjgei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpqcpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmeebpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blniinac.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oodjjign.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgibdjln.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcdldknm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apilcoho.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apnfno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bceeqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bkcfjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lehdhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooggpiek.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogdhik32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnnmeh32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajldkhjh.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blniinac.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bakaaepk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnokdaq.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpqcpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bakaaepk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogbldk32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmeebpkd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokkegmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngeljh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogbldk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pimkbbpi.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadobccg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjgio32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkelpd32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldpnoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mehpga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhnfckm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngeljh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nobndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odacbpee.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Camnge32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlohmonb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjildbp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phgannal.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 46 IoCs

pid	Process
3016	Lehdhn32.exe
1920	Lkelpd32.exe
2692	Lmeebpkd.exe
2664	Ldpnoj32.exe
2564	Mokkegmm.exe
1508	Mehpga32.exe
2208	Mopdpg32.exe
2720	Mldeik32.exe
1252	Mnhnfckm.exe
2404	Njnokdaq.exe
1968	Nlohmonb.exe
668	Ngeljh32.exe
2216	Nfjildbp.exe
2992	Nobndj32.exe
2996	Oodjjign.exe
1724	Odacbpee.exe
748	Ooggpiek.exe
2532	Ogbldk32.exe
1544	Ogdhik32.exe
1572	Omcngamh.exe
1812	Pgibdjln.exe
2084	Pimkbbpi.exe
1720	Pcdldknm.exe
928	Pnnmeh32.exe
2296	Phgannal.exe
3040	Qhincn32.exe
2892	Ajjgei32.exe
2740	Aadobccg.exe
2540	Ajldkhjh.exe
2520	Apilcoho.exe
2980	Apnfno32.exe
2348	Aifjgdkj.exe
2588	Appbcn32.exe
1080	Bemkle32.exe
1052	Bogljj32.exe
2808	Bhpqcpkm.exe
2788	Bceeqi32.exe
2036	Blniinac.exe
2168	Bakaaepk.exe
1984	Bkcfjk32.exe
1716	Camnge32.exe
2280	Ecjgio32.exe
2772	Ecnpdnho.exe
1596	Emgdmc32.exe
1088	Einebddd.exe
1684	Flnndp32.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
3016	Lehdhn32.exe
3016	Lehdhn32.exe
1920	Lkelpd32.exe
1920	Lkelpd32.exe
2692	Lmeebpkd.exe
2692	Lmeebpkd.exe
2664	Ldpnoj32.exe
2664	Ldpnoj32.exe
2564	Mokkegmm.exe
2564	Mokkegmm.exe
1508	Mehpga32.exe
1508	Mehpga32.exe
2208	Mopdpg32.exe
2208	Mopdpg32.exe
2720	Mldeik32.exe
2720	Mldeik32.exe
1252	Mnhnfckm.exe
1252	Mnhnfckm.exe
2404	Njnokdaq.exe
2404	Njnokdaq.exe
1968	Nlohmonb.exe
1968	Nlohmonb.exe
668	Ngeljh32.exe
668	Ngeljh32.exe
2216	Nfjildbp.exe
2216	Nfjildbp.exe
2992	Nobndj32.exe
2992	Nobndj32.exe
2996	Oodjjign.exe
2996	Oodjjign.exe
1724	Odacbpee.exe
1724	Odacbpee.exe
748	Ooggpiek.exe
748	Ooggpiek.exe
2532	Ogbldk32.exe
2532	Ogbldk32.exe
1544	Ogdhik32.exe
1544	Ogdhik32.exe
1572	Omcngamh.exe
1572	Omcngamh.exe
1812	Pgibdjln.exe
1812	Pgibdjln.exe
2084	Pimkbbpi.exe
2084	Pimkbbpi.exe
1720	Pcdldknm.exe
1720	Pcdldknm.exe
928	Pnnmeh32.exe
928	Pnnmeh32.exe
2296	Phgannal.exe
2296	Phgannal.exe
3040	Qhincn32.exe
3040	Qhincn32.exe
2892	Ajjgei32.exe
2892	Ajjgei32.exe
2740	Aadobccg.exe
2740	Aadobccg.exe
2540	Ajldkhjh.exe
2540	Ajldkhjh.exe
2520	Apilcoho.exe
2520	Apilcoho.exe
2980	Apnfno32.exe
2980	Apnfno32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Emgdmc32.exe	Ecnpdnho.exe
File created	C:\Windows\SysWOW64\Lbpihjem.dll	Oodjjign.exe
File created	C:\Windows\SysWOW64\Blniinac.exe	Bceeqi32.exe
File created	C:\Windows\SysWOW64\Ecnpdnho.exe	Ecjgio32.exe
File opened for modification	C:\Windows\SysWOW64\Ajldkhjh.exe	Aadobccg.exe
File created	C:\Windows\SysWOW64\Qfchnl32.dll	Mehpga32.exe
File opened for modification	C:\Windows\SysWOW64\Nobndj32.exe	Nfjildbp.exe
File created	C:\Windows\SysWOW64\Pimkbbpi.exe	Pgibdjln.exe
File created	C:\Windows\SysWOW64\Ojoligof.dll	Pimkbbpi.exe
File created	C:\Windows\SysWOW64\Ajldkhjh.exe	Aadobccg.exe
File created	C:\Windows\SysWOW64\Ecjgio32.exe	Camnge32.exe
File created	C:\Windows\SysWOW64\Aifjgdkj.exe	Apnfno32.exe
File created	C:\Windows\SysWOW64\Jkkcdb32.dll	Aifjgdkj.exe
File opened for modification	C:\Windows\SysWOW64\Mopdpg32.exe	Mehpga32.exe
File created	C:\Windows\SysWOW64\Mpbelhkp.dll	Njnokdaq.exe
File created	C:\Windows\SysWOW64\Aadobccg.exe	Ajjgei32.exe
File created	C:\Windows\SysWOW64\Bemkle32.exe	Appbcn32.exe
File created	C:\Windows\SysWOW64\Omcngamh.exe	Ogdhik32.exe
File created	C:\Windows\SysWOW64\Apilcoho.exe	Ajldkhjh.exe
File created	C:\Windows\SysWOW64\Hkbbalfd.dll	Ajldkhjh.exe
File opened for modification	C:\Windows\SysWOW64\Ecnpdnho.exe	Ecjgio32.exe
File opened for modification	C:\Windows\SysWOW64\Njnokdaq.exe	Mnhnfckm.exe
File opened for modification	C:\Windows\SysWOW64\Oodjjign.exe	Nobndj32.exe
File created	C:\Windows\SysWOW64\Jdbnpf32.dll	Nobndj32.exe
File created	C:\Windows\SysWOW64\Bflpbe32.dll	Pgibdjln.exe
File created	C:\Windows\SysWOW64\Jmdaehpn.dll	Apnfno32.exe
File created	C:\Windows\SysWOW64\Mhnkcm32.dll	Bemkle32.exe
File opened for modification	C:\Windows\SysWOW64\Mokkegmm.exe	Ldpnoj32.exe
File created	C:\Windows\SysWOW64\Moiihmhq.dll	Mnhnfckm.exe
File created	C:\Windows\SysWOW64\Odacbpee.exe	Oodjjign.exe
File created	C:\Windows\SysWOW64\Bopffl32.dll	Bceeqi32.exe
File opened for modification	C:\Windows\SysWOW64\Emgdmc32.exe	Ecnpdnho.exe
File created	C:\Windows\SysWOW64\Fdbhpk32.dll	Lkelpd32.exe
File opened for modification	C:\Windows\SysWOW64\Ooggpiek.exe	Odacbpee.exe
File created	C:\Windows\SysWOW64\Ajjgei32.exe	Qhincn32.exe
File created	C:\Windows\SysWOW64\Jcgalk32.dll	Lmeebpkd.exe
File created	C:\Windows\SysWOW64\Nkadbc32.dll	Phgannal.exe
File opened for modification	C:\Windows\SysWOW64\Appbcn32.exe	Aifjgdkj.exe
File opened for modification	C:\Windows\SysWOW64\Apilcoho.exe	Ajldkhjh.exe
File created	C:\Windows\SysWOW64\Ooggpiek.exe	Odacbpee.exe
File created	C:\Windows\SysWOW64\Bkcojhgk.dll	Omcngamh.exe
File created	C:\Windows\SysWOW64\Mkcmnk32.dll	Aadobccg.exe
File created	C:\Windows\SysWOW64\Qhincn32.exe	Phgannal.exe
File opened for modification	C:\Windows\SysWOW64\Bceeqi32.exe	Bhpqcpkm.exe
File created	C:\Windows\SysWOW64\Mehpga32.exe	Mokkegmm.exe
File created	C:\Windows\SysWOW64\Mnhnfckm.exe	Mldeik32.exe
File created	C:\Windows\SysWOW64\Nfjildbp.exe	Ngeljh32.exe
File opened for modification	C:\Windows\SysWOW64\Bogljj32.exe	Bemkle32.exe
File created	C:\Windows\SysWOW64\Efpmmn32.dll	Mokkegmm.exe
File opened for modification	C:\Windows\SysWOW64\Mldeik32.exe	Mopdpg32.exe
File created	C:\Windows\SysWOW64\Dfaakfpk.dll	Ooggpiek.exe
File created	C:\Windows\SysWOW64\Lkelpd32.exe	Lehdhn32.exe
File opened for modification	C:\Windows\SysWOW64\Lmeebpkd.exe	Lkelpd32.exe
File created	C:\Windows\SysWOW64\Nacgfd32.dll	Bogljj32.exe
File created	C:\Windows\SysWOW64\Camnge32.exe	Bkcfjk32.exe
File created	C:\Windows\SysWOW64\Gnngnk32.dll	Camnge32.exe
File created	C:\Windows\SysWOW64\Lehdhn32.exe	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
File created	C:\Windows\SysWOW64\Mldeik32.exe	Mopdpg32.exe
File created	C:\Windows\SysWOW64\Ffemqioj.dll	Apilcoho.exe
File created	C:\Windows\SysWOW64\Ngeogk32.dll	Bakaaepk.exe
File created	C:\Windows\SysWOW64\Akomon32.dll	Ecnpdnho.exe
File created	C:\Windows\SysWOW64\Oodjjign.exe	Nobndj32.exe
File opened for modification	C:\Windows\SysWOW64\Ogdhik32.exe	Ogbldk32.exe
File created	C:\Windows\SysWOW64\Bogljj32.exe	Bemkle32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	1684	WerFault.exe	75

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mopdpg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbldk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omcngamh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pimkbbpi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajldkhjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camnge32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecjgio32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmeebpkd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flnndp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Emgdmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njnokdaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcdldknm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ecnpdnho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mnhnfckm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oodjjign.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ooggpiek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Appbcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nobndj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogdhik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajjgei32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadobccg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apnfno32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aifjgdkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bceeqi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odacbpee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mokkegmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nlohmonb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Apilcoho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bogljj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blniinac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bkcfjk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lehdhn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lkelpd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngeljh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjildbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phgannal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qhincn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Einebddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mldeik32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgibdjln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bemkle32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhpqcpkm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldpnoj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnnmeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bakaaepk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mehpga32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkcfjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ecjgio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogdhik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhincn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkcmnk32.dll"	Aadobccg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bakaaepk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdnej32.dll"	Pnnmeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecnpdnho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mehpga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnfnhaca.dll"	Nfjildbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oodjjign.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odacbpee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmeebpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfchnl32.dll"	Mehpga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhnkcm32.dll"	Bemkle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogljj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Appbcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngeogk32.dll"	Bakaaepk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lehdhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlohmonb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bflpbe32.dll"	Pgibdjln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkadbc32.dll"	Phgannal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akomon32.dll"	Ecnpdnho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcgalk32.dll"	Lmeebpkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgldklaj.dll"	Nlohmonb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbpihjem.dll"	Oodjjign.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bopffl32.dll"	Bceeqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkekbn32.dll"	Odacbpee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aadobccg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Einebddd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mokkegmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmflbo32.dll"	Ogbldk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcdldknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhpqcpkm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejapnc32.dll"	Mldeik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgibdjln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bedoacoi.dll"	Blniinac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efpmmn32.dll"	Mokkegmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfjildbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdbnpf32.dll"	Nobndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefllkej.dll"	Bhpqcpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogdhik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bogljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mldeik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apilcoho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onndkg32.dll"	Einebddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moiihmhq.dll"	Mnhnfckm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ooggpiek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkbbalfd.dll"	Ajldkhjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngeljh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jenndm32.dll"	Ogdhik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omcngamh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmdaehpn.dll"	Apnfno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bceeqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bakaaepk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lehdhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mldeik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnhnfckm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njnokdaq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phgannal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mokkegmm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3016	2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe	30
PID 2724 wrote to memory of 3016	2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe	30
PID 2724 wrote to memory of 3016	2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe	30
PID 2724 wrote to memory of 3016	2724	becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe	30
PID 3016 wrote to memory of 1920	3016	Lehdhn32.exe	31
PID 3016 wrote to memory of 1920	3016	Lehdhn32.exe	31
PID 3016 wrote to memory of 1920	3016	Lehdhn32.exe	31
PID 3016 wrote to memory of 1920	3016	Lehdhn32.exe	31
PID 1920 wrote to memory of 2692	1920	Lkelpd32.exe	32
PID 1920 wrote to memory of 2692	1920	Lkelpd32.exe	32
PID 1920 wrote to memory of 2692	1920	Lkelpd32.exe	32
PID 1920 wrote to memory of 2692	1920	Lkelpd32.exe	32
PID 2692 wrote to memory of 2664	2692	Lmeebpkd.exe	33
PID 2692 wrote to memory of 2664	2692	Lmeebpkd.exe	33
PID 2692 wrote to memory of 2664	2692	Lmeebpkd.exe	33
PID 2692 wrote to memory of 2664	2692	Lmeebpkd.exe	33
PID 2664 wrote to memory of 2564	2664	Ldpnoj32.exe	34
PID 2664 wrote to memory of 2564	2664	Ldpnoj32.exe	34
PID 2664 wrote to memory of 2564	2664	Ldpnoj32.exe	34
PID 2664 wrote to memory of 2564	2664	Ldpnoj32.exe	34
PID 2564 wrote to memory of 1508	2564	Mokkegmm.exe	35
PID 2564 wrote to memory of 1508	2564	Mokkegmm.exe	35
PID 2564 wrote to memory of 1508	2564	Mokkegmm.exe	35
PID 2564 wrote to memory of 1508	2564	Mokkegmm.exe	35
PID 1508 wrote to memory of 2208	1508	Mehpga32.exe	36
PID 1508 wrote to memory of 2208	1508	Mehpga32.exe	36
PID 1508 wrote to memory of 2208	1508	Mehpga32.exe	36
PID 1508 wrote to memory of 2208	1508	Mehpga32.exe	36
PID 2208 wrote to memory of 2720	2208	Mopdpg32.exe	37
PID 2208 wrote to memory of 2720	2208	Mopdpg32.exe	37
PID 2208 wrote to memory of 2720	2208	Mopdpg32.exe	37
PID 2208 wrote to memory of 2720	2208	Mopdpg32.exe	37
PID 2720 wrote to memory of 1252	2720	Mldeik32.exe	38
PID 2720 wrote to memory of 1252	2720	Mldeik32.exe	38
PID 2720 wrote to memory of 1252	2720	Mldeik32.exe	38
PID 2720 wrote to memory of 1252	2720	Mldeik32.exe	38
PID 1252 wrote to memory of 2404	1252	Mnhnfckm.exe	39
PID 1252 wrote to memory of 2404	1252	Mnhnfckm.exe	39
PID 1252 wrote to memory of 2404	1252	Mnhnfckm.exe	39
PID 1252 wrote to memory of 2404	1252	Mnhnfckm.exe	39
PID 2404 wrote to memory of 1968	2404	Njnokdaq.exe	40
PID 2404 wrote to memory of 1968	2404	Njnokdaq.exe	40
PID 2404 wrote to memory of 1968	2404	Njnokdaq.exe	40
PID 2404 wrote to memory of 1968	2404	Njnokdaq.exe	40
PID 1968 wrote to memory of 668	1968	Nlohmonb.exe	41
PID 1968 wrote to memory of 668	1968	Nlohmonb.exe	41
PID 1968 wrote to memory of 668	1968	Nlohmonb.exe	41
PID 1968 wrote to memory of 668	1968	Nlohmonb.exe	41
PID 668 wrote to memory of 2216	668	Ngeljh32.exe	42
PID 668 wrote to memory of 2216	668	Ngeljh32.exe	42
PID 668 wrote to memory of 2216	668	Ngeljh32.exe	42
PID 668 wrote to memory of 2216	668	Ngeljh32.exe	42
PID 2216 wrote to memory of 2992	2216	Nfjildbp.exe	43
PID 2216 wrote to memory of 2992	2216	Nfjildbp.exe	43
PID 2216 wrote to memory of 2992	2216	Nfjildbp.exe	43
PID 2216 wrote to memory of 2992	2216	Nfjildbp.exe	43
PID 2992 wrote to memory of 2996	2992	Nobndj32.exe	44
PID 2992 wrote to memory of 2996	2992	Nobndj32.exe	44
PID 2992 wrote to memory of 2996	2992	Nobndj32.exe	44
PID 2992 wrote to memory of 2996	2992	Nobndj32.exe	44
PID 2996 wrote to memory of 1724	2996	Oodjjign.exe	45
PID 2996 wrote to memory of 1724	2996	Oodjjign.exe	45
PID 2996 wrote to memory of 1724	2996	Oodjjign.exe	45
PID 2996 wrote to memory of 1724	2996	Oodjjign.exe	45

C:\Users\Admin\AppData\Local\Temp\becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe
"C:\Users\Admin\AppData\Local\Temp\becb875c4fa5fac0323abc0c3a73a2c498f66acc60a2947dbb6a236259154afcN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\Lehdhn32.exe
  C:\Windows\system32\Lehdhn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\Lkelpd32.exe
    C:\Windows\system32\Lkelpd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\Lmeebpkd.exe
      C:\Windows\system32\Lmeebpkd.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\Ldpnoj32.exe
        
        C:\Windows\system32\Ldpnoj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2664
      - C:\Windows\SysWOW64\Mokkegmm.exe
        
        C:\Windows\system32\Mokkegmm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Mehpga32.exe
        
        C:\Windows\system32\Mehpga32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Mopdpg32.exe
        
        C:\Windows\system32\Mopdpg32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Mldeik32.exe
        
        C:\Windows\system32\Mldeik32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Mnhnfckm.exe
        
        C:\Windows\system32\Mnhnfckm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\SysWOW64\Njnokdaq.exe
        
        C:\Windows\system32\Njnokdaq.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Nlohmonb.exe
        
        C:\Windows\system32\Nlohmonb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Ngeljh32.exe
        
        C:\Windows\system32\Ngeljh32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\SysWOW64\Nfjildbp.exe
        
        C:\Windows\system32\Nfjildbp.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Nobndj32.exe
        
        C:\Windows\system32\Nobndj32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Oodjjign.exe
        
        C:\Windows\system32\Oodjjign.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\Odacbpee.exe
        
        C:\Windows\system32\Odacbpee.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1724
        
        C:\Windows\SysWOW64\Ooggpiek.exe
        
        C:\Windows\system32\Ooggpiek.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:748
        
        C:\Windows\SysWOW64\Ogbldk32.exe
        
        C:\Windows\system32\Ogbldk32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2532
        
        C:\Windows\SysWOW64\Ogdhik32.exe
        
        C:\Windows\system32\Ogdhik32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Omcngamh.exe
        
        C:\Windows\system32\Omcngamh.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Pgibdjln.exe
        
        C:\Windows\system32\Pgibdjln.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\Pimkbbpi.exe
        
        C:\Windows\system32\Pimkbbpi.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2084
        
        C:\Windows\SysWOW64\Pcdldknm.exe
        
        C:\Windows\system32\Pcdldknm.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Pnnmeh32.exe
        
        C:\Windows\system32\Pnnmeh32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:928
        
        C:\Windows\SysWOW64\Phgannal.exe
        
        C:\Windows\system32\Phgannal.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Qhincn32.exe
        
        C:\Windows\system32\Qhincn32.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3040
        
        C:\Windows\SysWOW64\Ajjgei32.exe
        
        C:\Windows\system32\Ajjgei32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\Aadobccg.exe
        
        C:\Windows\system32\Aadobccg.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Ajldkhjh.exe
        
        C:\Windows\system32\Ajldkhjh.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Apilcoho.exe
        
        C:\Windows\system32\Apilcoho.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Apnfno32.exe
        
        C:\Windows\system32\Apnfno32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2980
        
        C:\Windows\SysWOW64\Aifjgdkj.exe
        
        C:\Windows\system32\Aifjgdkj.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\Appbcn32.exe
        
        C:\Windows\system32\Appbcn32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Bemkle32.exe
        
        C:\Windows\system32\Bemkle32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Bogljj32.exe
        
        C:\Windows\system32\Bogljj32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Bhpqcpkm.exe
        
        C:\Windows\system32\Bhpqcpkm.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Bceeqi32.exe
        
        C:\Windows\system32\Bceeqi32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\Blniinac.exe
        
        C:\Windows\system32\Blniinac.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Bakaaepk.exe
        
        C:\Windows\system32\Bakaaepk.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Bkcfjk32.exe
        
        C:\Windows\system32\Bkcfjk32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Camnge32.exe
        
        C:\Windows\system32\Camnge32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\Ecjgio32.exe
        
        C:\Windows\system32\Ecjgio32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Ecnpdnho.exe
        
        C:\Windows\system32\Ecnpdnho.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2772
        
        C:\Windows\SysWOW64\Emgdmc32.exe
        
        C:\Windows\system32\Emgdmc32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\Einebddd.exe
        
        C:\Windows\system32\Einebddd.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Flnndp32.exe
        
        C:\Windows\system32\Flnndp32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 140
        48⤵
        Program crash
        
        PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadobccg.exe

Filesize
148KB

MD5
8637ec8aa6f49d2833b42be30df4003c

SHA1
36839d24d2a5be5eaefb25d3948c68b9c4eda942

SHA256
b863b20d7d6b7ff5ba45ec5394c288a53df86de0e34f36cf6c695b4f49d794b4

SHA512
5a5a75792156fb99df9b24f41545657c3552089b95cd8a0e74e14eb20452f01958568db46d5d19c334ae37c54992c705dbea23f69277b56ecf4f6f0fab5f0f06

Download Submit
C:\Windows\SysWOW64\Aifjgdkj.exe

Filesize
148KB

MD5
bab8ea78df533a1c069e16f4cb3f2d16

SHA1
1bb126a171959a72bb747e87d1b84726978d4e5c

SHA256
9ca8c475fa42aa2565bdb16d7f733c75a215a34b9439065ba122152d0e33eb52

SHA512
845d50ec9b41f31a76daa2663b05a0d8f8a8edb216f1a78902fd4d96002f29b7ac3f0601f0ed7d45c96a666ddad0a43c5bb0945d7ff84381017ed45412bd3ab0

Download Submit
C:\Windows\SysWOW64\Ajjgei32.exe

Filesize
148KB

MD5
9403ea3f91f1f16a5758946ba1fc5b56

SHA1
3ddfc6dc0ab6ca8a247db9f138bb28c452bdde23

SHA256
e71d71ae270e8ad004688809a95389844df476f2e16871bc19d443c2bba37685

SHA512
7debd67cf5e688cd458f3b6279a7182fb2bd9eea2847907d9884ed384a1d794144efd3b78b201101537595738b5c76e5c9713e9241e8a5bf6630b13b121bd9ca

Download Submit
C:\Windows\SysWOW64\Ajldkhjh.exe

Filesize
148KB

MD5
45ad26c92c04c504a84f40aa4fa5f454

SHA1
26843da74bbd231035e94ed50e3dbbe1cd489998

SHA256
e56e8aa0a707350439ae5abb12d849786153e22bcbc66176bd0c766717dc0d93

SHA512
abf04e21f3bff70105d98bf399afea3f230d5e388a8990144fa3cbc577bc97531d16a5a60714f76127fd64a62eb15fbd12648c12c982f9ed788ffbc2bd99d563

Download Submit
C:\Windows\SysWOW64\Apilcoho.exe

Filesize
148KB

MD5
bd5528734ef2f064d7e5c7e54225c36b

SHA1
c3ebf677705f19132f96ddda1eeaf4d3a68bf823

SHA256
6b81d745773977c32c745e75afd6f54237dc6bd7b84a438b20470be63c62991e

SHA512
0d9abc0ae2727087e1ebd640d05aa6b7374a48e35c4393bad34e6650f02a1f45861625d829776dda9ccff4e93053bbb92506ce8822ccb95d807c1755c5daa981

Download Submit
C:\Windows\SysWOW64\Apnfno32.exe

Filesize
148KB

MD5
63f266cc58a2605587adccc85ed14e8d

SHA1
e5fa5a4a1255218756a3a465430aa2908f8dffa8

SHA256
e9b4d0fc34e1894c053f2e493095656dee6ab905d6e3de41b7407ad77578709b

SHA512
4300b6d9542e571cda4d93f74f999661a35697a77300833231cdf7d373c1891c44c67e2a6cc05daec5ba80ef81b5f50bce65f8696ece00b708a1e6feb83dda2d

Download Submit
C:\Windows\SysWOW64\Appbcn32.exe

Filesize
148KB

MD5
0763345be661bf27110992e3bf52c552

SHA1
0162527379343d5c36ead6fa31f7d03267dc7471

SHA256
6b83ac7c380ee04af9aef00d724e7810811e3e6a49e2e9f8be5291334c5361a4

SHA512
5ebfac003cb7240b6bd724a4d5ac6510bf4d9101b6f6c3e003d803bfe09a0c057c817ffebd7f4db3f916e6c9b97c0c37274ac5ab4ddd4af59fb9e6b5ac631ba4

Download Submit
C:\Windows\SysWOW64\Bakaaepk.exe

Filesize
148KB

MD5
beb88bced4cfa03a900fe0c57420a494

SHA1
3a8131e90e2636f636a0f28cef0352c02dbbd0aa

SHA256
20677e1ef78f56fa6b82096645b6d23c552fa8aea862a6506a04774873e87320

SHA512
37fb4f661951b3d9f1b048d74081f7c495e98fe9be66c4764248c2a65887dc1fb8e3997c1b002d71bb005600084a8108b30a12d39afafd3dc5f36584aee372dd

Download Submit
C:\Windows\SysWOW64\Bceeqi32.exe

Filesize
148KB

MD5
e64da314fe8937aa39d595e634abf79f

SHA1
0ad9b19cafe43f54e25c695e00b9666ddb8a03f5

SHA256
d7218b28ed80eb09e56f8f5e30425604f6a08c3c1a6122e0501437708ad4d1d2

SHA512
7d424f96c23a9ffc5cfa88e1fccd6b01837fe75b0390e74a4fa3bd015166c57208ea1d8655f0ffc6344d1dffb998ce9a8d894fbfa7743176ff6124001a2172b5

Download Submit
C:\Windows\SysWOW64\Bemkle32.exe

Filesize
148KB

MD5
2c8eb1243ee6dc0ae869dc973bb2286c

SHA1
d66e946b2f779306a83415db43a3fe9365931040

SHA256
18f5b5d631373c3ce4cf5988273265557e1b646eea119992b6d4c79ecd226b68

SHA512
6258f70292d3138f0b7ee17e9937fba0ca9aa81d6f72d80cc3a24bf4ad3d5d7cc355cb178ed2940cc67d9c501b85f0825b60d07f3b14779ebb37aa66239b9f3e

Download Submit
C:\Windows\SysWOW64\Bhpqcpkm.exe

Filesize
148KB

MD5
108843b25f7faa228b97891ff05d0f81

SHA1
0bd45859ae871f71d5578cc1124b336cea0029ba

SHA256
7c58471617c1e475dcc44972ee1c0c35cf41e481d914ec41e82075afb8c42d8f

SHA512
37c8967160650bb86487dd2b8741e1ae7cdb27412353960c7979124a3aea73297bd36dc6a72af232efe78d5f996a786c89771fb84125bdb5619e19415a742742

Download Submit
C:\Windows\SysWOW64\Bkcfjk32.exe

Filesize
148KB

MD5
a6bb6c3850fbd8caf09205c078d7876b

SHA1
13c1a67d0fb9a913afbb08769a7a40ba7b8674b1

SHA256
0c89f671ec9c8c729f7806affa16ecb3fe26dd3361956fc55644272d3791b354

SHA512
913ff315490a6f361e66da503fae9577e8d201dab36eb886ab232afd55fdf5c82a070bac8e4a36498a09beb644860f1a1cfc1f5feba21f2da79e01cc5b399e8c

Download Submit
C:\Windows\SysWOW64\Blniinac.exe

Filesize
148KB

MD5
09d810fc3db5ab4b1ea764e86309290f

SHA1
786c5e787d5836126815b42d1c816ddafaa9a124

SHA256
1ddb523fe23220d8202463d0f12a78fdd51b4760718dd6366820cf1b688be51a

SHA512
0e54921876e6a55134bd6f6f1282b28cd5c01e45bff270ee4c1a40dedd99873be65d6aa4804805204b213da90276bbd6a7b57abcfd3eb26370a125b739527db0

Download Submit
C:\Windows\SysWOW64\Bogljj32.exe

Filesize
148KB

MD5
b31da7a3ff78a8b6e832ffd0f8be8727

SHA1
10155bb1d69b9f96c763ba2a131f79e75009a349

SHA256
d1bc7c9763e6d45f1dbe996b36cc7b9ddcea34676718c62405e0c61a63d750d8

SHA512
4b48053a7d94dab5af884955897195eacf11db01aec850d4c76d0ee95ece24974fa9659d1fe37687b2cf2a7224ab781ae2faa5e63492d656e216b3e14e5a9e57

Download Submit
C:\Windows\SysWOW64\Camnge32.exe

Filesize
148KB

MD5
1a811e128ecc7a53039c8589aef7b5ff

SHA1
83a73edfc0259e3afd8396ceeeb1ed0313f63bc4

SHA256
21d36e3c229db562222f5483a40f0ade42c2f547c36c5fe5452af78a230c924f

SHA512
5e5f738879c3816e6ec6296d88105b54467048088ad300b30e56a1777d85c24097e3d50cdd0d8d42a00462bf8392fce8984951df8a4be7b1d8f2809860f4b00b

Download Submit
C:\Windows\SysWOW64\Ecjgio32.exe

Filesize
148KB

MD5
72fc07924506e53d47fd5b2023eaa737

SHA1
c48c4556c8399ec280df542b470042d91e7c495e

SHA256
775770596cba1cd24df57bd0c923d4c23fae1f99896c4741eb42bf03e2a83aa8

SHA512
17d7ab4efd3045a14ffacbce6d9cbbda7ba59d87cc13fb8eafc7f41ca61e7b38f83506cc8357a1ef90203f0ff6f0e223a25d0285c24eeff38550cfd7b4ac050d

Download Submit
C:\Windows\SysWOW64\Ecnpdnho.exe

Filesize
148KB

MD5
2220d7c5087b8b35bf2844c5c463d62b

SHA1
751212d182399765ac6776a562a0941ab313b249

SHA256
9f5b2d35b2414ace5e9ed7b21d6b58d933047b0499dc86270b9a051bf04eb38a

SHA512
63e6f222aa7ae0389ce2f29aa17992759128cfe360aa4abcbf0d0ec7267d210b658d6b0af8b66066ef950f9d4187e6adc3282c6f94044b9e9ec8c7c91326a06b

Download Submit
C:\Windows\SysWOW64\Einebddd.exe

Filesize
148KB

MD5
de893b2210f4aa8352d9dbeb57109f1c

SHA1
b5c30d19f473f61d5da0090a463105fa56280761

SHA256
03aa3369518485f9e6799b0ff7087e3e0e0472649aeb245e91b3d247c987ea50

SHA512
9fa4f0f18b6f19f561ccf56ef50deddb7ec9bb997d474d3d911402f2bfbb51f57df3d9ed84216a60badf05e5b025352bff3ec04ec838448eb57451034b36fe54

Download Submit
C:\Windows\SysWOW64\Emgdmc32.exe

Filesize
148KB

MD5
019a17bafea5808d009474f6cde0ea7e

SHA1
2938b1f86a669de6dffb2f6280047f5529b7c13f

SHA256
98e3d749f043778617c809922cf4e7d7af1a9002c153b0b4c969aa7cb96ebf74

SHA512
748b6abb8f7d11a571e9539b41a9358c06ddc5f945fee912d825e3f54ff0479f0ede93de96f02c9e1ea3e3190de70bba2402fe9466ad5cb23316bfa1102ef61e

Download Submit
C:\Windows\SysWOW64\Flnndp32.exe

Filesize
148KB

MD5
23a31daa2414f183c04075b695d17d3d

SHA1
db4b4f68ca088b4a664f8e7bca65dfd5b032c568

SHA256
f8d5149dc9b17170a280475be7a8d483d521803ba5c0040d38048b2b8cd9baa6

SHA512
40eff2f23107d4bf141832e5f34585b47729f279c0ef156d700256b29e4df86e7d3651289459a9fed55015886122810a0dd3f7b5770507d9217f397214fc1f1f

Download Submit
C:\Windows\SysWOW64\Mehpga32.exe

Filesize
148KB

MD5
f8260229ff930206837764ca41611d06

SHA1
dcefe2fa39a4b921509d22483a743b158a91e2b2

SHA256
61fc044ea0e50dd26bb212e8c23127252fb65c35309d730dd8a38ccd48c7656e

SHA512
17fa92d068f54534456ba7327ccac7933a4beba4b98ced84e4c8d6fd0df229af7a4c7d20121f44545b33aa319451f19d20ffdc50a091dc3060e9c4418dbe2270

Download Submit
C:\Windows\SysWOW64\Nfjildbp.exe

Filesize
148KB

MD5
99b262f36a94427cba942da01bd6c6c7

SHA1
3c55ce0d3e1b71d9756d6cc83e9d8d83861a4039

SHA256
eb0acfe543c32722342eb287d9733c22325bd3d0d9de535e67dfe97041934257

SHA512
1d7dafe6f805a1c16e13fbbbb451f2cce3552aa25f207780c60350310ec32bd2ff48d7cb7bec66f907244925b6b4a751bfa044e411d7cb75696c88b2c6c5f521

Download Submit
C:\Windows\SysWOW64\Odacbpee.exe

Filesize
148KB

MD5
64b65c294982350a3d40b508476eeb59

SHA1
08b762ebd0adc86ee3d3b25f44814c4dc07e93d5

SHA256
5a03103d2c57d72bd44f09e7fe71c7d4bd6f41218b040267432082382794aed3

SHA512
0ee1c2dde8173d0788268ca0497884331111b5ba4a80ea0b9536a2316e7f74d41ecd46ba53e0ef8cfca67576202e707e654e7819b09723409bcff44ac84cdc30

Download Submit
C:\Windows\SysWOW64\Ogbldk32.exe

Filesize
148KB

MD5
ece35b21a89e61fac5234a370c6f8f3b

SHA1
bf075235275446b8c93651114bdc6185b3b069ae

SHA256
8837792593f4d2cc99cccffe08fc379b03a662cad2e10cf19e35dd35f68d5c92

SHA512
246f7945486a73af1db6b6aa0bfdec4f962b6fc4946e4ea007ffba4283af3a150f7d7eca44e9ab2c31a79adebf6a2b8565b1f7c34c736982e8c3f894f5d23bd6

Download Submit
C:\Windows\SysWOW64\Ogdhik32.exe

Filesize
148KB

MD5
ab86aad38b17c446ac25c7246106b305

SHA1
1ba496f7bb87c5d2497eed94428e4f2edc481546

SHA256
d97dc5e0baa4688eb7e9d2efed9ea039d086b21397496db8260c43f9394334ef

SHA512
ae959fb24b2e5be28ef900872ae814a293b5919d8956f62e07f48dd5b154f982e18769afc8b13d1fe8d680bede999ac73cd02321cf92d28b33ce8cfee578a6fe

Download Submit
C:\Windows\SysWOW64\Omcngamh.exe

Filesize
148KB

MD5
b58c879a2cbb9c7426eb2b861072c72d

SHA1
f4a377250851cb51778ac0c5ecb5590cff5d35fb

SHA256
f40013ae86a8deaeae321dd2c9510cb9aee0aa5d7ae53cdc3f892db99b576916

SHA512
746446a936911f820949034aaf49f3f9a2df2f2cbb41f89a15aa0a9408f73a96a84ba8a3b57ee6e699a708715aec11447e29c72d83e93e47189892b2dac6baa2

Download Submit
C:\Windows\SysWOW64\Oodjjign.exe

Filesize
148KB

MD5
77977bd33e507343d13658382898cf72

SHA1
cd8bbf46897b8b98e337db704b6747e7243cf5f6

SHA256
af68ac2825c71afd8f0b431ffb68719084404fbfb129665d55da955cc85d1704

SHA512
12d04c9e4373edf5fc203a6b2cda32d68297ea9353917381d78df17b2bba5538a68ba1d8a1e38304546ce4cb1f910d5bb15a1c18e98131f741326f11c4535dec

Download Submit
C:\Windows\SysWOW64\Ooggpiek.exe

Filesize
148KB

MD5
05e7364516c66a5c19b65d97234fc0d2

SHA1
3528462df174cd320f2e2e4971293372ee77fbf9

SHA256
4750867e348ec837d76518735272f9f26a935fac8ffaf88b837a31a308ccaf45

SHA512
300cd92a2d1a6485041b15d9d53b285969982d690313115903f69c7c777c24466e8fc2ec1093293496407a02591d7d9279a525a82adf0fa219e37f396f4c60b5

Download Submit
C:\Windows\SysWOW64\Pcdldknm.exe

Filesize
148KB

MD5
7e16b4b68bbdfd6e339b1ebc21c3c690

SHA1
df089e35fe3db6ec6ef806f805100bc26879491b

SHA256
1b62993115855476068faa00d0d38d327a9f2f2045a1e08be07afee10720d6fd

SHA512
ad938420feaa182b8805bb03ea20c74e4194232e7be26ddb7464d97893531f0ee285b514c574da6b8331048a4f675b6e14b42e6901a30ae6b5f08b6121dc2b2c

Download Submit
C:\Windows\SysWOW64\Pgibdjln.exe

Filesize
148KB

MD5
f670708b47eb6e1fe6a6069738db680a

SHA1
756097534d116169776929382fbc58636df91835

SHA256
1de1d9673f9fe7058f40b0e51fa8383c15402054ff6a833529f1ce1f47367848

SHA512
96328e77d448813bbf2d90b4a5eb984396e87629681e123d896aeef11906d1ad7913606e187f334eb5abd765e5d8989a46b1bf61bd315f67b9cc4d098862acbc

Download Submit
C:\Windows\SysWOW64\Phgannal.exe

Filesize
148KB

MD5
42b9663b51160c8495822b627e875291

SHA1
68d7734c0575c0775b8db95c96dc42fbc69b0f29

SHA256
cea1db0a9b137e1d1fee43346ad183218a08b951b93321a20a82e6df7f058f85

SHA512
746b7c19648da4a1e062ca38969d3d2f6d3e128a28b915e228fdf047918e45c353f87baf40bda5d30be491731569dd2fac20173e3c830cd3e3e70c131e013233

Download Submit
C:\Windows\SysWOW64\Pimkbbpi.exe

Filesize
148KB

MD5
2c390b8ca0e92f288e02f553a374fe15

SHA1
cf0f8d088e84013d0bdb45f58b3cccdf01f40294

SHA256
c3450868c5feedc8f0aeb99b96b6f3ebe1ce9cdf40ebbea9543a483b5643e715

SHA512
82d8ba4f5ec741c3e8a6665ea3869b841aa9cf9a77622081cc1648fbc33491c552761bf4be1ce34c36c1ef01e8bb0f178737f11e2c18f45097c54b2cbba4e3ae

Download Submit
C:\Windows\SysWOW64\Pnnmeh32.exe

Filesize
148KB

MD5
1f6d01f5e0161bb36253f164a09c8022

SHA1
71568dc0f32109b5617ad96cf429655b2ca85aa8

SHA256
68c2c739f568439d54b14193083b07e12a950af16ec4f37ac80f3879ac5b3b69

SHA512
4a55142866fe4585d9744ad806b62abf510059032d925a7c09d0255d7404bd5d1da0189491c33da916904fe52e7ff4b00eaf25d52d67ba689b8a9c2034f55c0e

Download Submit
C:\Windows\SysWOW64\Qhincn32.exe

Filesize
148KB

MD5
c4425ce998dac575d2c5c78602475c0d

SHA1
563533ca78a491c657e7dccf3185e86b91484c2b

SHA256
2b1152d96f5207e7fc22fd2311f1ca660ec2c5e819d80462df2eeb8a60dcff15

SHA512
2ab6ef126b2de551937062cde1930b636b44fbf5b12bcf159fd64f90abe3bfe8a7fd30189c201ecd90c3161b5d07e5b760d1c18dcd35d206b03b59b111ef1d5b

Download Submit
\Windows\SysWOW64\Ldpnoj32.exe

Filesize
148KB

MD5
bf92d9fed6712b750e3122c14b6e1eff

SHA1
569152635f8d4984caa869373bac4ffc5bd0099b

SHA256
201c734393ea0f2d633ef5aa2b41517e8ffde2ef7c8ea7799572d6cf2f03ff60

SHA512
717a747bb1637cf252f88756c8fbf1bfe0209256ca0ee666eac8e8298c1cbf0dba1ea3d3912f2937234eb8c36b97bedd11c1b0652b00dd0e36321c2b872be781

Download Submit
\Windows\SysWOW64\Lehdhn32.exe

Filesize
148KB

MD5
64f184598a5cc5023f7ec61a80fd2354

SHA1
5b75d9dad13288d94561af86081deee0443ed812

SHA256
36202e52de49167325c9e4acf98fafe54714444b0ff28bdc859a76721181071a

SHA512
9fa02a5ce067632e5dd546f1ea638bd9c0329079e0fac5dea5b09b5dfef986bbcc67815e635e456d62970c28b69d0ce4804b2cf6614d92b8364351562dbb1e60

Download Submit
\Windows\SysWOW64\Lkelpd32.exe

Filesize
148KB

MD5
1280a197c2e70a92737ebb55f4102b11

SHA1
8be0de739bc05c33ab27c5fdaa79e35ab9f71c50

SHA256
73822b337bcc3b8cb2175774901bae886084c41fe16664f01de904c1b397c66b

SHA512
76bae7773ad87189dfb128f2c4ab5b54e10f2f1042df03427a592736ddd8fbd3446da4e491f60b056c0f1d13f8cd08c4b6ffbb5b2224b44f306a4b05519931ff

Download Submit
\Windows\SysWOW64\Lmeebpkd.exe

Filesize
148KB

MD5
015e2b9fccbcd62b17b24642137af745

SHA1
8c1f39eea88a8db1cb84dcfc9fbe9a2ac8ade83d

SHA256
d1d35477ac45c2eaac6dbe31edfab1f7d1f4a3135326abcde937f6585b0e53ba

SHA512
c20d81f896cc9f34d5ac35ed6620b8e68b747f0a7e3f590b390a116382ffdcd4eea9b5b7a49bc96cf47cefb50506ea63b7280f4bc660a455dce3fdb0153a8a66

Download Submit
\Windows\SysWOW64\Mldeik32.exe

Filesize
148KB

MD5
e789b251568c0df658a40489015ff668

SHA1
83c7580e750874c7c49c5037f1feebb4233dd55e

SHA256
06bf33df387c46ec9d15d8fe1087b44de6986965b28174cece9247877b5dc8da

SHA512
126a49789766f892c2cef7c3742dad7ab4bdba901d4376fdc70109f594a31dac2f6312c50b7e3c1bcd0ec7f7e877e4c523c9e26016fd271fac44c178fa433b46

Download Submit
\Windows\SysWOW64\Mnhnfckm.exe

Filesize
148KB

MD5
3ccae98080f97099e072b20319b4afdc

SHA1
50edac7abd96bec2caf1a8104aa505856d396b46

SHA256
863ddc361476cfba34bfbf3ae2e2eaca787d296a302eaf61b6f392d8ae41bb4b

SHA512
6299a1976a4cca48381e5545fa60fc1cfb70d474f92097938625152387ba222cf234bdb1d7a3df2686eba24d94a859685c2f46d8cb5cd18222b648c0cb8e56d8

Download Submit
\Windows\SysWOW64\Mokkegmm.exe

Filesize
148KB

MD5
6e6eb8c71117825f5499011ac3fbdeef

SHA1
ee2311e821f0e90ad786bda69ae9a862f1d01ab2

SHA256
540a4c78d6048a9b60bd8c8414aeb04f3980aed02546bf83f8967429aabd4f0a

SHA512
7c8bb8a7defd6e32632e00f4a2918d51a536570a6dd990da05320ca18dd9c970204b39d1a08c3300e1cc648fff65a353e2e0e4b937dba8c86ced8b35d18957a8

Download Submit
\Windows\SysWOW64\Mopdpg32.exe

Filesize
148KB

MD5
3f5ad5841c1b7861d21c5306181567ad

SHA1
8f08c75d4daef3628367b0eaf61f22325a77b4be

SHA256
c11ee32d06ad795bea31fd63dc68106ada4a582af85d8aa419c09d5618f67a9a

SHA512
c39106944532028dc86122310a7686f05b09f4281d02d243e2690074866ed93e95b30d05f18d1640926415444c975b7594badccb58783fda7c006566ac2b2d4a

Download Submit
\Windows\SysWOW64\Ngeljh32.exe

Filesize
148KB

MD5
252690693c73bc42af8f1e5397c11379

SHA1
b5af457a1c4b56a61ec26dce8f0782dbadf0b8c1

SHA256
a86b5d02e8cc08e9cb9b900385047be3e828a2f1a4b67cdaf91adfa228990d3a

SHA512
5a63cb80529f36078a1d53da0f5e75ce89598bce1c3e7f0f3d3a5827affc255cb0c4158e70e5870c906e68dd08924eb5dc25687278fe8dff14e2a8c236bb0659

Download Submit
\Windows\SysWOW64\Njnokdaq.exe

Filesize
148KB

MD5
ecbec5e31389cb7031a8d6bdb5bcfe5c

SHA1
68e2b07cd6399c3321db8c2d47f3067e4466f65f

SHA256
b15a9ac1b0844944f1062665a0d568fbe90bd1d4bbc063f33b3945c8f03f862e

SHA512
d8a8da845a16adfaa7e58e8cba6fc521275115f3586ab8249243b01c4b96c4f436a44fe969e9662cfc44ddeb8c0ba9af4166b495a12c40df8d1b4672c199f565

Download Submit
\Windows\SysWOW64\Nlohmonb.exe

Filesize
148KB

MD5
d4e4d350e4a10560eda263419ab8174e

SHA1
82a0a424c70e7d7de3e39ac36f7408fefd304cdf

SHA256
103ff76835fe14d92cb588cb046a1288013e9402b3e3edefb2632e67bfe07020

SHA512
484ad9da42250d332872f2507310ba154191dcdb99350374a594354e1d45287bcee705cfcfdec528d99b99dac6b9fb78a31a2900d10c4be703e023027c1def5d

Download Submit
\Windows\SysWOW64\Nobndj32.exe

Filesize
148KB

MD5
7553129a4ec7a98df48b8529dd3bbd6e

SHA1
c54d6b2e27848d1eb86d20e2a759c8a711c7e73e

SHA256
e24d9b0f48f98e9ccfcdb46ddecdd2ccf3d23b3df277fdfee12bb53ca506857c

SHA512
55a59a42ec08b078e97ed0a76a79543e91f356d35d8298e2d8d8aa56b72d2011dc3bb16d745f7fe61f8d106cdf0890c5b02aacb592204b855362b01bb470ee2b

Download Submit
memory/668-170-0x00000000002B0000-0x0000000000300000-memory.dmp

Filesize
320KB

Download
memory/668-162-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/748-233-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/748-236-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/748-240-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/928-316-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/928-311-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/928-317-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1080-414-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1080-419-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1252-131-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download
memory/1252-123-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1508-83-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1508-91-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1544-258-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1544-262-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1544-252-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1572-273-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1572-263-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1572-272-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1596-507-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1596-519-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download
memory/1716-475-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1720-306-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1720-305-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/1720-296-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1724-518-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1724-229-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1724-218-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1724-225-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1812-283-0x0000000001BC0000-0x0000000001C10000-memory.dmp

Filesize
320KB

Download
memory/1812-278-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1812-284-0x0000000001BC0000-0x0000000001C10000-memory.dmp

Filesize
320KB

Download
memory/1920-27-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1920-40-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1968-474-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/1984-473-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/2084-295-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2084-285-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2084-291-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2208-642-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2208-109-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2216-493-0x00000000002E0000-0x0000000000330000-memory.dmp

Filesize
320KB

Download
memory/2280-485-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2296-328-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2296-324-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2296-322-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2348-399-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2348-404-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2348-392-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2404-148-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2520-382-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/2520-381-0x00000000002A0000-0x00000000002F0000-memory.dmp

Filesize
320KB

Download
memory/2520-372-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2532-241-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2532-251-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download
memory/2532-250-0x00000000001B0000-0x0000000000200000-memory.dmp

Filesize
320KB

Download
memory/2540-371-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2564-80-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/2564-81-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/2564-423-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/2664-63-0x00000000005E0000-0x0000000000630000-memory.dmp

Filesize
320KB

Download
memory/2692-42-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2692-51-0x0000000000450000-0x00000000004A0000-memory.dmp

Filesize
320KB

Download
memory/2692-403-0x0000000000450000-0x00000000004A0000-memory.dmp

Filesize
320KB

Download
memory/2692-55-0x0000000000450000-0x00000000004A0000-memory.dmp

Filesize
320KB

Download
memory/2720-121-0x0000000000450000-0x00000000004A0000-memory.dmp

Filesize
320KB

Download
memory/2724-362-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2724-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2724-12-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2724-11-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2724-361-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2740-351-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2740-360-0x0000000001B80000-0x0000000001BD0000-memory.dmp

Filesize
320KB

Download
memory/2772-504-0x00000000002E0000-0x0000000000330000-memory.dmp

Filesize
320KB

Download
memory/2772-506-0x00000000002E0000-0x0000000000330000-memory.dmp

Filesize
320KB

Download
memory/2788-445-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2892-350-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2892-349-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/2892-345-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2980-395-0x00000000005E0000-0x0000000000630000-memory.dmp

Filesize
320KB

Download
memory/2980-388-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2992-202-0x00000000003B0000-0x0000000000400000-memory.dmp

Filesize
320KB

Download
memory/2992-498-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2992-500-0x00000000003B0000-0x0000000000400000-memory.dmp

Filesize
320KB

Download
memory/2992-200-0x00000000003B0000-0x0000000000400000-memory.dmp

Filesize
320KB

Download
memory/2992-193-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2996-517-0x00000000002D0000-0x0000000000320000-memory.dmp

Filesize
320KB

Download
memory/2996-505-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2996-513-0x00000000002D0000-0x0000000000320000-memory.dmp

Filesize
320KB

Download
memory/2996-217-0x00000000002D0000-0x0000000000320000-memory.dmp

Filesize
320KB

Download
memory/2996-216-0x00000000002D0000-0x0000000000320000-memory.dmp

Filesize
320KB

Download
memory/2996-210-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3016-14-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3040-339-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/3040-338-0x0000000000220000-0x0000000000270000-memory.dmp

Filesize
320KB

Download
memory/3040-329-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3040-726-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads