berbew | 767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe
Size

96KB
MD5

4ff0af1853a06c36cd74a7a3b6d81490
SHA1

9cadf0650e612ffb00b102facc6d181cabc33a71
SHA256

767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4
SHA512

083ed8a62f0d2ae7cbe23dcb6bb9177dfe7cb78ef2329ef7c80b68ff5d5bddc85f5547c7425cf012f221d97b3b4610bcf0f3ab68e040b0919a71ddb85e27203b
SSDEEP

1536:1FxmAWJ0dQk1+aTwoi/CjgGkJ1alc0X4lv5F2Lv7RZObZUUWaegPYA:bBWJ0OyTRi/CjgGk2lXXa2vClUUWae

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opakbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kefkme32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
2584	Jimekgff.exe
4196	Jlkagbej.exe
4416	Jbeidl32.exe
348	Jioaqfcc.exe
1676	Jpijnqkp.exe
4636	Jbhfjljd.exe
1968	Jefbfgig.exe
436	Jmmjgejj.exe
3896	Jplfcpin.exe
2992	Jfeopj32.exe
3612	Jidklf32.exe
3152	Jlbgha32.exe
3712	Jblpek32.exe
368	Jifhaenk.exe
1592	Jlednamo.exe
1096	Kboljk32.exe
392	Kiidgeki.exe
1036	Klgqcqkl.exe
5092	Kbaipkbi.exe
4384	Kikame32.exe
4812	Klimip32.exe
4436	Kbceejpf.exe
3448	Kebbafoj.exe
1736	Klljnp32.exe
8	Kdcbom32.exe
4584	Kedoge32.exe
216	Klngdpdd.exe
2600	Kdeoemeg.exe
2608	Kefkme32.exe
3076	Klqcioba.exe
224	Kdgljmcd.exe
4164	Leihbeib.exe
2136	Lmppcbjd.exe
3180	Lpnlpnih.exe
1612	Lbmhlihl.exe
1240	Lfhdlh32.exe
3456	Ligqhc32.exe
4368	Llemdo32.exe
1556	Ldleel32.exe
3080	Lfkaag32.exe
4044	Liimncmf.exe
2112	Lmdina32.exe
4776	Lpcfkm32.exe
3936	Lbabgh32.exe
3460	Lepncd32.exe
960	Lmgfda32.exe
2092	Ldanqkki.exe
2520	Lbdolh32.exe
4140	Lebkhc32.exe
1464	Lmiciaaj.exe
756	Lllcen32.exe
3168	Mgagbf32.exe
1404	Mlopkm32.exe
4452	Mdehlk32.exe
4936	Megdccmb.exe
2716	Mplhql32.exe
1784	Mgfqmfde.exe
4716	Mmpijp32.exe
4360	Mcmabg32.exe
4236	Melnob32.exe
1632	Mlefklpj.exe
4264	Mgkjhe32.exe
1328	Npcoakfp.exe
4432	Nilcjp32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Leihbeib.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Amhpcomb.dll	Lmdina32.exe
File created	C:\Windows\SysWOW64\Lepncd32.exe	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Jbhfjljd.exe	Jpijnqkp.exe
File opened for modification	C:\Windows\SysWOW64\Lebkhc32.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Kgngca32.dll	Qjoankoi.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Alcidkmm.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Efhaoapj.dll	Llemdo32.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Klljnp32.exe	Kebbafoj.exe
File created	C:\Windows\SysWOW64\Bpdkcl32.dll	Klngdpdd.exe
File opened for modification	C:\Windows\SysWOW64\Mplhql32.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Kmcjho32.dll	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Fqplhmkl.dll	Jbhfjljd.exe
File opened for modification	C:\Windows\SysWOW64\Cdhhdlid.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Mhkngh32.dll	Klqcioba.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Hfligghk.dll	Njciko32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Cnicfe32.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Mnodjf32.dll	Odkjng32.exe
File created	C:\Windows\SysWOW64\Kboljk32.exe	Jlednamo.exe
File created	C:\Windows\SysWOW64\Kefkme32.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Benlnbhb.dll	Lfhdlh32.exe
File created	C:\Windows\SysWOW64\Jlingkpe.dll	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Nggjdc32.exe	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Jlednamo.exe	Jifhaenk.exe
File created	C:\Windows\SysWOW64\Mlopkm32.exe	Mgagbf32.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Bapiabak.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Qnhahj32.exe
File opened for modification	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dmamoe32.dll	Jefbfgig.exe
File created	C:\Windows\SysWOW64\Dmgabj32.dll	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Kebbafoj.exe	Kbceejpf.exe
File opened for modification	C:\Windows\SysWOW64\Kbaipkbi.exe	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Oendmdab.dll	Jlednamo.exe
File opened for modification	C:\Windows\SysWOW64\Kdeoemeg.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Olmeci32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6644	6424	WerFault.exe	268

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mdehlk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncfdie32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpijnqkp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdcbom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npcoakfp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdfkolkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Accfbokl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcfkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klgqcqkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbceejpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgagbf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlbgha32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jblpek32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jlednamo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbabgh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qceiaa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llemdo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qjoankoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiidgeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbmhlihl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdgljmcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Leihbeib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbdolh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njciko32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblpek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjpckf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaekf32.dll"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klimip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kikame32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dejacond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcbifaej.dll"	Jimekgff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eohipl32.dll"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Acqimo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfeopj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Llemdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmcjho32.dll"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghpcp32.dll"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogbipa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2584	3428	767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe	83
PID 3428 wrote to memory of 2584	3428	767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe	83
PID 3428 wrote to memory of 2584	3428	767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe	83
PID 2584 wrote to memory of 4196	2584	Jimekgff.exe	84
PID 2584 wrote to memory of 4196	2584	Jimekgff.exe	84
PID 2584 wrote to memory of 4196	2584	Jimekgff.exe	84
PID 4196 wrote to memory of 4416	4196	Jlkagbej.exe	85
PID 4196 wrote to memory of 4416	4196	Jlkagbej.exe	85
PID 4196 wrote to memory of 4416	4196	Jlkagbej.exe	85
PID 4416 wrote to memory of 348	4416	Jbeidl32.exe	86
PID 4416 wrote to memory of 348	4416	Jbeidl32.exe	86
PID 4416 wrote to memory of 348	4416	Jbeidl32.exe	86
PID 348 wrote to memory of 1676	348	Jioaqfcc.exe	87
PID 348 wrote to memory of 1676	348	Jioaqfcc.exe	87
PID 348 wrote to memory of 1676	348	Jioaqfcc.exe	87
PID 1676 wrote to memory of 4636	1676	Jpijnqkp.exe	88
PID 1676 wrote to memory of 4636	1676	Jpijnqkp.exe	88
PID 1676 wrote to memory of 4636	1676	Jpijnqkp.exe	88
PID 4636 wrote to memory of 1968	4636	Jbhfjljd.exe	89
PID 4636 wrote to memory of 1968	4636	Jbhfjljd.exe	89
PID 4636 wrote to memory of 1968	4636	Jbhfjljd.exe	89
PID 1968 wrote to memory of 436	1968	Jefbfgig.exe	91
PID 1968 wrote to memory of 436	1968	Jefbfgig.exe	91
PID 1968 wrote to memory of 436	1968	Jefbfgig.exe	91
PID 436 wrote to memory of 3896	436	Jmmjgejj.exe	92
PID 436 wrote to memory of 3896	436	Jmmjgejj.exe	92
PID 436 wrote to memory of 3896	436	Jmmjgejj.exe	92
PID 3896 wrote to memory of 2992	3896	Jplfcpin.exe	93
PID 3896 wrote to memory of 2992	3896	Jplfcpin.exe	93
PID 3896 wrote to memory of 2992	3896	Jplfcpin.exe	93
PID 2992 wrote to memory of 3612	2992	Jfeopj32.exe	94
PID 2992 wrote to memory of 3612	2992	Jfeopj32.exe	94
PID 2992 wrote to memory of 3612	2992	Jfeopj32.exe	94
PID 3612 wrote to memory of 3152	3612	Jidklf32.exe	95
PID 3612 wrote to memory of 3152	3612	Jidklf32.exe	95
PID 3612 wrote to memory of 3152	3612	Jidklf32.exe	95
PID 3152 wrote to memory of 3712	3152	Jlbgha32.exe	97
PID 3152 wrote to memory of 3712	3152	Jlbgha32.exe	97
PID 3152 wrote to memory of 3712	3152	Jlbgha32.exe	97
PID 3712 wrote to memory of 368	3712	Jblpek32.exe	98
PID 3712 wrote to memory of 368	3712	Jblpek32.exe	98
PID 3712 wrote to memory of 368	3712	Jblpek32.exe	98
PID 368 wrote to memory of 1592	368	Jifhaenk.exe	99
PID 368 wrote to memory of 1592	368	Jifhaenk.exe	99
PID 368 wrote to memory of 1592	368	Jifhaenk.exe	99
PID 1592 wrote to memory of 1096	1592	Jlednamo.exe	100
PID 1592 wrote to memory of 1096	1592	Jlednamo.exe	100
PID 1592 wrote to memory of 1096	1592	Jlednamo.exe	100
PID 1096 wrote to memory of 392	1096	Kboljk32.exe	101
PID 1096 wrote to memory of 392	1096	Kboljk32.exe	101
PID 1096 wrote to memory of 392	1096	Kboljk32.exe	101
PID 392 wrote to memory of 1036	392	Kiidgeki.exe	103
PID 392 wrote to memory of 1036	392	Kiidgeki.exe	103
PID 392 wrote to memory of 1036	392	Kiidgeki.exe	103
PID 1036 wrote to memory of 5092	1036	Klgqcqkl.exe	104
PID 1036 wrote to memory of 5092	1036	Klgqcqkl.exe	104
PID 1036 wrote to memory of 5092	1036	Klgqcqkl.exe	104
PID 5092 wrote to memory of 4384	5092	Kbaipkbi.exe	105
PID 5092 wrote to memory of 4384	5092	Kbaipkbi.exe	105
PID 5092 wrote to memory of 4384	5092	Kbaipkbi.exe	105
PID 4384 wrote to memory of 4812	4384	Kikame32.exe	106
PID 4384 wrote to memory of 4812	4384	Kikame32.exe	106
PID 4384 wrote to memory of 4812	4384	Kikame32.exe	106
PID 4812 wrote to memory of 4436	4812	Klimip32.exe	107

C:\Users\Admin\AppData\Local\Temp\767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe
"C:\Users\Admin\AppData\Local\Temp\767191cb537bf1b1fd9828afebf794bc6988f2be2798c176b51f38570e948af4N.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\Jimekgff.exe
  C:\Windows\system32\Jimekgff.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\Jlkagbej.exe
    C:\Windows\system32\Jlkagbej.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\Jbeidl32.exe
      C:\Windows\system32\Jbeidl32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4416
    - - C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:348
      - C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:368
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3448
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1736
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:216
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3076
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:224
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1240
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        40⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3080
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4044
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2112
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        44⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        46⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        47⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        48⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        50⤵
        Executes dropped EXE
        
        PID:4140
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        52⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1404
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        58⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        59⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        62⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4264
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        66⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2268
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        67⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        69⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1452
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        70⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        71⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        73⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1416
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        76⤵
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1844
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        78⤵
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        79⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        80⤵
        Modifies registry class
        
        PID:3200
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        81⤵
        Modifies registry class
        
        PID:3660
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:60
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        84⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        85⤵
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        86⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2576
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        87⤵
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        88⤵
        Modifies registry class
        
        PID:2236
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2072
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        92⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        93⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        94⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        95⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        96⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        97⤵
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        99⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        100⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        101⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        104⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        106⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        107⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5888
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        109⤵
        System Location Discovery: System Language Discovery
        
        PID:5932
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        110⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        111⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        115⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        120⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        124⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        125⤵
        Drops file in System32 directory
        
        PID:5880
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        128⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        130⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        132⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        133⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        134⤵
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        136⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        138⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        139⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        140⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        141⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        142⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        146⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5584
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        149⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        154⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        155⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        157⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        158⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        160⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        162⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        164⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        165⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        166⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        167⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        169⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        170⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        172⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6920
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        174⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        175⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        176⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        177⤵
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        179⤵
        Drops file in System32 directory
        
        PID:4708
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        181⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        182⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        184⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 220
        185⤵
        Program crash
        
        PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6424 -ip 6424
1⤵
PID:6544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
96KB

MD5
fcc1d9ad852042b81bffea05a1c3b0d9

SHA1
1e3bdaa78780c5088bf5b9b7aa7cbb5914e1b69a

SHA256
fabc4e605954d7d2e01676af79bda589cc97438803acf918234efbdb22963ebf

SHA512
a23e8fd6eb9e0f7f89f1611ea09dcd2e65f42f09ed311a750578f4ebf792f39540ee8ddb4464b98d451601999d5edaeaea6047d34fb12ae9b374682dd0e6635c

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
96KB

MD5
a89c176f1e63cacab291fd7c733cfffa

SHA1
6cd70aba43f7973daad28108969031e89eae44c3

SHA256
abea76fd4b1831d240b0fc1178869d33b143b321e5ec29bba1695bbe3dfe8e9b

SHA512
b33b88d078794dcb3b3769b222e6726dfba2d3345223d5c17965906953fb23de93d6c3f1fe9892488825e62942984497274b78f71c13eef47362e12a24b83a52

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
96KB

MD5
71a9f1cd2e830af0e4514f0e347b5d9e

SHA1
132e238c52bd0f258b5434c8cf96eba48526fe7b

SHA256
a8f9006ce56d7107b99e2ab0144d21ba879ccd11e846dfb8451fafe419b4b620

SHA512
71908fb2ec5a689143307fe7ef6497a40ca394d971b1080a3bc72430fe821d6e7f86894dd814c7838e0e49613cfa8abf7408d9dfe9ff48df7a5c88300add0a66

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
96KB

MD5
20d5a261b7d2b1f3ec5b9ec1cd64b232

SHA1
b3ca8293c282892241f3770fcf8bb51b66f25431

SHA256
42f0c08fd56f46f2147c3e013aa83d045db2488a757dc8256d8ad17224cec73a

SHA512
a8da45423dd66cde6e4f4fa69bb801f0617402fa8ebec497ad0e3c983e28a44f621a2ae966d03236378b7f5a2946e2a40e257a36d75bb3f401e169eab9d6d353

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
96KB

MD5
7c5cdc4a69f8aaaa0d00b2bf80d8dfd9

SHA1
875539e2b9630fae99fc78d4e44eec747329c7fc

SHA256
313bb495681cff131d2c6551ddee6e6dae3e09799521e78804b1c5d1312f0ff2

SHA512
e7ea39aa2b121914cf0abef72bfa33854ca53b8aa75939ad809ed7a6bb1c154b9b62881e5db0d9af1832dfa382efc4a6a0762190437df9f6bfbb8d95a5650263

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
96KB

MD5
cda8482c6f0958a08ffbc9f6b183f73a

SHA1
1e0881d206e0df73589df517aa2e715e9ef7d252

SHA256
f9b99344e4bd027ba65cb594813199b5697c29f0caf988369553750cf2dbc61b

SHA512
54082f85025ffd0a5b76d2d395d378510e51cb4e6618023d45e576d9f9f7d7eaed87f4b0d2e5ff04fa9510b741bf99082cecee0e27458db46cacf19f1579afac

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
96KB

MD5
0fe1317c35627f61c2f305cd8f3039c1

SHA1
f042e0283b1d727b60f667a0a1158332936574d2

SHA256
b85a5e229a5c881465fd20f1b7c362b1b5e22858d855eb8dda07e1855c26e0c3

SHA512
f8fe005a63e91a2a81368c92ab0b57a00ed85bfdd22f954b2d4eb3977c299e31bd59125fc0ccbd246911b0991b724284d81d9428c88a2a589cc54e692a470880

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
03bc1931546ca916962a8f3973083e7b

SHA1
8f5c278a95281a7655c78bffdc071791660ee350

SHA256
fc0f0a017feb14cd7ab146023faa3f172164eb80fa8aac57ff64abf9e0ecc7b7

SHA512
9ffe04f8df78bb32e239b187cf2936d4758b922a904b0568b12b95b37b783557769238f492daadaf0d2dd7aae9c46b281bb8722950070bba72514e50e1d4f2e3

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
96KB

MD5
8a8ff1103d0ebd2fe634d47eb2ad9ab3

SHA1
df93deeafa227b27a82b4b583a5c66925004e33b

SHA256
d5949e9415eb12daadb14d852bc6d5bf88d50ad75b136396e6697c17e40f0a34

SHA512
1d8b7674643c5f68bf9b411bfa3ace473c3e07eb90d7352ce5d9ee72916707aeeeb4cd32f889af6691bb5863863154549058d4ab55f3b7ad52030c43bd365be5

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
96KB

MD5
394b1b5613497f0bf0ebb613f1adefe0

SHA1
07161f8a24f64b836edac837656d903a2a7c35c0

SHA256
6ccb8ec105ec8c8526530a58f778198f033db6749be1de27ed59a6d449c419e3

SHA512
67d2da79d79d11e684d73fe35c8c667dcb0a9bcbc67054fa7944365de532fa9e7123f1923920f08f16f7e98c4baaf7bae10ef72f612ac123d1db804fe1bc0324

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
96KB

MD5
52172743b6d07fdcc49ed33df1b3c1f4

SHA1
24980c56ba1524640377f41682cc4c7272eb6e22

SHA256
8f79235221d0e3b7c12ac27e29fda075e87d070e1b6127f5593eddce9943942d

SHA512
c1ff6a1a8c6b45e5ea446eec6eb1142e88bd3cb072df957d5a7a6b05b4cc715ab49c3b879e069c48b1667b073cba574d8acef16b045f9c0b173346630d22e380

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
96KB

MD5
d3fb886e76f381089250bdff9ed5c3bd

SHA1
312f959aa3ef1a437956f50509013e89eb9e6a50

SHA256
524da834840b0dda90f30c9387b06cb09e4cb7403bab3c465cf581073fecb265

SHA512
f9afef170b40857192f847c6246fd8fc2d6ae797ac15ec299cb26bcc457854abf7a70b2e79c937bf8d410008a3274aa4c87a5c0a99801403106d92626d948a12

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
96KB

MD5
e3924bc4bad6d17054ffecff0226eb90

SHA1
141a01c8ab900eb4f70e9fb4281bb12fa3a9fdd5

SHA256
5046da897662e90aa52f4470ccd288ad2a1b434aff59c07e130da59468a5510f

SHA512
e37c00ae4f6304141ace6042e9756044328b0a203f385025fdb5197fdce2a891220021af991bb523407d4b1acbc0cbf9cef0c06b4d146ccfb9f832038a7459bc

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
96KB

MD5
cfe630bbe690f9f2be9d3fdc3fbfb241

SHA1
852eb27004dbd76e2dddd197806a0de9696bd7e5

SHA256
aa25f96babbac18d76713d94eafe5f3e1d2173efaf2edf8e1798789d71cb13ba

SHA512
41258a93656318be319e4ae49b3958aeb7cb801f3c1115ad7f83f498eef749b49af6e88978e52d6fc849dabf08786206adb32bcbcc27106fa5575b27b17fd8bd

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
96KB

MD5
1689d40bd34da4de7a62eaa3cc12908f

SHA1
6fa1ddcc21c102bb544d376ca96650d2deaa2a13

SHA256
fdf0a644df26fc626a82d2496b057fd60cfa2cd97882cf054acf7726dae68af7

SHA512
cb05690fa2a1fc0301e82bb49395920e8e3b26c1ad08d5c12120d553daa2bfe5518169f7fbb037648ed4b0f1da9c0d86449bc1b37209330d24a10dc273452225

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
96KB

MD5
f2e5ac4f60d1009eae8cf2019cbbcdaf

SHA1
e7017309070fd6cb1a71e355eb59b5b7d22e7e4e

SHA256
14d369af1668fe6a9cb25fd0b67644f0176c3fb84d122e392c4fd1e7cb625b95

SHA512
fd85a8c52c06b6fabc4b917f2bf8a15e9b47aa61e621b9d8134bb7bb1facf0c40e3c268f5bf3b6258e77139203b78fb77f931e1da14c0bbd175b0d7d640aae0d

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
96KB

MD5
5d74c05ba3a856734db66323b0941912

SHA1
44af230f0f6bafee9ec510a77ba45e246dd255a4

SHA256
4e3cda17ebefe83bb7e3712a4319dddb5cb583110144ea6f20636cb37f08f1c1

SHA512
f51d472adabc84b098b86dc8da95afc9f2921c74c274e4e5cdf0727dcdb377685e702ef6d193cfe580057b33e7a9d22c0ccd40759c5449bf849f144dba647eec

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
96KB

MD5
f50562b1226e5c6fa2125e1b779ca767

SHA1
c47a458c21f8f9a0e8b56e5cfd6e87bc7869f45f

SHA256
5d5763ca35cdea2aefe43f39dec7f392ef935ea81761482009e37a220f4b37d5

SHA512
791e932ad5936a509df3e13e4d609c1d4dc9f3165aac839bdd829a86c8d6bec5bd19228e61c35612b7b694053efe4791f0ac9b1d5be37981883ac95919b5e5ea

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
96KB

MD5
047f54b03270f48d290fcaa0eaf83902

SHA1
fcff3174f3f78170bcf300d1e0b2eb2dbed54962

SHA256
d05e65ac5caf257830baf5a42d52a5bd8c7a24002d8d6ebc930a70df268b73f4

SHA512
0636b3a4ab1fc7b5462e00ed2478a037c350914ee9cd83b48ab956c20145e17378db49e5a94ce5a6ccb0967a8b2084b06207b6a7c75431bbcb66b710d790a426

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
96KB

MD5
2eea599e55fa988b93c2b244b9efc397

SHA1
30fac0c749c0c8c2cdcecfe2f75de00882de5fd5

SHA256
3bd4641b1435a1ff11532f49fcab222f1507f1770e08356f6c4fa4fb2b75c7ee

SHA512
3fcc6c6183531cef94e11ad0293ca60564e349b0dbef861e34ed2b4a95130827a77ad93043c032d9ee4a64eeca57785c547bf015cbdc4b3433258ed148eb89d5

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
96KB

MD5
7535cbe53db3f1beb729ffaab2817d34

SHA1
f1b1c4b878d7a308a0ae86cf681945884c96ced6

SHA256
e29a990c75c71e857a51f400ae976239ce72dc7883b8990c8e329b60f413063c

SHA512
8956f0ebe4a0cf92d3777532b65471e8b5882cc8d74e024d194dfcaa460907334f181b4c2cff26df90e13dc82c2aa74b3a59ee62fd90bca9a02b5bed4706ea58

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
96KB

MD5
e5fb315ce1c6c1791fa6d4f626d522ff

SHA1
38b4ea96541d305d597f886961ecc8cbf548ff52

SHA256
b8d704c125a372d1c1898c3bc7281394ddf181e4e1c44cb3b2d67b5c9184012d

SHA512
7cadf1506f5a5f3ebcf5387abde0ff6a4a276d38987583f26b13fdfbbad6f0cc7db7470f382fb9a8d276a0f62f39ac9a11aace27b8227152eb6c580f98c275f0

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
96KB

MD5
9833bc917f3676dc2dfa46dc3ecd0fc5

SHA1
93afeaccc628f6c1fe9fa15f8b8b06e06461d7b0

SHA256
5e5800d53f59300cf9b921704abaf5287f48a9425a6a2f99ba69067b24c4d6d2

SHA512
95aee7758422054572b9181cd018024e9169ae1ab7f19e986e5c48e78565683143edc00cdca06f51bce99a2443f6c0da89cf15e7fba9cedbfe9b80e0fe03fe35

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
96KB

MD5
79d171a60c11b0df736bd8ac67610c25

SHA1
8cefdc580f1bebe0b7030725f3e779d0bdef04a2

SHA256
d7d470df6001d417d4e858ef8b9c8fc7d92550aaa53e146a57606599b73c2845

SHA512
7b2be9b99faced4e572bf40673de7c0a8ab9f4c54721812a9fe2f0123e08c459051b2384638a022e6c7e778c9137928be1940d575b5d5ee3a641e9b985dd0d09

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
96KB

MD5
aebc44807af35aba5a488f3d85461038

SHA1
ba7d41aa66fe325c21556dbc5750cd527e9d29b1

SHA256
e10a89fbdcdd1bad3828f08ef1ce1826b6de31b86238f8c5a5181f4aa8bf4520

SHA512
b16cecf3d42b611cf32d10642aee57566532f53730ab5f263e31565d8444479f808c32f72051875cda38a7c488ce71abd9b69a0a7169c34a15b8b5a82de0810a

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
96KB

MD5
c0b73ec25c472664cda2c49e452fb8ad

SHA1
e43ff3c8851242aa817f7eb375d91267dae00993

SHA256
10a2e154d050c260c2b8e0a4a148d62d68bb2e03466d8d11fb31f6ad78ff0cba

SHA512
0b2ba4c95c45da4fae9e0230baacf8a1a61eadde9b9c49c73b792f7b78dc706e8460b36ad0973dc24282f0f9469be3be8b860b42f6b68d70f64793b4b7e8f553

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
96KB

MD5
c892ee3f4cbad9f14fd18d0d98041759

SHA1
a08a3b350aa24e4b882d340fa7cbaed7c14187e8

SHA256
49b538a41f2e11051316410bdf8cc8d0fdc235e2e4089c23af377edc70cd7f2a

SHA512
96f25cff7125886bb5f23baa452ec6d1fdadc3065c70ac363050b74eef5da1610fd7b65044c7d2b366f01b997fbf4c7cc86bbfcb5719c95cb4a34b708ceff246

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
96KB

MD5
f556ccb502efdc5489e24bba5c1424c4

SHA1
8f5324d52a7534cead1c625b804d4267068801b7

SHA256
f8222e54a9dbca1b92436ace8c0473250017a43189b32b31a9052340015359ac

SHA512
26f0f697daaf2b7cca2ea99a154cfa5b6594b724866068abc49880231ad1013c2dc92dd222c7497db0c07d87e8195a94ffe524440c3e021dade971bb88800816

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
96KB

MD5
1238f1266b38cbde9055c56a841d16be

SHA1
c3cef59f3fd15761596a25e2d31ae3b15f6e4d95

SHA256
8f929aadbc12202579648f847d9f5aef5f805993e715ce22c49f03c61a389939

SHA512
6ee2db01caad328c4a8b131b114d2a11b811ca11deba56419d9b3be5ab0da16477af4e25838aecdab5d69c806f5f289ca8a4ded39573f144840d7542cc83a78d

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
96KB

MD5
423b5e5860991dbbd6201ea161ab0115

SHA1
34f50c0f66d47b1f327773439b59efbc1c183069

SHA256
ab9cc6872a44be00708b38a0a001fa1d32a556e99b60f9c6cb2aa00a0d933f3d

SHA512
241373e88bb86455c8918735ef0b43517f285c9473fbee693c1a042020e7798dfa460df05cd023424f13aca4d38ac49eb8989042d71979540e2fd9b871c9e5a5

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
96KB

MD5
6ebef435db7d7601971e5f75b9737eba

SHA1
f4bac13de6429a39d8411f1be74a72c18a36a420

SHA256
874dfd9e2de58758a3dcca1c8653d2152cb3fac0c9c330eaf141b94cb0411799

SHA512
29f96ab974a15f982973f7524083134bde8036d892ada67743032b2e75de1e0716ac1939a670af484893cb08465204657750c33f99001ce457a1b7ad0bf3b0d6

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
96KB

MD5
822e778dfc438182f75ba068d8f3f583

SHA1
071ed219dcfcdd36d7b8cdeee54d9d26a52d617f

SHA256
1a80b1ac28a3715e0eb1afcd71891ed752187d86b164ad626c6efac34afceede

SHA512
181cc89d8266aaf41ed5922475f62779b6f02368cb7883f91ef4617e58c3c2f7566b91383f05872d627552e9d038777096f81e244e1cf28435c55a8bdbbdb068

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
96KB

MD5
e7ae2f7bf0cb8fa0895631fb70cdb615

SHA1
33a68a16127f4cca43ddb2da6a4588fb4826f538

SHA256
1a24938abf01a22a6ad46a19f8bf036e3859f6497d4415bfb58ff035e86ae0ff

SHA512
a69c92a3ffe32b91525c33278acef26af5532b6a5ce50fd895cb6b7d6b5caa60562063cdba6a166be0268399c8df5ea3dedd26e2b3e9f4d044fef02cd9c3a76d

Download Submit
C:\Windows\SysWOW64\Kboljk32.exe

Filesize
96KB

MD5
63a9d47388a9491ca52a4754aec4e942

SHA1
b6c2b64fabad3b84396ac28dec9be73f13f3a6d7

SHA256
146cdb5dfdf5d69996ed508087d2706de65cb7ba123bf724e928dc1fbb6421b3

SHA512
f9c4d48076fc8b49b3f7b1608523b56872a05c7f7bb4ae4fc0b500b3d8a959d26ae1451eb21de4b9dfbf77924f2d81c578ab04ddd230584162bbe5436e3fd0e5

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
96KB

MD5
7d545dbc8d75d996f89004539b2568cc

SHA1
e2f103a2be499f26441d26ecb5d270a9eba06692

SHA256
a3c5283c6753530feed08601a934d20b21f2ef036b01eb0fdb3f9a50412bacb6

SHA512
31430346f463816e49b85c07978c4c5942ffcd426671fa19a6e545916f1a68a1bf8521836f9ecaf080b78fbf0d8b9bfc8aeefd24addcada811fc66d3da79a692

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
96KB

MD5
24383b0518dcf5e14264432940ee386e

SHA1
adfb9babc123d67a047fb15d6f110513f0364b4c

SHA256
3c7334dcc19e19ea6eba068da9c5d42053bee7e872b62340077d52e61277e2ff

SHA512
01701fa482b0ab26a4dec166b55e2a4aed44a43f4fe8df48547cc3ba27d06a49f2f99a3c9dda943ed2786ede8208c125d75ef4608fba56eeb46c84716c72a146

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
96KB

MD5
57644c0278275aaf8a729c5d0b9136b2

SHA1
7706ff19036eb461454d678454286c472d37bf72

SHA256
84e104aac0b05824b933b46a90459fd92631d4b34e17f0c28c07ba6a9d807723

SHA512
754fc326b28b047b94f862dd7336093ee0bf5f38e12c232da785d71d6d683c90ffd91781ed35f70a5e68f195828bea703a3b5271175cc062cc11881f105a4107

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
96KB

MD5
7e35874b1301114da3781ee161694007

SHA1
5fe231ea1dab12be7b2cf035c17da30a01577094

SHA256
488247918c80e6da0c1d4e7b830aa2e9e56bb46d9c2810df229ec3eb2a72be35

SHA512
7359346ff8515fe3a65b1d55d6aebad35110ed4bf7f0752b8bdda3f7ae3fa2eae79a176709a6cdbb15867e2edab9c58df1c9d1dce29d0500c715bfabc8c0e952

Download Submit
C:\Windows\SysWOW64\Kedoge32.exe

Filesize
96KB

MD5
78b454da627a9738cd3217af870dfc0b

SHA1
fe610b7d899d0a75225061e6f44a3a342609f89a

SHA256
32aa8723eb47005fa338154bca06fa81688bf35ea12130dedb08fd5e5538b72d

SHA512
98190c03d93ff02668900ce3618c10a3b2f5ae06ff78d8e4b3edc352688b7cc3bd09f7cf3deed2b48ba48f79657e25fdaff7d988f802b817cc25f6319cfa6537

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
96KB

MD5
c09dca1873066b302ceb74695a565c7e

SHA1
d8a9464833c6ac4c09d13d63affc4ea276c15baf

SHA256
54340b0b03315a9ba97f5eac9ef02d205103b37f00db5351eda7c4b456949c98

SHA512
102bd8d6acd574042101bc8b726f4f1ea9f24b429e4430310811a1abcbd53b4de51c634271af45ef38e50e7b229d759fb32b6b5828c6433f0d0ca37794586d14

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
96KB

MD5
28bb455bbbb762264bf76baad05a30bc

SHA1
3234f711941094ca5956c3ce9e88a827b3e6647b

SHA256
0543eb145470810eace1ca43e91fc3168c2e57cc6f94e484991f5b0dbd60e0dc

SHA512
9a73591aa762aba3f64f31638cf62d68e76a42b38a492d03e5e94994036c6d3b86c87e07fe07db594eeb057aa6dfab408810b1cc416164488ecac42e85f4e4d0

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
96KB

MD5
49b2a3af3aabb0f9c69385746c0bce5c

SHA1
fd48b79a020bd1f1385715c4d914a2810e83853c

SHA256
b6b9fa4b69d2dffe43aa7f977d83930a6300c04b36c62d7b863144a6778a5667

SHA512
9cd3fcf23e4221343dd08602bb78a6b0030f9584c6c5264b82d0c59c44cd885089ee821f91281594cd95b655ba557688638f82fe45aa984c913bee234e2a9cc9

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
96KB

MD5
33b8870ed6ab5bfedcbf46b7b873a34a

SHA1
4f997cc45c65eddabbee9fd5832d10fd20a7d63b

SHA256
7b24399123ccff0f063ea248081e734e303505848d44f420a7b19c98d584882e

SHA512
73831acf28c48d63c2a3756db3a4468aaf20a78940267603bf73c13390dc54a57c5ad6d42b5c1a85f00d0cd9b372f655027bc6af4639925a9e02bc8940824d37

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
96KB

MD5
657ebf76236affd1c0805cff7520f5de

SHA1
d4e06a7a47692aaa05522b0c9a2b2c4cbc177c5e

SHA256
48fecc586b6b8fd2be06f458dd5fa09f99b3cc217fe416c9e9fa4421e199691e

SHA512
1f60f636b0f825294403fb4a48017e13f6594fa745f4b0e4f9875d156f8ee87bc11c164356b1cae238c9b44d24ffc54c28c33f9d62668a41d23ba27bd95cf6b5

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
96KB

MD5
87352cd6343673f4db8b3ffa723374a8

SHA1
c7fa46e1d7c2398ba150ff0c2ca910e1b485c516

SHA256
12e940c84f258c84d2e12f8f17b8813054f68018f20bb799052dd3339bad6497

SHA512
371b854be39e70b9708ea239e6391a724d081b636b578452b0d3ede5e946e81bf566cf3a36c085fc4c90d98fbd5051bf52759e765cdf688ccaa74df52cf4a789

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
96KB

MD5
d25ea708a3105c94767277fba16690b9

SHA1
942b6b3243cea6cfc9a4648e05a53f1171cada6a

SHA256
21d2a8f9d6ef5638d90c7910d96df938180bbdcba00348b7912331bd36404976

SHA512
80a0ce901f20f196ee63db847f23c51b83c083345fdd185959c5276892f49cc17b7c97cd42984545d69a5d3ef13659dcf3ffe90c31c9a9b6912b37cef51d62ed

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
96KB

MD5
c2ab1fdb9e31f0a17c94f32ec6e606a1

SHA1
19881efc3142bd2d433b9d9cc031df3127bfbcf0

SHA256
102d61eba20d2f3de9161547b24d2f826a32abc84b5596c6d6f035a0a2c92664

SHA512
3fbf1fce3b4a4efd559026d39dfff6ef4bc8bcba65be6993a06bf07347a0313d4ae48d3e75e4eb6aff0d18f7e874f1d6b6155183eb310c00b02e028508a00825

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
96KB

MD5
bde11c3425ccdbf6d47f859d5c96cafe

SHA1
dffca0acbaef37d5610f875fab450d92ffb50254

SHA256
549baa705c691b417e9fd2bd9f7013abafd7deb7e045c2bddb1a44df1280dc3d

SHA512
81debe33903932c310124db746a73dc99d69d60f2c6bf351ae24339b519981cc8a73e69acc298e80d3c956cca87ba30e472a6265955e9c60028e9dd3ed54c896

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
96KB

MD5
6bb124f8a9ef25128cfa1c9b24387f91

SHA1
0f1aea5febff92d435d20087d6dbc2d1755886d9

SHA256
2e235858d4b8d172e72cce58ea85f8eea0edfc971db4f6d013936795d72a9010

SHA512
a1c09a63aae4cda5abc0fdb572896e7a2e4d10426f956310c2b5815fe9abbed48d5af955ce9def24a7df8f25624e013349ae43e297901896e5957745bfb068d5

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
96KB

MD5
a6e128a1166315c1032bff0893c869ec

SHA1
827465ee0e5bdba5a2cf4e3a3651c0ef3ae569ad

SHA256
cfdbe4011f96037737b46363d85071ec1a05c08bccb4acbfda14ef7bf59e5968

SHA512
b3236a2a4963b934d29f774e48fce977873e35fd05bb4c776ffd428a6a2a7ec5261978785f7bb622ac84a438204877f88872a05adb37741c24d25f7ab87e6730

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
96KB

MD5
feaaf9c83eb308df672fd363ee7fbac8

SHA1
5385af9db42bb9e2d56a70d8d3ba1ac5d266fc59

SHA256
2aa45133e2b076adda1eb9dd9a05c50818ca7846c1799d7334747a188abaa483

SHA512
fc52b189840a6e3e2ac8422a0a1056f75d02e42bc983394fee2dcba97c49f34476abcb534699e7663db65f1f0a4eb84c50f1817bf9a9444f101907bbd3e66a75

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
96KB

MD5
390c677c729a10516974d0a4bef2834c

SHA1
da9805bf8741776e6445ba5b8f00a2a05a174307

SHA256
e3ef1b81107f097185743489a826eaeab3b5cb056c7e2c3f6a486d5eb0b0a835

SHA512
f2735a382c31fb1058cbe80ce71cb4297e83093eb2b227146a4ea7ad76168886130955a062b98574ea02337a90dc46b6d570634677e2241e1c214172152a75a8

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
96KB

MD5
1305c7a8edcfe01dc07f566e8330db81

SHA1
0954bc9aacfe9259129ed6f4a9677689b015c44c

SHA256
77bb204e392119e1916172200385519b8a3a19a2bb8120d74b7616ed54d56ae0

SHA512
ab00bad008cbf14b41c68c4c18b5c63b4930c81d79641c54ec71543bd82901f5fc0d0f673ae17cd8fbf8490c38eb79701ac45aea42c4f9121a4d0b6f9ffd22ea

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
96KB

MD5
b7e309c02689cc5c6dda61ef858182fc

SHA1
5d33b8478d4e877aab80898bbf0e173692a96674

SHA256
3e0f7cacb3508ef7d575a43541527585a761f257a867f9b9fe53f8c7aeead983

SHA512
3bbc37ae8379e8fd974dc060385d267db425b30715651cb20060f547f34caeee8b7e8e3ff2c0b4f5fb69e8c38238a156c799b11816188866cc1667c74e06bd70

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
96KB

MD5
1416d1d726efa2ec92a45f99da1d968d

SHA1
f0cf7731ae679423ed3ed63ce183d56b0d414dce

SHA256
2ec210f368bbc620bdc7668a5f7a206690a06ade307daa525328deed93c60673

SHA512
c04cf92820f32a41cda4c439c8c54283fedb3a981bb32396b0d1149744111ddeff787b8ea294dda90b51a1b6f2f10e793fc8eab17e7e4dccfdcc4c39b4e9308f

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
96KB

MD5
59e49f6e177ee59d60b51a7b8a680415

SHA1
e818436535486865348619ef56119495d820316c

SHA256
de43fc6a65f66feb179c474fd03097e244bd9f1b818b769c8f7fab3df50575f6

SHA512
73e62e2df8793c726511c2793b6a87bf1606cffa40cc06e30811b2cf0b0952bf8a5650028cd046e2e3d043b5a5f40ba39d39618462d6b3235541e237b0fcdb38

Download Submit
C:\Windows\SysWOW64\Pfaigm32.exe

Filesize
96KB

MD5
3074a9c2ce4363c1863886cb4ef409e5

SHA1
d2c8d7d8daa65725d443e66f807b1a330631858b

SHA256
f84765691fee6c4b60ef81f9530fd7687f50e30ad135f8071dbe62ad8929bb39

SHA512
794b544fd4d8fbba63e885bc9eb4d8ad7edc84e6224ba0a5c842e0b28fd2cdc9d78c244de9653f851b74f66ac9bffe94118c155885f9405e1ee155da9fb40d53

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
96KB

MD5
64736b182382639985a965ecbacb87d5

SHA1
14307d25532760944ab3d372fcdd9d025bd7c7d9

SHA256
57a077c2ed7dda660bc1250edd47d723d345094d2a31e0b69fea4c68fc25a9f8

SHA512
30089d29153d8896beb7f3405254a1ba5966431b04cac256ef82f6de7ef90ff36ae759f79017dfd7f8523706be65a1909c35c52754168973cd222d2af1adac2f

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
96KB

MD5
48fbd6ed3bbc28863fb5f286bcc3235e

SHA1
457cbcf6262b35f82d85b892bcad661960c9f6cb

SHA256
9eb68fc36d298456f7ab83298135935b0ac85e2b445cd12e6bef3eb5fcc878e0

SHA512
bc172c27329fd92d77a52783b22d7c5f1cb263b987b87d693d47f40848c62452887d10e68ce010fd83171dab5ffc28ab4a37b93e5ecca35e1957f7da2d02b624

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
96KB

MD5
76c3fdf4bab6d0a45908c51414ee16ff

SHA1
3286dac5319e7d363516e82a26537d45245162ed

SHA256
a8030440209982cc0919eab4153c7959ad5e6a6675e35603093362b688e246f8

SHA512
2ba9ff8411e4eb89ee7eb85ee17308d63372a6fe5b16d4fe2023ea0c018922c998800f4a0c0e409ee85b19e4400c6acd5cd272743d7c93e720fe1ee061f658b7

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
96KB

MD5
929e286d64c2e9350c40ed07543d468f

SHA1
57cf87f3d76d248535b6048ba298863c00cdf21d

SHA256
de7c5b07eb5f344523785d2d0d0fccd9ac58a26e0729e1e9289ec0bbd22ce37e

SHA512
ec12606b8163d49b3aca3b3f11a5fc3134cc089edab284ff731bfcca1ce2eeb0fc31bf4460519aa8a3f69f7e8efb9d0dea6d2c3b760038ff5d1594c429a67cc1

Download Submit
C:\Windows\SysWOW64\Qffbbldm.exe

Filesize
96KB

MD5
932a692bb228eeb28b6cec214c13c5c7

SHA1
0fa43290530661c5516aa60ded240a5bade4561a

SHA256
e4ab2281d7a77bbd423a7c34181dd4579948eeec9ecaf049bd40bcb13033deec

SHA512
c58f4527b9da139c047627a83b180ff1eda0d0dbb740f11f6fd029dabddbefd18fa888c026254a4a229e1158088be8d781ec60fe098fa5d4cddbf1bc2114f79f

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
96KB

MD5
f004264bfa6aef5eebc8918dab750d94

SHA1
7bb45ed45fa29736a2a4ee8956e642e167a8fc2f

SHA256
8fd31f2832948b03c964f06d1df26e2f298569fae3b61958930305ebb4a74984

SHA512
c2b4f130f62357eb393cf9f7932097fdd1bcf66db3d7f9b8a410c1f4e7b5dac0bc20639c5d1275843cf702542773e6ac2dc6bead832c8c0a5fa78381087abf22

Download Submit
memory/8-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/60-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/224-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/348-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/348-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/368-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/960-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1240-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1328-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1404-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1452-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1464-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-548-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-575-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1736-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-516-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1896-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-589-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2092-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2124-528-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2136-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2444-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2520-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2576-576-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2584-547-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2600-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2608-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2716-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2992-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3080-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3200-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3428-534-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3448-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3604-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3612-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3660-541-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3712-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-569-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3896-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4044-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4208-480-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4264-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4368-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4452-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4480-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4716-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4732-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4812-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4968-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5092-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5124-1368-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6876-1284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7008-1279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads