berbew | 1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966

Analysis

max time kernel
93s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe
Size

337KB
MD5

9614421996da2b6778a3e33e7db1a80d
SHA1

0dccfb44e1fa87708b0b8dbc2fcfc5fe700978f7
SHA256

1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966
SHA512

1464221a4c69f475b3864686607c6863fa301da267311e87f58aa95709da123841fadf58e69b0bf89e186c8dc0e3274d72a9a3cf1b1178a289c44468a01f0d14
SSDEEP

3072:Ib48mmu7XuukIwpGisgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:4pr0+5Iw0is1+fIyG5jZkCwi8r

Score

10^/10

berbew njrat backdoor discovery persistence trojan

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aminee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnneknob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Medgncoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndaggimg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeniabfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceehho32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 64 IoCs

pid	Process
4392	Jmhale32.exe
3920	Jedeph32.exe
3300	Jmknaell.exe
3132	Jefbfgig.exe
2620	Jmpgldhg.exe
4140	Jblpek32.exe
4076	Jmbdbd32.exe
1684	Kfjhkjle.exe
1576	Kiidgeki.exe
3888	Klgqcqkl.exe
4876	Kbaipkbi.exe
1612	Kmfmmcbo.exe
3380	Kpeiioac.exe
756	Kdqejn32.exe
8	Kfoafi32.exe
3412	Kebbafoj.exe
4316	Kimnbd32.exe
4916	Kefkme32.exe
932	Kmncnb32.exe
3596	Klqcioba.exe
876	Lfkaag32.exe
3564	Liimncmf.exe
2180	Lmgfda32.exe
2036	Ldanqkki.exe
4680	Lgokmgjm.exe
2900	Lingibiq.exe
1172	Lphoelqn.exe
440	Mbfkbhpa.exe
4120	Medgncoe.exe
4492	Mmlpoqpg.exe
4948	Mlopkm32.exe
1028	Mpjlklok.exe
2928	Mdehlk32.exe
1516	Mgddhf32.exe
3584	Mibpda32.exe
5008	Mmnldp32.exe
5052	Mlampmdo.exe
3516	Mdhdajea.exe
1096	Mckemg32.exe
3648	Mgfqmfde.exe
3068	Miemjaci.exe
2128	Mmpijp32.exe
1632	Mpoefk32.exe
1812	Mdjagjco.exe
1756	Mgimcebb.exe
1692	Melnob32.exe
4160	Mmbfpp32.exe
2776	Mlefklpj.exe
2236	Mdmnlj32.exe
4952	Mcpnhfhf.exe
4704	Menjdbgj.exe
3764	Miifeq32.exe
4008	Mnebeogl.exe
3944	Npcoakfp.exe
1500	Ncbknfed.exe
264	Ngmgne32.exe
1944	Nngokoej.exe
448	Nljofl32.exe
4496	Ndaggimg.exe
2696	Ncdgcf32.exe
1852	Ngpccdlj.exe
2596	Njnpppkn.exe
4484	Nnjlpo32.exe
728	Nphhmj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Melnob32.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Pfhfan32.exe	Pcijeb32.exe
File opened for modification	C:\Windows\SysWOW64\Pgllfp32.exe	Pqbdjfln.exe
File opened for modification	C:\Windows\SysWOW64\Klqcioba.exe	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mlopkm32.exe
File created	C:\Windows\SysWOW64\Mdhdajea.exe	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Gcgnkd32.dll	Nnneknob.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Ocpgod32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File opened for modification	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Ncdgcf32.exe	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Ocgmpccl.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Caebma32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Chcddk32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kbaipkbi.exe
File created	C:\Windows\SysWOW64\Fpkknm32.dll	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Jmknaell.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Afhohlbj.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Kpeiioac.exe	Kmfmmcbo.exe
File created	C:\Windows\SysWOW64\Lingibiq.exe	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Pfjcgn32.exe	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Aglemn32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Jefbfgig.exe	Jmknaell.exe
File opened for modification	C:\Windows\SysWOW64\Ndfqbhia.exe	Ndcdmikd.exe
File opened for modification	C:\Windows\SysWOW64\Ofnckp32.exe	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Hiclgb32.dll	Odocigqg.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Cdlgno32.dll	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kfoafi32.exe
File opened for modification	C:\Windows\SysWOW64\Nnjlpo32.exe	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bcebhoii.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mcpnhfhf.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Ncdgcf32.exe
File created	C:\Windows\SysWOW64\Chmhoe32.dll	Ofnckp32.exe
File opened for modification	C:\Windows\SysWOW64\Qqijje32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Mcpnhfhf.exe	Mdmnlj32.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Onjegled.exe
File created	C:\Windows\SysWOW64\Hmcjlfqa.dll	Ampkof32.exe
File opened for modification	C:\Windows\SysWOW64\Mgfqmfde.exe	Mckemg32.exe
File opened for modification	C:\Windows\SysWOW64\Njnpppkn.exe	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Ebinhj32.dll	Mdehlk32.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Mgimcebb.exe	Mdjagjco.exe
File created	C:\Windows\SysWOW64\Nkenegog.dll	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Bqbodd32.dll	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Aqncedbp.exe	Ambgef32.exe
File opened for modification	C:\Windows\SysWOW64\Dhocqigp.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Lnhjmp32.dll	Jmbdbd32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7160	7036	WerFault.exe	254

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Medgncoe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opdghh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmbdbd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbaipkbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lfkaag32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liimncmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ldanqkki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olkhmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcijeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeniabfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpccdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kmncnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgimcebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Melnob32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqpgdfnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aminee32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caebma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgnilpah.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kefkme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miifeq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onjegled.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiidgeki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olfobjbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfjcgn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mgddhf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mckemg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndcdmikd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bhhdil32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmknaell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ndaggimg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jmhale32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdqejn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klqcioba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdifoehl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dopigd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lingibiq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpnhfhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nphhmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amddjegd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlampmdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pdpmpdbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgdeib.dll"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjccj32.dll"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maickled.dll"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlplhfon.dll"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbmgladp.dll"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjkmdp32.dll"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beeppfin.dll"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmhoe32.dll"	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpoddikd.dll"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgfqmfde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkoqfnpl.dll"	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogbipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmknaell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbljp32.dll"	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caebma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncbknfed.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4392	1388	1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe	83
PID 1388 wrote to memory of 4392	1388	1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe	83
PID 1388 wrote to memory of 4392	1388	1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe	83
PID 4392 wrote to memory of 3920	4392	Jmhale32.exe	84
PID 4392 wrote to memory of 3920	4392	Jmhale32.exe	84
PID 4392 wrote to memory of 3920	4392	Jmhale32.exe	84
PID 3920 wrote to memory of 3300	3920	Jedeph32.exe	86
PID 3920 wrote to memory of 3300	3920	Jedeph32.exe	86
PID 3920 wrote to memory of 3300	3920	Jedeph32.exe	86
PID 3300 wrote to memory of 3132	3300	Jmknaell.exe	87
PID 3300 wrote to memory of 3132	3300	Jmknaell.exe	87
PID 3300 wrote to memory of 3132	3300	Jmknaell.exe	87
PID 3132 wrote to memory of 2620	3132	Jefbfgig.exe	90
PID 3132 wrote to memory of 2620	3132	Jefbfgig.exe	90
PID 3132 wrote to memory of 2620	3132	Jefbfgig.exe	90
PID 2620 wrote to memory of 4140	2620	Jmpgldhg.exe	91
PID 2620 wrote to memory of 4140	2620	Jmpgldhg.exe	91
PID 2620 wrote to memory of 4140	2620	Jmpgldhg.exe	91
PID 4140 wrote to memory of 4076	4140	Jblpek32.exe	92
PID 4140 wrote to memory of 4076	4140	Jblpek32.exe	92
PID 4140 wrote to memory of 4076	4140	Jblpek32.exe	92
PID 4076 wrote to memory of 1684	4076	Jmbdbd32.exe	93
PID 4076 wrote to memory of 1684	4076	Jmbdbd32.exe	93
PID 4076 wrote to memory of 1684	4076	Jmbdbd32.exe	93
PID 1684 wrote to memory of 1576	1684	Kfjhkjle.exe	94
PID 1684 wrote to memory of 1576	1684	Kfjhkjle.exe	94
PID 1684 wrote to memory of 1576	1684	Kfjhkjle.exe	94
PID 1576 wrote to memory of 3888	1576	Kiidgeki.exe	95
PID 1576 wrote to memory of 3888	1576	Kiidgeki.exe	95
PID 1576 wrote to memory of 3888	1576	Kiidgeki.exe	95
PID 3888 wrote to memory of 4876	3888	Klgqcqkl.exe	96
PID 3888 wrote to memory of 4876	3888	Klgqcqkl.exe	96
PID 3888 wrote to memory of 4876	3888	Klgqcqkl.exe	96
PID 4876 wrote to memory of 1612	4876	Kbaipkbi.exe	97
PID 4876 wrote to memory of 1612	4876	Kbaipkbi.exe	97
PID 4876 wrote to memory of 1612	4876	Kbaipkbi.exe	97
PID 1612 wrote to memory of 3380	1612	Kmfmmcbo.exe	98
PID 1612 wrote to memory of 3380	1612	Kmfmmcbo.exe	98
PID 1612 wrote to memory of 3380	1612	Kmfmmcbo.exe	98
PID 3380 wrote to memory of 756	3380	Kpeiioac.exe	99
PID 3380 wrote to memory of 756	3380	Kpeiioac.exe	99
PID 3380 wrote to memory of 756	3380	Kpeiioac.exe	99
PID 756 wrote to memory of 8	756	Kdqejn32.exe	100
PID 756 wrote to memory of 8	756	Kdqejn32.exe	100
PID 756 wrote to memory of 8	756	Kdqejn32.exe	100
PID 8 wrote to memory of 3412	8	Kfoafi32.exe	101
PID 8 wrote to memory of 3412	8	Kfoafi32.exe	101
PID 8 wrote to memory of 3412	8	Kfoafi32.exe	101
PID 3412 wrote to memory of 4316	3412	Kebbafoj.exe	102
PID 3412 wrote to memory of 4316	3412	Kebbafoj.exe	102
PID 3412 wrote to memory of 4316	3412	Kebbafoj.exe	102
PID 4316 wrote to memory of 4916	4316	Kimnbd32.exe	103
PID 4316 wrote to memory of 4916	4316	Kimnbd32.exe	103
PID 4316 wrote to memory of 4916	4316	Kimnbd32.exe	103
PID 4916 wrote to memory of 932	4916	Kefkme32.exe	104
PID 4916 wrote to memory of 932	4916	Kefkme32.exe	104
PID 4916 wrote to memory of 932	4916	Kefkme32.exe	104
PID 932 wrote to memory of 3596	932	Kmncnb32.exe	105
PID 932 wrote to memory of 3596	932	Kmncnb32.exe	105
PID 932 wrote to memory of 3596	932	Kmncnb32.exe	105
PID 3596 wrote to memory of 876	3596	Klqcioba.exe	106
PID 3596 wrote to memory of 876	3596	Klqcioba.exe	106
PID 3596 wrote to memory of 876	3596	Klqcioba.exe	106
PID 876 wrote to memory of 3564	876	Lfkaag32.exe	107

C:\Users\Admin\AppData\Local\Temp\1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe
"C:\Users\Admin\AppData\Local\Temp\1d44c0856e1ab028ff6ef546a5b6e30af30cdf7a7e3c73d2d0b2da2baa86d966.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\Jmhale32.exe
  C:\Windows\system32\Jmhale32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\Jedeph32.exe
    C:\Windows\system32\Jedeph32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Windows\SysWOW64\Jmknaell.exe
      C:\Windows\system32\Jmknaell.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
      - C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1576
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3564
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        24⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2900
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        28⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        29⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        31⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1028
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2928
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1096
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3648
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        42⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        44⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1812
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1692
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2776
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        55⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1500
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:264
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        59⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:448
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2696
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1852
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:728
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        67⤵
        Drops file in System32 directory
        
        PID:3976
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        68⤵
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3336
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        70⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        71⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:3000
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1396
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        75⤵
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:696
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2552
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3692
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2468
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4384
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2452
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        87⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1772
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        89⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        90⤵
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        92⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1580
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        93⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:4488
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        96⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        100⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        101⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        103⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        106⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        107⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5692
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        109⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        110⤵
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5960
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        115⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        116⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        117⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        121⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        123⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        124⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        125⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        128⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        129⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        131⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        132⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        133⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        136⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        137⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        142⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        143⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        149⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        150⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        151⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        152⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6548
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        156⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        157⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        160⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        161⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        162⤵
        System Location Discovery: System Language Discovery
        
        PID:6856
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        163⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        164⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        166⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 404
        167⤵
        Program crash
        
        PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7036 -ip 7036
1⤵
PID:7100

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:7036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
337KB

MD5
824ce0d0c131d4835e0fecb3141e2789

SHA1
e0a8db5031364ae0d339e759a319f57981d8e13b

SHA256
cd0dcea7e872de1bb4efc2f4bca9263c1c3e3462c47fa365f304fc2311f57e1d

SHA512
1829470f80ea6507a76025f0e987167db273ccf25feb0d4e5a6b5220ba7a0745a3c5b40c24b74769e7dabc93600cf64db88780657bbe47882d652055fdf1ac8c

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
337KB

MD5
48aba1e959660b75df31eb6f5c8eaeac

SHA1
dbcadb9b605dee3294b51d165b5ee61f71af102d

SHA256
053293fa2cd0a0d248de69d998437f347699770aca6e7e1b43b43eacca835b44

SHA512
a7670cff80738dfeb77a30812ab34aa595f1170a09a6f77a276d22fb1a577bc1f6078114d1c933bc40c3b4932df3ee0d8d58f74f11e8f927299e036ebba30a22

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
337KB

MD5
63d7ffc9250279485c6b90746df1f010

SHA1
dcd96c00dd1b84f612c474fe5335f5cc0e9a5348

SHA256
f63f90ded9e2688f7a4bec2d5839b021660f0d5d94c8bc5b9a28eea02d46dd51

SHA512
66f7e82cad7dab704edb37e0663889ee77c6b5a8cf2ab4c467108acaa7fea8fdab177fa9e0118681e5654e12905ec41369822f18b106ec2ec8c50ff66fbebe67

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
337KB

MD5
b1b6fb03abe333db9a9c9839b41e983a

SHA1
89e521408ef49f86c2239140b34d13b2186e8a4a

SHA256
1686e0f8b4b28937306f923a1e93407563b133aecef03d06a60913b3cc18e372

SHA512
7cb2b4770c63f9a779e37fb6b2692eff5c780adbf3d2a9af808914271db10bdc099cf253029d4af2950adc9be900f492580452e43d8e3b59407e17c4e4ac4ac5

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
337KB

MD5
adc886de2fd46b62d414fb4c8dbf497b

SHA1
af14f759a80ef1c9c7db931ca41fcdca045d13de

SHA256
69eba89ed70a51529bd54c1d0c50d42de3fc68f4e3eca7236a34a3242ed155d3

SHA512
f19e28975d26dc61206751157bd5e35ca67d9fd4a31f3c3e5150d26249904db8b73baac9a93f3a3dde9961fbd6fde82a60b0196cdb7018a1c72e9f5c233f718a

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
337KB

MD5
95c1e3a4d57d78c48bd7c49db7c465d8

SHA1
6b43a570f1498cee788d281be3e072bf12f705d9

SHA256
227d05c2bb717dac8e3d367c64eac51bd30ad4d0000fb623c1894e13a106c946

SHA512
57891deadd471106d5d238c81711a92792938ee9b53c068d58e8601d52fa685047cfd0e953f23b7bf39a3076bfc756606b26dc78022b342808195be6f3db15f8

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
337KB

MD5
3ef96d1f4017c9418746d9bb0589b899

SHA1
89235d1498a97a74d07f7a03165ce1390753bd4b

SHA256
9cf5c97b508e976c222e488d59dfc5db0c87ca788754a4a8140f14a702c4b69d

SHA512
3cd5bea8ca266d350a3dfbc361c1267d1e14bab5b37bf07ee2a161905fe9a89ccc10b221504568c9a10437289bdbe3b001215aa01e59051991b25bc1ef8ddca7

Download Submit
C:\Windows\SysWOW64\Jedeph32.exe

Filesize
337KB

MD5
c8b67aa794a85207e0d01ad123910021

SHA1
8339cc5ee149acac627cc6b2226970c33397f5e5

SHA256
acd9b407fbade66ad8e24d2cdb338dc58bb479ad085e963fce40fefa4008f4bd

SHA512
a00b4a1cbd4a241c25a97e0fc13c88a0c67b97c0d0f515e3a2426e624187b7c012652d1c87fdc7a07e3781543ece449ba4df997425786c3a2abc877989d41023

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
337KB

MD5
13d68b41ad6b83937a2ee113e4616ab9

SHA1
8b531ecbbd45ac4e9b1b5b9dc70e71d540275fb4

SHA256
7cc36fa7658a6755be209aac72fbe837a0f2cc7d22d1959b6aa28a6c6f39031b

SHA512
b4a56800693b953579889b9eb8c5026c9fe00e1c8f8ac1736a243c1fc27c0a6caf6ae4fff4d8e539395f85ec925f0422292e8355401aff6eef452091a4b66cc2

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
337KB

MD5
2a761ad30d4267d003f4dcb0db69e325

SHA1
25376865ddcedc4859a6e4396acea1a198dbd214

SHA256
16552df59f863a690c8c3e94ee130db678de7d49aed2c1fbabfb12b944a92931

SHA512
ab544dfb5e5a35da5e8fdbf7d4dc8c1d160b083000ddac8a64e3455bfdd72ca0effb481856fb186c1732546bfe803f42900a3ec8716ad67c13454c5cb14968e2

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
337KB

MD5
081fecd6a8f3a56eab55ce7e6cd95a6d

SHA1
7f432bb23a30d5f143822bb510f551474e3704d7

SHA256
87df79f8817c500eeac3f8acbe51cbdd00f51756160eb242666924483ec26ad5

SHA512
46671f3f146b8f0911915b56b4ad87bdaaf6183c57733023408b7b66d50cf83b2a290333b5a7979ce9214db67ebde3ce7529263ad21899b96732605f761074be

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
337KB

MD5
a0b2a6bea882019487b670707ca65b1f

SHA1
a1e7cf328c18bfc3409297606351bd8f270bba33

SHA256
05ce63afab2e4ea2931dad8d49784e12cb32b5d5f99ae5cdcd11f68c8bad0459

SHA512
052eff134ca78dd5370326fda1d31f9501a6ed6cf27e3451cfd1e767ad35765fa480a8ebd6608dc682b61295d052596e72b4ae8b4661792b3b5d9b79a04efa7e

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
337KB

MD5
ebbc62dd72145f2da6ce8cd54251fd01

SHA1
b5753348d54bb833a47f2c01ce663dcde65591df

SHA256
69505d8a1e626bf56fe1099908e580a80540f06388dd0451030e486ab54f4d3a

SHA512
360a9cc5ff4d7b1a1a473883acee46e78fb4fd304b51c4ed27e62297258155571f2d5f301acb6377ed111f636f5730004fd72ea034b41745795c6049b194fed3

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
337KB

MD5
ddf94b0a5ca4431b45628a765327884b

SHA1
661fc2b45733cec56c9807649bed8a4c087b23ee

SHA256
1274911815321edbba102e4b828bf889539adc382a75c22adfe9bdc871a816f9

SHA512
0deb32cf82898f0e47fad59cad6e99530e7325b630831a3346f732ed873b237ef42b6a16924a8a749e82aa01ca6fef8d26b8595b0aea135cb8ed74b7058552eb

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
337KB

MD5
40052f37026439b3db980e1d750bec0b

SHA1
9a0588533285de14260db2fba0002c4134826dc7

SHA256
3d56fe37c7aa0f93ac52b857a9d49e5f63e57415b2b955e099f88382b0193e79

SHA512
2dc8ff125b2cce395ecf654c921684412a03cbcbcd851a25fe19e71042c2fc1e84f01ffcf0fdef21755cc29ce33333fc23b5966214a4ae9481988f2063b20dc4

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
337KB

MD5
35318c069635ad7742548a31f10c8f34

SHA1
b758c8369dfbee3c01f01b4b9c0dd3781001f031

SHA256
0e6e4bd47ce31c3351a7e2f016391d484cd4e36fb2ad24c30be65195285f7424

SHA512
dff144d648f68be9cc5e9ba9de5cbb340fc6ebce45fd425facd1db2bb5f46d7f03499465b149d71216f85dd51c96b9b5d25d805a62559b519b39e5824e504c6b

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
337KB

MD5
8eff38b6af4c7233e6f68bab1104c2df

SHA1
2db29f58c51587c6aa39b89b0f50cdb3ca9e3496

SHA256
6d9dca0fa28bbd804693e41d5cda1588433762a10ef78bae6959b4ba9ffb6976

SHA512
a8fe238afb24d2d71b0bb5aadd2890ea1cf302d5cabf48279d9671643832f0bc68f778d33b25de6baaa6fca4c03011ff4fa212e233c8c465235ebcee1be390ce

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
337KB

MD5
e73eb746e0abe3a0203f288e376a07c6

SHA1
7aa8d0f52fa3130743c08c14753adea6a8f581d3

SHA256
20fcbc317b2a2b0147c8dd9140e2f4fd9307ef8bf7573825bc573934049fca0f

SHA512
586186cc0181d1712b6ea41f6109751ec4b05ee5e73647891971b8744cfe252ca32a5210d128bed3b934b28eb11225523659aec13cebefbf6ce0ccfcb41c988e

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
337KB

MD5
4061af86b38e026cd42f12885693b152

SHA1
a305561674a9d5235141e08fc139b1f60221da19

SHA256
80519edca34b99658f001b64d073907dfd901ccd9f23b7220ef2f028c3cd3605

SHA512
81ae9c328c3f7fcde8f9a9ca7537110d30264d1ad36cefd39ed30b6ba61a3f878ee8306c8aed42c645a56468795ac0acf2283b33dd0db03b07a6734d6b0a87ee

Download Submit
C:\Windows\SysWOW64\Kiidgeki.exe

Filesize
337KB

MD5
736f77448d309654eaf0630fdc6642fa

SHA1
500491cdfbbe531d647b90ec2e5dfd4c93a185e9

SHA256
1e5fe90f9cb3f3e1fd92d1ef410ba523f089668426b6449a5951c0d40b0b1eb2

SHA512
8644bbb0e33dd5daa7eaeff0bdb6a48482096179d01310c5e78a7ec9a88319f62fe6e7502ea0599d206e6ddf92d8f8df7e9b2d857bd3c80680d0804f11b2d205

Download Submit
C:\Windows\SysWOW64\Kimnbd32.exe

Filesize
337KB

MD5
6481182121b7361584940bfe7bc4c640

SHA1
bda41859067e8503d5b7281b6ee7812f569f067f

SHA256
1798b7817dce1eb8012dd7ff36759e961f00688ecd8626fa120709b847e121a8

SHA512
3abe592aa3a8661196ae8c0da66ff68e627925987ef77c459c473d24d89fabd9f3bac3154340b17f9ad86e49b15804c602b660468f121998357c3709cb502798

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
337KB

MD5
0e0e5793fa3a9cfaeec8ce3b56ab509d

SHA1
f99280a4b67d9632b47a315e4e337a5b1d68321f

SHA256
54260dcb2a91049e20c278a9cd19f4a706aa03c397b2a5730ccafcb2b09a040a

SHA512
a084f752bbaf2e323eae6c1e7676abc5fc8a2482810f4cddcf3f6b8dbbcbbc64597a51642cccfe40df87e04ed166168a17ef57c6d8b59158d60c66b9591f2ce1

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
337KB

MD5
044e6020bd87e5e0feb7c49468641c3f

SHA1
1aeb61481b45a496ef337b6ebc874b3bdf9f39c8

SHA256
aa39ea568cc90a048d76e9e60f6ceeebf650738f999db5e290fe2ab189e80e37

SHA512
e656e8dc035a42400c5a1ae29b69e51ccd431457a0e45f1a89658d9c2af591deb52c92882383f065aa94d680ff62f63d189b67a471d92644577b1c1d48f33c09

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
337KB

MD5
da0cd5c2d602ad3ffa92d2c2f6a01aef

SHA1
43d298b258e014d03cc2ff39dcb20f18584af334

SHA256
a6c0cc2aad8f7fbc20af5d00dacbec4d5a9c68b0f90cfd779a8108b9321e02c6

SHA512
0bd1e2ab8a8f01772e328cffb62b80f46e364fa56bb1752174857dd81b107adac5ea17ac55f831940cca79384b63d389420f59466429ffd6eff9796ed79e8616

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
337KB

MD5
de05a707c6ea0f1f659bcd46fc97001f

SHA1
33e7bba507643d6eed9e524b698d84319e522e12

SHA256
f67f124188706ac4ce1e97535fbc7f45693105bd2ea5541bb7d023b44985fe35

SHA512
5bddd5e81b16cf22a104252c8cd2fad5c064284d309684354e6283bf004a2034f6c50e672c76b5f198fb358c06b361560755a0fc19975f5d1e991efca6629078

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
337KB

MD5
09f087a6412f5359b2c2c4890ac828d2

SHA1
4c6a6d763433f234ac3e97f06e54bc3e13935cf4

SHA256
2c0757abfd4147de4bff8fa2cb614e74936988f80898b23b0544bf2b9a26ed70

SHA512
8a11a3369bb235c9484e1076e8eda6a06eb1a8377361512de44f94be5233a3e79f2ab65f287ee9568638adb22d4c3e8744298e92305f09e6619909fd95591764

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
337KB

MD5
bfde9c2be42c3118d67056df4afa795a

SHA1
cab9bc71a5f1d2ffdd0d071facd193a36c2236b8

SHA256
61e43137f22cc6b40e31f6f07c2f3cbb31d74e66c46ecfb20274ef392f509682

SHA512
4565601e19e376b53215619e76850af6acccbcbdece87e57ea6837bf4b284eee2b21b43a0302befa178e2776fef00cdcf9bdd53f0fc0435ddc300b26c901c1d1

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
337KB

MD5
9ba26ce4e7d38240b248bc5e3ce8e9b3

SHA1
74dd01202f15d25b08e404f37558499fbff53a05

SHA256
fa462bfefd62d912961e4ced40dab5d9bbf0454362826f590e080f3a0eb08887

SHA512
50e54cc84bc4c66790982ca63918ec8a9c27a0f4f2c1234caa2e625ca615ec7d44418a1df0fb718616ac474c5152ff305a919aa3a89fa5dee43ce4af28b296be

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
337KB

MD5
a149007d5837daf5af0486939e7d823f

SHA1
5e9b2395ade85b2d7b17b0939586dcd8ed560e27

SHA256
95336ca2677be4bb5881de971e17d4691cf6a6568fabea280d2be05ab852314e

SHA512
9d1020ab9a3eac9852e8bf6a716dca13e68e10d79e60bd83479439b079bd28ac8bc2aa2eaac3bee39c2e73d0bc3274ee9c6f5e2efdcf30115ff19574669bdd8a

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
337KB

MD5
8618daa31ea32d95bbe2cfe85cafac02

SHA1
b3df78d4dafede2108afc02924aed1f501826aa2

SHA256
9e1562303f26fdeba5d11f0ace3ac2a345b2fbaa6034babd0cf5b9e36a6f75bb

SHA512
8224819c3567a37e225aa9d1bf99f06fd5ca2d90ecc431e05a43ad4ef706111c89b8ec932e843b96b58456253b5c288a802425ab51293acd279ffa1a7e5aa6a3

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
337KB

MD5
2c557986b96ddf7deec8fdd0bd6ef2c0

SHA1
16349471aa9cd94890dae1bca7542460ecfba20b

SHA256
6bc372e6f86676bb8c2f59fe2c8ddf614a2474b56506634563171f88bd61cac7

SHA512
6a8c5910f06460a06636fb5d584601e3367399bd666d7353159241ff0aebf13714c8ea25252fce0fbda39b6c4168bb549c5ce2ac6e09235f8df6a0a7e9fc73e7

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
337KB

MD5
efce3b1e8cc50660abd5c1f5535dd48d

SHA1
213a37d7a444c77e83ba1e898482dc0f315fcedd

SHA256
610f0d72b729b531d5a6eb5f155558de3ef1096f2aafb5c0a946b64f3aec9011

SHA512
121d94acbded0a9079df6851dee2d89021311d3b51a892e39d6656bd2d824d0c8580905383325dd1e024e4e1623eb36c145c369ffc8bcfc3aa49ed1b33740c35

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
337KB

MD5
ef1a1d4c4736e54c06fa81d20f022ea0

SHA1
b14f33a4ccd189c71b1d0560dd4b02728d877abe

SHA256
662fa76321f618155dcb9f90df56981745c2cddf923ebfdb76f54821e8068da0

SHA512
0639fd5906f29c09b90d0b619aaa19ba22a72abb2698c646b00acd837ebc96914f0dc932ffac7eeea194854dcaac59b8f35b1fed16be999482f285c5c37ce1d1

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
337KB

MD5
025deab6f619d57e22ed1cc332c4f5c6

SHA1
c805dbafbdd13a4fcc53f259c6519fcc466db8ad

SHA256
21efd2de72c6cbf2b703b12c984c2d1e4719a4b29b3ed9e2db191dad5b76118e

SHA512
8beeed0d0a3b1de57cf36f83444aa6a7f19c8162f077151b41032db1c63c896e0a5916c22696407bcdc3c4f055a8df76ab525a2b79d9f650dd549343f09bb118

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
337KB

MD5
544cd6915e65f808918ce5aa36252aaa

SHA1
e9ef62a45f19285c3c0b07392068d98724b6311f

SHA256
664efbfe8d4f409e30580f8cc069876e06758cd285d573ff424adfbcf6d2d0cb

SHA512
bad7a55ab1ce4a4fa0a6d4351871364876d587f431cd5e7fb4a2df0a1bd92494be0cb4dc7cb5d4c4c57c9efaddc1590d966f8267a85c60fd7b3b70e210b59d9a

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
337KB

MD5
340f40bb7d8edb0599485c78436704a5

SHA1
0b8e48bd4dbd76572bacc835d71e95ff9438b217

SHA256
73d8c7a2d8b5ab761ff212964734de13d395ac09876eca27698a8d1cc676d268

SHA512
0dc74591a33fa0454ae115bbb2788e61cf1b36719bb39acf4ffd4257b154455afbfcac57b14a23fd8c7ce6a038c0e2c605a0f2ac2fdfe5a13c20ec24831e6729

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
337KB

MD5
620803fbcb132b89c7c86a3e955f2171

SHA1
df9d166a77089793ecd0d5f382095586486c8d45

SHA256
a735ee48498a65142e74c6a6260a661d37a3a14951702a5f4828917222fbe25b

SHA512
b7b0cb1585f99f0afbeb45549a5d2f302f10f409bec82ea4b559e64901a22cfa97d90e86c1df3a736022aa4070d3e2bca26d2a89abbcb16d81c5334a299954d9

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
337KB

MD5
dcbb348a7e3b98ede868fbbf0552fbbd

SHA1
e44c6822e710f3fc7772993b3ed69c26edbdfd3e

SHA256
d6df7ac6f8f608158bbb8f4c181d26259e2551de4d5f18ab8e0267ef244793f3

SHA512
4e88e197d97da774cac84dd363d6290066de2f8a9c7e11dabad758a246bfe915502fc6ceece41964a9f8a830e6ac2e341ae900786269a7d446bb2751bcc28657

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
337KB

MD5
7fcb06f6682fa0b4f20a500223a803c4

SHA1
ee5b5554e68014c1b4cf569a45febd4ba53a491d

SHA256
47f9283f0cdd4b8877b78f9f7fba27c1a11ea051e099d40e34abeb9fc2bc8925

SHA512
ce118a5fd7fac52e1b194aaa9d93a176d61134b214e681c510567e961c70c05f6d384d270cf5bac486df3fb1615c9e54690a031522181996d155f5468c995a2a

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
337KB

MD5
bff6d01b9123fed9b524496621ae8127

SHA1
a76f096225f89cd823d9276424b080437d90113a

SHA256
f14ddf96cfe7d93d77612a8344339df701128d1b1e13f28ed8cd5aedfc0afc6c

SHA512
dbe020a76816e33f3e3e4b362245bbde4629bedb711788d81940cc903fb832d05f04614918a7148e0d00d66a35585f5fb565e3de5e10d27f3ce960e83e7fe4ec

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
337KB

MD5
44ba797054e70308e7aa839cc9e7461f

SHA1
c439087d0d9990ace49519b9518dadc198c4da3b

SHA256
02fcb7917d74a548f8de09b6ff95b0dd2740a128253ccba733e59b1695f8896f

SHA512
7280a14fedb223dc8bd571fc90aa6b451a3cfaccd1fb029405c34f4bf6644c6d4a924f4508b5e5b84ff33dabb676235362dff452747284c505a7f320d7e5afe3

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
337KB

MD5
57b1e2718ec31ab23788c18d0f68e7e4

SHA1
bf8193ca7e27e258fe41cb620c6a19a7d36572b7

SHA256
64dd7486286f920529b3bc8c8b013e66df78d61ef27cd78f27926bbcf94280ee

SHA512
eb1f8f3a0243fae04d7ddb42e279530efd90609a683d5ebdcee2b2236677ee58e8042b261c69b0206b952922045318d6bef34efa9ab9d6fc06eb1d847e66d866

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
337KB

MD5
3cb0f8aecbceff3e2383783b088476cb

SHA1
8602f1ae08014901b95dd4ecd69eb25cbfd498cf

SHA256
085844b546e621deb288f731b80acb815da470ca4fb1cdbc48186e6c4852ace1

SHA512
2c5ee2f5448c6316f9b587e1808fde943ef018dc596d913232a829119ef676bfb73c63984a144334961c510172bc9f41764356e4e207b308274bd82447f212fa

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
337KB

MD5
9456c67cdb9fd7b6dcd10754fa8d0e63

SHA1
d5f77ed6840372bd2190fce67a5134eaca039924

SHA256
f6ee54683f02215bf33c77f469c8230bbebf8e9638ffbe7920e913bde19ccb77

SHA512
3064356eb98ecdee990271446720e88ce05103e9e4927f83a74a2e14ef2310ad12f664c6f5d25a4e8686d8a92e54e5885553397bef4fda2108cd5e5b291d2ab1

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
64KB

MD5
54843a7e935049891d179f0762dd1a88

SHA1
d5ad1f2f10829e1fa338923677ffefb9562e530c

SHA256
bfba8b6432997c48a25844bdc5f56af494c50e8acd303a59c9dc0dc5dcb11439

SHA512
af4344ddbe80084b28bbeffde369d136714b83b1af24396b50b748016078d6eeef3367146290b8c7cfa999955521a4ea6db2086fab9b43944fe5ec22c92d9db6

Download Submit
memory/8-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/264-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/440-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/696-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-118-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/932-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1028-261-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1096-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1172-222-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1388-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1388-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1396-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1496-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1576-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1612-101-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1728-588-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1812-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1944-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2128-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2180-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2236-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2456-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2620-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2776-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2900-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2928-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-473-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3564-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3584-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3596-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3648-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3764-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3868-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3888-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3920-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3976-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4076-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4076-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4140-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4160-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4260-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4336-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4376-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4384-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4496-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4876-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4916-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5008-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-291-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5232-1157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5336-1156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5564-1173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5600-1210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5820-1166-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6768-1108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads