3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe
Size

385KB
MD5

7c5fcfaf0fd5410c83779e34f9540ea4
SHA1

6007fdd61e381cda61ab51531938860e7d0d104a
SHA256

3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7
SHA512

6ca3454a707efcce748860d5eaba3abdaa091a014ed7e16c8e81b00cd4176207c558708cd922eb239354135ba1142df62a3a6301f3d8551089bde934a2067883
SSDEEP

12288:ciMY+y59SLWy5jy59SL3y59Ey59SLAy59SLZy5iy59SL1:cTy7oWypy7o3y7Ey7oAy7oZyUy7o1

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Bcoenmao.exeCeqnmpfo.exeCeckcp32.exeDmgbnq32.exeDogogcpo.exeDeagdn32.exeAeklkchg.exeAgjhgngj.exeBanllbdn.exeChcddk32.exeDfknkg32.exeDjgjlelk.exeBjmnoi32.exeBapiabak.exeCmgjgcgo.exeDhfajjoj.exeDjdmffnn.exeQgqeappe.exeBfhhoi32.exeBgcknmop.exeChmndlge.exeCnicfe32.exeCagobalc.exeChagok32.exeBganhm32.exeBmemac32.exeCenahpha.exeCegdnopg.exeAeiofcji.exeCnkplejl.exeBnkgeg32.exeDdonekbl.exeQqfmde32.exeAepefb32.exeDeokon32.exeAgoabn32.exeBjfaeh32.exeCnnlaehj.exeDfpgffpm.exeBalpgb32.exeBclhhnca.exeDdakjkqi.exeDelnin32.exeCmiflbel.exeCfbkeh32.exeCajlhqjp.exeDmcibama.exeDanecp32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddonekbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe

Executes dropped EXE 64 IoCs

Processes:

Qqfmde32.exeQgqeappe.exeAqkgpedc.exeAeiofcji.exeAeklkchg.exeAgjhgngj.exeAcqimo32.exeAfoeiklb.exeAnfmjhmd.exeAepefb32.exeAgoabn32.exeBjmnoi32.exeBmkjkd32.exeBebblb32.exeBganhm32.exeBnkgeg32.exeBaicac32.exeBgcknmop.exeBnmcjg32.exeBalpgb32.exeBcjlcn32.exeBfhhoi32.exeBnpppgdj.exeBanllbdn.exeBclhhnca.exeBfkedibe.exeBjfaeh32.exeBmemac32.exeBapiabak.exeBcoenmao.exeCfmajipb.exeCjinkg32.exeCmgjgcgo.exeCenahpha.exeChmndlge.exeCjkjpgfi.exeCmiflbel.exeCeqnmpfo.exeCdcoim32.exeCfbkeh32.exeCnicfe32.exeCagobalc.exeCeckcp32.exeChagok32.exeCjpckf32.exeCnkplejl.exeCajlhqjp.exeCeehho32.exeChcddk32.exeCffdpghg.exeCnnlaehj.exeCmqmma32.exeCegdnopg.exeDhfajjoj.exeDjdmffnn.exeDmcibama.exeDanecp32.exeDdmaok32.exeDfknkg32.exeDjgjlelk.exeDmefhako.exeDelnin32.exeDdonekbl.exeDfnjafap.exe

pid	process
3948	Qqfmde32.exe
3712	Qgqeappe.exe
400	Aqkgpedc.exe
4296	Aeiofcji.exe
4384	Aeklkchg.exe
4668	Agjhgngj.exe
1248	Acqimo32.exe
2580	Afoeiklb.exe
2848	Anfmjhmd.exe
2944	Aepefb32.exe
3180	Agoabn32.exe
3244	Bjmnoi32.exe
1400	Bmkjkd32.exe
2752	Bebblb32.exe
4792	Bganhm32.exe
2096	Bnkgeg32.exe
3368	Baicac32.exe
4704	Bgcknmop.exe
2116	Bnmcjg32.exe
316	Balpgb32.exe
2528	Bcjlcn32.exe
3448	Bfhhoi32.exe
1564	Bnpppgdj.exe
3256	Banllbdn.exe
1068	Bclhhnca.exe
544	Bfkedibe.exe
5060	Bjfaeh32.exe
1444	Bmemac32.exe
652	Bapiabak.exe
1360	Bcoenmao.exe
1216	Cfmajipb.exe
1560	Cjinkg32.exe
3696	Cmgjgcgo.exe
4484	Cenahpha.exe
2168	Chmndlge.exe
1640	Cjkjpgfi.exe
4896	Cmiflbel.exe
2540	Ceqnmpfo.exe
232	Cdcoim32.exe
3140	Cfbkeh32.exe
1948	Cnicfe32.exe
3504	Cagobalc.exe
3076	Ceckcp32.exe
2620	Chagok32.exe
2344	Cjpckf32.exe
4712	Cnkplejl.exe
4632	Cajlhqjp.exe
2952	Ceehho32.exe
1072	Chcddk32.exe
4844	Cffdpghg.exe
2128	Cnnlaehj.exe
4440	Cmqmma32.exe
2524	Cegdnopg.exe
1036	Dhfajjoj.exe
380	Djdmffnn.exe
2936	Dmcibama.exe
2272	Danecp32.exe
3704	Ddmaok32.exe
4812	Dfknkg32.exe
2852	Djgjlelk.exe
3088	Dmefhako.exe
4760	Delnin32.exe
3600	Ddonekbl.exe
2316	Dfnjafap.exe

Drops file in System32 directory 64 IoCs

Processes:

Banllbdn.exeCjkjpgfi.exeAqkgpedc.exeCmiflbel.exeCdcoim32.exeCajlhqjp.exeCeehho32.exeDmgbnq32.exeChagok32.exeDfknkg32.exeDdakjkqi.exeDeagdn32.exeCeckcp32.exeChcddk32.exe3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exeAeiofcji.exeAcqimo32.exeBnmcjg32.exeCfmajipb.exeCnicfe32.exeBfkedibe.exeCegdnopg.exeDjgjlelk.exeAgoabn32.exeBebblb32.exeDanecp32.exeDgbdlf32.exeCmgjgcgo.exeBmkjkd32.exeDfpgffpm.exeBjmnoi32.exeBnpppgdj.exeBjfaeh32.exeDjdmffnn.exeQgqeappe.exeAfoeiklb.exeBaicac32.exeBmemac32.exeCeqnmpfo.exeCffdpghg.exeDhfajjoj.exeBnkgeg32.exeBfhhoi32.exeChmndlge.exeCagobalc.exeDogogcpo.exeAepefb32.exeBapiabak.exeBcoenmao.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Feibedlp.dll	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Deokon32.exe	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Ddakjkqi.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe
File created	C:\Windows\SysWOW64\Aeklkchg.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Afoeiklb.exe	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bnmcjg32.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Dhfajjoj.exe	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Gidbim32.dll	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Bganhm32.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Bjfaeh32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Acqimo32.exe
File opened for modification	C:\Windows\SysWOW64\Bmkjkd32.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Ehfnmfki.dll	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Ljbncc32.dll	Afoeiklb.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Baicac32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Nedmmlba.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Omocan32.dll	Chmndlge.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Cffdpghg.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Aeiofcji.exe	Aqkgpedc.exe
File opened for modification	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process

2916 4700 WerFault.exe

pid	pid_target	process
2916	4700	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Cjpckf32.exeDeokon32.exeDdakjkqi.exeDeagdn32.exeAeklkchg.exeAgoabn32.exeBganhm32.exeChcddk32.exeCegdnopg.exeDgbdlf32.exeDhfajjoj.exeDmcibama.exeDfnjafap.exeCfmajipb.exeCmgjgcgo.exeCeqnmpfo.exeDjgjlelk.exeAqkgpedc.exeAfoeiklb.exeBcoenmao.exeBmkjkd32.exeBnkgeg32.exeBapiabak.exeDelnin32.exeDogogcpo.exeAnfmjhmd.exeBjmnoi32.exeBaicac32.exeCnnlaehj.exeDmefhako.exeDmgbnq32.exeBgcknmop.exeCajlhqjp.exeCffdpghg.exeDkifae32.exeBjfaeh32.exeChmndlge.exeChagok32.exeDfpgffpm.exeBnpppgdj.exeBmemac32.exeCfbkeh32.exe3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exeQgqeappe.exeCnicfe32.exeBebblb32.exeBclhhnca.exeBcjlcn32.exeBfkedibe.exeCjinkg32.exeCenahpha.exeCeckcp32.exeAeiofcji.exeAgjhgngj.exeBalpgb32.exeDmllipeg.exeDdonekbl.exeCmqmma32.exeDjdmffnn.exeDfknkg32.exeBnmcjg32.exeCdcoim32.exeCagobalc.exeCjkjpgfi.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjpckf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeklkchg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agoabn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhfajjoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmgjgcgo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djgjlelk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afoeiklb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcoenmao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmkjkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anfmjhmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baicac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmgbnq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgcknmop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cajlhqjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjfaeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chmndlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceckcp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aeiofcji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdcoim32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjkjpgfi.exe

Modifies registry class 64 IoCs

Processes:

Cnicfe32.exeCnkplejl.exeCmqmma32.exeDeagdn32.exeAeiofcji.exeBebblb32.exeBgcknmop.exeDeokon32.exeDmcibama.exeDkifae32.exeCmgjgcgo.exeBnkgeg32.exeBmemac32.exeDogogcpo.exeCmiflbel.exeDanecp32.exeDfpgffpm.exeAnfmjhmd.exeDdonekbl.exeBclhhnca.exeDmefhako.exeBfhhoi32.exeCffdpghg.exeChcddk32.exeAgjhgngj.exeDgbdlf32.exeQgqeappe.exeBnpppgdj.exeDhfajjoj.exeCeehho32.exeDjgjlelk.exeDmgbnq32.exeQqfmde32.exeCjkjpgfi.exeCjpckf32.exeAgoabn32.exeBjfaeh32.exeBapiabak.exeDelnin32.exeCeqnmpfo.exeCdcoim32.exeDfnjafap.exeBjmnoi32.exeBalpgb32.exeCeckcp32.exeAeklkchg.exeCajlhqjp.exeAfoeiklb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghpklj.dll"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Deokon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bneljh32.dll"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Poahbe32.dll"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgqeappe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjkjpgfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjngmo32.dll"	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dchfiejc.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdheac32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffcnippo.dll"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekpanpa.dll"	Cajlhqjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exeQqfmde32.exeQgqeappe.exeAqkgpedc.exeAeiofcji.exeAeklkchg.exeAgjhgngj.exeAcqimo32.exeAfoeiklb.exeAnfmjhmd.exeAepefb32.exeAgoabn32.exeBjmnoi32.exeBmkjkd32.exeBebblb32.exeBganhm32.exeBnkgeg32.exeBaicac32.exeBgcknmop.exeBnmcjg32.exeBalpgb32.exeBcjlcn32.exe

description	pid	process	target process
PID 2360 wrote to memory of 3948	2360	3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe	Qqfmde32.exe
PID 2360 wrote to memory of 3948	2360	3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe	Qqfmde32.exe
PID 2360 wrote to memory of 3948	2360	3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe	Qqfmde32.exe
PID 3948 wrote to memory of 3712	3948	Qqfmde32.exe	Qgqeappe.exe
PID 3948 wrote to memory of 3712	3948	Qqfmde32.exe	Qgqeappe.exe
PID 3948 wrote to memory of 3712	3948	Qqfmde32.exe	Qgqeappe.exe
PID 3712 wrote to memory of 400	3712	Qgqeappe.exe	Aqkgpedc.exe
PID 3712 wrote to memory of 400	3712	Qgqeappe.exe	Aqkgpedc.exe
PID 3712 wrote to memory of 400	3712	Qgqeappe.exe	Aqkgpedc.exe
PID 400 wrote to memory of 4296	400	Aqkgpedc.exe	Aeiofcji.exe
PID 400 wrote to memory of 4296	400	Aqkgpedc.exe	Aeiofcji.exe
PID 400 wrote to memory of 4296	400	Aqkgpedc.exe	Aeiofcji.exe
PID 4296 wrote to memory of 4384	4296	Aeiofcji.exe	Aeklkchg.exe
PID 4296 wrote to memory of 4384	4296	Aeiofcji.exe	Aeklkchg.exe
PID 4296 wrote to memory of 4384	4296	Aeiofcji.exe	Aeklkchg.exe
PID 4384 wrote to memory of 4668	4384	Aeklkchg.exe	Agjhgngj.exe
PID 4384 wrote to memory of 4668	4384	Aeklkchg.exe	Agjhgngj.exe
PID 4384 wrote to memory of 4668	4384	Aeklkchg.exe	Agjhgngj.exe
PID 4668 wrote to memory of 1248	4668	Agjhgngj.exe	Acqimo32.exe
PID 4668 wrote to memory of 1248	4668	Agjhgngj.exe	Acqimo32.exe
PID 4668 wrote to memory of 1248	4668	Agjhgngj.exe	Acqimo32.exe
PID 1248 wrote to memory of 2580	1248	Acqimo32.exe	Afoeiklb.exe
PID 1248 wrote to memory of 2580	1248	Acqimo32.exe	Afoeiklb.exe
PID 1248 wrote to memory of 2580	1248	Acqimo32.exe	Afoeiklb.exe
PID 2580 wrote to memory of 2848	2580	Afoeiklb.exe	Anfmjhmd.exe
PID 2580 wrote to memory of 2848	2580	Afoeiklb.exe	Anfmjhmd.exe
PID 2580 wrote to memory of 2848	2580	Afoeiklb.exe	Anfmjhmd.exe
PID 2848 wrote to memory of 2944	2848	Anfmjhmd.exe	Aepefb32.exe
PID 2848 wrote to memory of 2944	2848	Anfmjhmd.exe	Aepefb32.exe
PID 2848 wrote to memory of 2944	2848	Anfmjhmd.exe	Aepefb32.exe
PID 2944 wrote to memory of 3180	2944	Aepefb32.exe	Agoabn32.exe
PID 2944 wrote to memory of 3180	2944	Aepefb32.exe	Agoabn32.exe
PID 2944 wrote to memory of 3180	2944	Aepefb32.exe	Agoabn32.exe
PID 3180 wrote to memory of 3244	3180	Agoabn32.exe	Bjmnoi32.exe
PID 3180 wrote to memory of 3244	3180	Agoabn32.exe	Bjmnoi32.exe
PID 3180 wrote to memory of 3244	3180	Agoabn32.exe	Bjmnoi32.exe
PID 3244 wrote to memory of 1400	3244	Bjmnoi32.exe	Bmkjkd32.exe
PID 3244 wrote to memory of 1400	3244	Bjmnoi32.exe	Bmkjkd32.exe
PID 3244 wrote to memory of 1400	3244	Bjmnoi32.exe	Bmkjkd32.exe
PID 1400 wrote to memory of 2752	1400	Bmkjkd32.exe	Bebblb32.exe
PID 1400 wrote to memory of 2752	1400	Bmkjkd32.exe	Bebblb32.exe
PID 1400 wrote to memory of 2752	1400	Bmkjkd32.exe	Bebblb32.exe
PID 2752 wrote to memory of 4792	2752	Bebblb32.exe	Bganhm32.exe
PID 2752 wrote to memory of 4792	2752	Bebblb32.exe	Bganhm32.exe
PID 2752 wrote to memory of 4792	2752	Bebblb32.exe	Bganhm32.exe
PID 4792 wrote to memory of 2096	4792	Bganhm32.exe	Bnkgeg32.exe
PID 4792 wrote to memory of 2096	4792	Bganhm32.exe	Bnkgeg32.exe
PID 4792 wrote to memory of 2096	4792	Bganhm32.exe	Bnkgeg32.exe
PID 2096 wrote to memory of 3368	2096	Bnkgeg32.exe	Baicac32.exe
PID 2096 wrote to memory of 3368	2096	Bnkgeg32.exe	Baicac32.exe
PID 2096 wrote to memory of 3368	2096	Bnkgeg32.exe	Baicac32.exe
PID 3368 wrote to memory of 4704	3368	Baicac32.exe	Bgcknmop.exe
PID 3368 wrote to memory of 4704	3368	Baicac32.exe	Bgcknmop.exe
PID 3368 wrote to memory of 4704	3368	Baicac32.exe	Bgcknmop.exe
PID 4704 wrote to memory of 2116	4704	Bgcknmop.exe	Bnmcjg32.exe
PID 4704 wrote to memory of 2116	4704	Bgcknmop.exe	Bnmcjg32.exe
PID 4704 wrote to memory of 2116	4704	Bgcknmop.exe	Bnmcjg32.exe
PID 2116 wrote to memory of 316	2116	Bnmcjg32.exe	Balpgb32.exe
PID 2116 wrote to memory of 316	2116	Bnmcjg32.exe	Balpgb32.exe
PID 2116 wrote to memory of 316	2116	Bnmcjg32.exe	Balpgb32.exe
PID 316 wrote to memory of 2528	316	Balpgb32.exe	Bcjlcn32.exe
PID 316 wrote to memory of 2528	316	Balpgb32.exe	Bcjlcn32.exe
PID 316 wrote to memory of 2528	316	Balpgb32.exe	Bcjlcn32.exe
PID 2528 wrote to memory of 3448	2528	Bcjlcn32.exe	Bfhhoi32.exe

C:\Users\Admin\AppData\Local\Temp\3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe
"C:\Users\Admin\AppData\Local\Temp\3a1fdd0476ea792b3d9a858d5b2ff758d75195953e836bcaab5fec66e159b3e7.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\Qqfmde32.exe
  C:\Windows\system32\Qqfmde32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\Qgqeappe.exe
    C:\Windows\system32\Qgqeappe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\SysWOW64\Aqkgpedc.exe
      C:\Windows\system32\Aqkgpedc.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3448
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:544
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5060
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:652
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1360
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        33⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2168
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2540
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3140
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1948
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3504
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2620
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2952
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:380
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        59⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4812
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3088
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        66⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 396
        75⤵
        Program crash
        
        PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4700 -ip 4700
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
385KB

MD5
55b7ed1a950810e3bbfa4a631475b070

SHA1
7be37c70dc3cf94f2857351068b36cc47765a49e

SHA256
30ce4c78b7769c9faf5aa9c8dcfa48893d170e910c440af0f17b084c163a8980

SHA512
5c73c72c061ca00c5ba8802b8dc915b6b9fc32a73a0e08fa51226a24d955d7da0b8f87e61fc9a516eb7fc302a2b8abb02c73c3af645e746fc7e8b2a6bc79e646

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
385KB

MD5
46c118d36f8939038d5910fa34a4b142

SHA1
260f0e2e8afc1af5c3692c78e5154ee02dbc6189

SHA256
d0a1fa6c647327d18387d9b73326858112ef23e3fdb26d9069aaf70514d9c33b

SHA512
78c0950694f66461b3005979edfc3cac49f904f0dcff5d4e53b21c5961556d938bb3c965300fa0d58c7995783d0ab254326a65238705927907c697997879fd5d

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
385KB

MD5
0f48a8dabc0cec5179cc2fc15159cb24

SHA1
c4dcdaad81bd2db8bb33e68dc84f282ff9da8598

SHA256
391e054a88219a34712403776b1a7f880a947cec5f67128a0743521450beb61e

SHA512
83f6618fce803b6442fe110116acb19197939bc7f515c240f1bbd57c80fbe9fed34899f2282769aaffbe2ad50332c4d312fa4799633eaeb272acd41ec5bffb18

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
385KB

MD5
04d16e6c9b2cc3801f8a1c0f23ffdf6d

SHA1
e7953a9e3f7b7db5cae73ee8ed771024f8a37d1b

SHA256
508f4b8718c3e6f505869de49ede3bcd95e1e40d2dd75be3b9227b52f3ef4f9c

SHA512
881c38ab14ab437b2e428986e86c9687644a2ef509118c9ea5bada83d193bbd1a24eab47b624c5bd034e7f9075151855997b0dacf021c016526282a5433f4d3f

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
385KB

MD5
f61e73f943f0f41987e5f3589c9e2491

SHA1
77431ad6540afe405a92f88ae61bdf2236f84f8c

SHA256
6bdd7e83b9a59b7f0ab837e37546dcdf128aa7a68ca96b79a39fd702623b8cbc

SHA512
616d650a7baf1c452f4e0eacf51827aea82d7a6247e5c969e55eb807219b0a8848979196bd109360c9b06f79605ebc67339dc894fb79013892e04e844ea65e37

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
385KB

MD5
9074ea81895893d2e4a820584d0e86c5

SHA1
71c43c47492b386ea9feaec33208f3e8698c7815

SHA256
257f8c3581d155ad3588bf1a4b7513b32a737da008b433d6deef163bd17fcabf

SHA512
fb7e8bce7887da029fddff9df06592081386f627eb2758af91e74b822a01d0fa7b49d72b84759a7db38b97419f48723c5caabfb4d8818c7757c72f1163e4b3c0

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
385KB

MD5
670bc211c6c19d0adcea7257e58b846e

SHA1
58d3e3c5b67053128d92ac06c3b4d6e84ba5cd92

SHA256
9f3b35a8b1bba40770eb193da21c031b75b9b641d0ac307365a40af1859b1fff

SHA512
20166173e80f72543e6faf8d48fe143b8f311cfa7aae08a77c8eccd6d3f351d3880c62d0368f7e743636c3a8e8a89fc55d915dd1e87a12ba5c4fc0f21a2ca5c1

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
385KB

MD5
3a3d159999590265863bb4ed4ed200a8

SHA1
5870b41db164b9d81769537250975e69e175ad88

SHA256
0a6862ee5338cc8d74f2018bed9147c7cc42dc3ec9ddf6c79206ec8ea291a2cb

SHA512
751218e0b95a918118a0b3846ae990c14cbdfdeaf9b9ef3f28c9daee46b75ad0135f82f3c1219c036304abec809a82aab817acb8e7234da10ac786ab35ad479a

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
385KB

MD5
439facde4646c08a0353ed2b5a23a465

SHA1
f410ce9c450bc7f8c6a088ca81f2d1c4cdf9a4c2

SHA256
c36022804b7651b0e33a55f59a7e55eef33b8564d973cafeb8330a53a3b9864b

SHA512
be21a32e4afc884051d6ac0cd82a6ba3d1b501d45e1ed1def5d6efd144154330ab0ab33b7273964033e0bea5e6e2d2347b847ef54d42262591409b65d83befcd

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
385KB

MD5
512a8fc39c3d09ebf84a56e0c8f0ebf0

SHA1
d1044e84cc863c52eb215aff4736c3cc18ba93c3

SHA256
458f192c1112ddedf0288d282cfa27800a240dc4ad4e5efb8a2cd19640be4728

SHA512
1ecb24702aed5e75adae2f8d97f5869ae1ec7139c7c6c584634c9f52d942989ee9bd0fa2cf1220cca99fa7e117e07c8bfcd11e4d1c31a6bb22fd85f6727cc396

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
385KB

MD5
c8442104c8481d0f9e2d8ee2c32e009f

SHA1
2a2a408b9d2e8d4d1d7ed4904727aba3a912414d

SHA256
66afc4a1038ad43fc6f69633310e4b5c3c582533a7ef30a5f389cff17b5bac8d

SHA512
e0fc0038e87140758b8a86fe202f601caeab6bbeb0f6d9b67fb05f2cf3435f0c583beb09e9e176728f6217bdf47e89868dab835c2453ded547daa07740c9427b

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
385KB

MD5
23f5eec9a74a0ed826120440d52d91cd

SHA1
73c6467aa87583960dc3ccc04049d6efeed2946e

SHA256
4f35be6b379cce8d203655166c2ec6aabafc59ec21f0b5cf52d51868080183bc

SHA512
95afe7a8ef37ef570ac3133e85700f0acb2394fd5eb16fcf65394941bad52c3d08077d9d69cdda341729b8dda5799a277922900361cb50be46ee525bfa628d4c

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
385KB

MD5
1dae631b98583692144c0e5de602ffe2

SHA1
d941b097e82e407fb27fbf5f99622ddd972d19f8

SHA256
6c4e14b4cf239600b5905b76ca9f39fcb49a3fdd806711d9b75b74a93496c52c

SHA512
fd11bb37a51f016ec11d8748584994b7e8ef35faccc2e848a2f88eac075376686c4bf596914cca750ffce5b7be752d37b62a13296fe89dbc18a81a5ab0b11029

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
385KB

MD5
ef36d7c6cb8b02c7ce6c4d7d4ffdcac8

SHA1
3a8e30506d881ebac5ab31e9fb016d6a960c0eeb

SHA256
f66245e884cbdf803d3f5162c0cd180bce9838f4c4b504538e1203b189c47f2d

SHA512
406cabcef412805396b3bcfcc9a1736770ee70bb2e7ddf9ec0425fe5fcdd61ef00e90fe3d0ccaae2652641fa5098e85a4806338199e1be27cccf6cf3ce11d77f

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
385KB

MD5
199a1d277f626e92ef3ce70834556b89

SHA1
26fc56a34412cbf1b5b69c351818ebb552901d4a

SHA256
6736e4fcb0e8dc10ae6b688de9e370f17a4f15f0cbb244a795b418fd9b1621db

SHA512
e6063f824ba536d43fbed7c3a6ec170d7b8425673720e56af6d7573b274ad4cc3269c9a0ca00083f416c30b579c7c4ffd8b40a729446563910e0c61c39c8ca2d

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
385KB

MD5
10c13a8d626b5965b55f565b478ccda0

SHA1
90df6d1a113b0daff6b199a92d0687a794f1476c

SHA256
40213a9d6ca4d513332614eb24cfead5bed0eea54decc8cbbd8f0c9db6f03575

SHA512
81e37359655bcee938bb39ca1bd14fc998c3581ffea9db1322f00d793533eeaf8c3e356ae0882e10b4aa13e8412bab3da465f236fed6885ca86b3708d1244b02

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
385KB

MD5
ef9af3bee5a08722fd41aa349df9b593

SHA1
445bc630bfb41a5a1848aa69e72f0ec3a4c5c0ae

SHA256
03c2cfd793eac035efaf3aba5e981ff1574b2af167f1e1a47240da1a69af0eb3

SHA512
2c6505c268f046a5fa36c03c5be0d2f603934e61b7dd64151443702293fcd47a61d3800cc7d74c814cb2a76d156ed4de7600565b10e524058ba3449df35d1350

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
385KB

MD5
52eb7da48d4d1382a7c883435b24ee23

SHA1
f63172d8080e1c8f4c2d022bb96b8ce71c86f78e

SHA256
7f624a8a3a424beec0ab2f7466fad0d8cb66474d70e02ca951ea6821e469cec6

SHA512
e7520c32108c7d6195a986be97044bbb8adc8bed3151e32b1bac6396687ffbee879adbd29788f53f3168be2d8474a54412f1cca4b77b01af28f5fa30d4b887ed

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
385KB

MD5
12fedace276064ee4977dc1170f5d2f0

SHA1
ed017071d34fc249021b5cf00447defa46cfd6ba

SHA256
1088e1ca692e4f68c3c8cdee1b97da75d27075c9954ace4ac9698421cb786a93

SHA512
4d339ed8f11a976e4809936638ee84cf010f1fa21f0c1598ff6124d134c17e7229b206753c9ebf37cd2c4ca147f16be4bd3de58e8019aa16af535f301a8551e1

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
385KB

MD5
c3983a7aaebaee77fbb14884dbf963fa

SHA1
3a547124e98305b571654f57f6e56e0133dd330c

SHA256
7744cb918afbf65247f1c7b3ccba4ee650326f7180a4d7ba9f8cd0231a7690e5

SHA512
f27bd9eead3cd7f6e786305ab3b2b0680a8bd944124849e364f5fd6d03324e96b6b093a31278613d608e45cd9ac9372b86c3371bdd64f5f375766d2928fba797

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
385KB

MD5
4df5eb5f038d4dde5e031f8bac69ab5b

SHA1
a81de28be9be2918427df10cefb2831480aa4bae

SHA256
54681dd97b45cb820e1893eb93a18a44bd415d2cdadb76f1cd90386657ea26b2

SHA512
08dfd642ce6bd1bc90a9594382ab01694aff6bb046782dfa0d23ac0724b8d6189deb2797aaad271a956f681a5c7089e65387477b7a749aa0d9d6342a45f9082d

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
385KB

MD5
1c6fde4dc3803f04d22f493580508a4f

SHA1
3463074a2faa6ce012f0f3c214952c23051dad52

SHA256
96a5c82fdaac5be60b7189561e165b72d12047022cf98b5ce0fed9815646786a

SHA512
94ecad464ad8bec04f32db5c2f8af8082884e801420a3ec1a2fa910bf13128d2fc9bb43732d41aab9de1ec4abb86f98040029d6bea1266db9fe2268e96da76f9

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
385KB

MD5
8c78bc155e3bceec8f0fb272a10e8d61

SHA1
0f144f094e4f2656798b839b15a61022328447b3

SHA256
0e5051270ec445cec28a9512a197468e7c588c39481c181e0d23fed4e762f7ff

SHA512
4c28f5230f91eddc44a9c84eeca73a55a6de927398d971d0dad7bc8eb0a94a663fd19c849315465b62abd8b11903031320e8346a0990385690af42e8de91a384

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
385KB

MD5
67c0fcf3ab809c0a8169b3753279738a

SHA1
5e716a4828a0d33b6c2570c85e1e14aa7b9126f8

SHA256
136315de142b24fd3dcc4b88d69f4c24aa916b0273119141e75c9b75612eb7ba

SHA512
8605d14f4ad7f5e3fbdc450922708dd83737a84ef6fc6ab8c9399de61180e1a00c9aa26732ea6164514bf54f05aec89c3e4c27969255f1ea40a3b4a857dc1f58

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
385KB

MD5
5403d161e79049ef459e8a0b30b36c29

SHA1
5e61b4bc7ea122dd971d46a45756890c4b7c2083

SHA256
c7eb7d947f3c9a490f4cdb4a9002e99f4c30a5c6979688897ccb9670f27080e8

SHA512
5cc096732e1b5316c807d95b5b34c47317e9f1cd9a0a4b74567cb7a5d780e907d41c4a42dca64ce194a6a82f208715fddd1614830e56db7f65a20c8ad541ec72

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
385KB

MD5
798fa0c2d5d096c1aff14971b0c2600a

SHA1
48a7a5546b1905876c2cb130c98330c784e8a093

SHA256
4214df455cdf1163ae24390b21ad0e9dc82a557494e83caa718500cb2d2b8a95

SHA512
b1e06cdb7e35b2f647dda11dad9f763785b39593cfa2428acbc4f0f7253a528b91671cab73ff3f0533b8b8e64e27624b6300047e838bc934ec8bf3d6d438bf51

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
385KB

MD5
17bad5ac2dd839b14c636ee5ef6162ff

SHA1
a474b8f2d84e8e052abca4636d716efe80f07dd8

SHA256
15903dd8401aa4346950989e8f3ba3b95b04c3f78cbcaaeed23ffabad1acc5af

SHA512
f79e07db5b61285aa416ca6da169949152ec88f8fbe86147f721ac7315c7a1e965ff0bf9cbac62139b1a9cec7283e05685ee22f7ac5435b712e71b8142c79c34

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
385KB

MD5
0c62043489bd005176aa763c29c8429e

SHA1
30065ae7b8574c593e4b058cff4912555c5815ca

SHA256
413f5b07a64877d096590bebd154783bf58ad765a3a030c16d3237f85bd3b8fb

SHA512
a10a69532487fa1de4267dc95239aeb5c2ba6faa925f38822bedb1eeb51f0e43c94ca80c93a5ed1e6ce74027a0cf4b0c2ba3b86f4c4f7487ea9e1c8b3403bd89

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
385KB

MD5
568c33af68f6c8aba5626fdfc03ab74e

SHA1
b4e8ff3868fe6caf63e2228d8229870f957c9b8d

SHA256
b4bb20a1400f17612724d5839a13442a6e585dfe6c6c33381e9a2a89815c2cf2

SHA512
b25c2e7dfae28dd727660a9efae15cf5873df36fbeb8142540a9c98953059204f02dc628daa442127e769b1a1fde9e6c02b5f5e6637ea72619a94ada9cc6199c

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
385KB

MD5
42078c57d4c1d9d415a42f564c03c800

SHA1
b3cf30dbf47f11326dee1c04080df38c7364aad0

SHA256
7891429ef5c28c64094773d525549a2ce56ef960e1fa997f4da38b2e3211bc81

SHA512
af85d1f2bf566b2c53f519f1aa28c79df53808c9b8f715fecbba6b091fd8f25121d3051720f10d2aa998e0250f09a7f76d8e60c9a4ed0ef8a7215175f33499d0

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
385KB

MD5
1d08e5f7472cd6d5a30ee8cce5a84442

SHA1
e29a70643303d73df396ea4e4b9c98936ddb5174

SHA256
8fd69ca6121cc58111bfefb6960361cfc9ebf90ee2fba55984f130b8285a99cd

SHA512
cdd4826590d13121c6f6e8101846a08a1de9b43816c1116ba6260bb6288e50b561cc62787a4e36c8c66a95558eca835740f2393fa11b1862bd9d6b19839883bb

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
385KB

MD5
0f3bccf87e36e5e5af975c981eeebf32

SHA1
7e6556b541a543fee7e5fa0ec02b65066252c05d

SHA256
b9eb4c22f6e0f563c44855b78946b57bae09055298d1df2fe81bda069c0e8b35

SHA512
50bef3c5e3fd8d02d93565b0d244e04a3d2592ad7a696a04b5581e1818398546800546d18645fb63872e425db46494c8834f99d15542bbd21f3c3bf82795cfda

Download Submit
memory/228-493-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/232-545-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/316-432-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/380-513-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/380-463-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/400-25-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/544-571-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/544-443-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/652-565-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/652-444-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1036-462-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1036-515-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1068-441-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1068-573-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1072-525-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1216-450-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1216-561-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1248-57-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1360-563-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1360-445-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1400-129-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1408-484-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1444-567-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1560-451-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1560-559-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1564-439-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1640-459-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1640-551-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1944-480-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1948-541-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2096-428-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2116-431-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2128-521-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2168-553-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2272-509-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2272-465-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2316-472-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2316-495-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2344-533-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2360-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2360-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2524-517-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2528-433-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2540-547-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2580-68-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2620-535-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2752-473-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2848-77-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2852-468-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2852-503-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2876-491-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2936-464-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2936-511-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2944-86-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2952-527-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2952-461-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3076-537-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3088-501-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3088-469-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3140-543-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3180-107-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3256-440-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3368-474-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3448-434-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3504-539-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3600-497-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3600-471-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3628-482-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3628-475-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3696-557-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3696-453-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3704-507-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3704-466-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3712-16-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3772-489-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3948-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4252-486-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4296-32-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4384-41-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4440-519-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4484-555-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4632-529-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4632-460-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4668-49-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4700-476-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4700-478-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4704-430-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4712-531-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4760-470-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4760-499-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4792-131-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4812-505-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4812-467-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4844-523-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4896-549-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/5060-569-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download