berbew | 9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe
Size

71KB
MD5

940bac052e82672bed9822d7e1a0ac80
SHA1

654373261b3f5a205b257b2dc2422ea493169872
SHA256

9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683
SHA512

168bc5ba7bb3671861e6096acef8c28755de82e8434061802e3b39a40a97d1728cb09ec5df4c940d2ab4b1c2b9d59fac8882cc4021b00fb93e4dc1a98438b51c
SSDEEP

1536:rYjYk6gAZ27AN6lRMCSlRXO3m++WXrHsRQyDbEyRCRRRoR4Rk:rYa20klibebDrMesEy032ya

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Nnjlpo32.exeNphhmj32.exeDfpgffpm.exeNjefqo32.exeQgqeappe.exeBganhm32.exeBnkgeg32.exeBaicac32.exeBclhhnca.exeBapiabak.exeCmlcbbcj.exeDodbbdbb.exeOdkjng32.exePgnilpah.exeQqijje32.exeNgbpidjh.exeOlhlhjpd.exePjjhbl32.exeCalhnpgn.exeDaconoae.exeOjgbfocc.exeAfmhck32.exeBcjlcn32.exeBanllbdn.exeBelebq32.exeNgpccdlj.exeOfcmfodb.exeOgkcpbam.exeOcbddc32.exeNljofl32.exeCnkplejl.exeNloiakho.exeNnneknob.exePqknig32.exeAglemn32.exeBnpppgdj.exeCmiflbel.exeDaqbip32.exeDfnjafap.exeDmjocp32.exeOfeilobp.exeNcianepl.exeOddmdf32.exeBffkij32.exeDelnin32.exeDgbdlf32.exePmdkch32.exeAgeolo32.exeAgglboim.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nphhmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baicac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpccdlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngbpidjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

Processes:

Nljofl32.exeNgpccdlj.exeNnjlpo32.exeNphhmj32.exeNgbpidjh.exeNloiakho.exeNcianepl.exeNnneknob.exeNpmagine.exeNjefqo32.exeOdkjng32.exeOjgbfocc.exeOpakbi32.exeOgkcpbam.exeOlhlhjpd.exeOcbddc32.exeOjllan32.exeOdapnf32.exeOfcmfodb.exeOddmdf32.exeOfeilobp.exePqknig32.exePgefeajb.exePnonbk32.exePmannhhj.exePggbkagp.exePmdkch32.exePflplnlg.exePcppfaka.exePjjhbl32.exePgnilpah.exeQgqeappe.exeQqijje32.exeQcgffqei.exeAgeolo32.exeAgglboim.exeAfmhck32.exeAglemn32.exeBfabnjjp.exeBagflcje.exeBganhm32.exeBnkgeg32.exeBaicac32.exeBffkij32.exeBalpgb32.exeBcjlcn32.exeBnpppgdj.exeBanllbdn.exeBclhhnca.exeBapiabak.exeBelebq32.exeCmgjgcgo.exeCmiflbel.exeCjmgfgdf.exeCmlcbbcj.exeCnkplejl.exeCalhnpgn.exeDfknkg32.exeDaqbip32.exeDelnin32.exeDfnjafap.exeDodbbdbb.exeDaconoae.exeDfpgffpm.exe

pid	Process
4144	Nljofl32.exe
4892	Ngpccdlj.exe
3204	Nnjlpo32.exe
2900	Nphhmj32.exe
3192	Ngbpidjh.exe
3696	Nloiakho.exe
2920	Ncianepl.exe
1092	Nnneknob.exe
388	Npmagine.exe
1700	Njefqo32.exe
1560	Odkjng32.exe
2340	Ojgbfocc.exe
348	Opakbi32.exe
1132	Ogkcpbam.exe
4988	Olhlhjpd.exe
1192	Ocbddc32.exe
3656	Ojllan32.exe
4708	Odapnf32.exe
4792	Ofcmfodb.exe
4724	Oddmdf32.exe
2528	Ofeilobp.exe
4056	Pqknig32.exe
1140	Pgefeajb.exe
3876	Pnonbk32.exe
3096	Pmannhhj.exe
3180	Pggbkagp.exe
5100	Pmdkch32.exe
4824	Pflplnlg.exe
1144	Pcppfaka.exe
2020	Pjjhbl32.exe
1944	Pgnilpah.exe
1272	Qgqeappe.exe
4432	Qqijje32.exe
4324	Qcgffqei.exe
3584	Ageolo32.exe
3956	Agglboim.exe
4768	Afmhck32.exe
4992	Aglemn32.exe
3932	Bfabnjjp.exe
3600	Bagflcje.exe
4256	Bganhm32.exe
4700	Bnkgeg32.exe
3032	Baicac32.exe
4684	Bffkij32.exe
2412	Balpgb32.exe
2656	Bcjlcn32.exe
3624	Bnpppgdj.exe
1112	Banllbdn.exe
5052	Bclhhnca.exe
2684	Bapiabak.exe
932	Belebq32.exe
2404	Cmgjgcgo.exe
2616	Cmiflbel.exe
3172	Cjmgfgdf.exe
4748	Cmlcbbcj.exe
1588	Cnkplejl.exe
2132	Calhnpgn.exe
644	Dfknkg32.exe
2916	Daqbip32.exe
3928	Delnin32.exe
3976	Dfnjafap.exe
404	Dodbbdbb.exe
2160	Daconoae.exe
1456	Dfpgffpm.exe

Drops file in System32 directory 64 IoCs

Processes:

Pnonbk32.exeBcjlcn32.exeDfknkg32.exePflplnlg.exePjjhbl32.exeAglemn32.exeDelnin32.exeDaconoae.exeNpmagine.exePgefeajb.exeAfmhck32.exeCnkplejl.exeBelebq32.exeCalhnpgn.exeNphhmj32.exeBnkgeg32.exeBaicac32.exeBalpgb32.exeDodbbdbb.exeDeagdn32.exeNloiakho.exeOlhlhjpd.exePqknig32.exeBganhm32.exeAgeolo32.exeBffkij32.exeDmjocp32.exeNgpccdlj.exeOcbddc32.exeOfcmfodb.exeQcgffqei.exeOgkcpbam.exeBapiabak.exeDfpgffpm.exeNljofl32.exeNgbpidjh.exeOjllan32.exeBclhhnca.exeDfnjafap.exeNcianepl.exeOdkjng32.exePmdkch32.exeCjmgfgdf.exeBnpppgdj.exeNnneknob.exeOdapnf32.exeQqijje32.exeCmlcbbcj.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Hdoemjgn.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Bfabnjjp.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Njefqo32.exe	Npmagine.exe
File opened for modification	C:\Windows\SysWOW64\Pnonbk32.exe	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Afmhck32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Coffpf32.dll	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pflplnlg.exe
File created	C:\Windows\SysWOW64\Bneljh32.dll	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Ejfenk32.dll	Pqknig32.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Hddeok32.dll	Nloiakho.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Nnjlpo32.exe	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Dfdjmlhn.dll	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Oddmdf32.exe	Ofcmfodb.exe
File opened for modification	C:\Windows\SysWOW64\Ageolo32.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ogkcpbam.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Bobiobnp.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Ngpccdlj.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Nljofl32.exe
File opened for modification	C:\Windows\SysWOW64\Nloiakho.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Odapnf32.exe	Ojllan32.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Ncianepl.exe
File created	C:\Windows\SysWOW64\Ojgbfocc.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Pflplnlg.exe	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Iphcjp32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ngpccdlj.exe	Nljofl32.exe
File opened for modification	C:\Windows\SysWOW64\Npmagine.exe	Nnneknob.exe
File opened for modification	C:\Windows\SysWOW64\Ojllan32.exe	Ocbddc32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Npmagine.exe	Nnneknob.exe
File created	C:\Windows\SysWOW64\Bmfpfmmm.dll	Ogkcpbam.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
5092	4600	WerFault.exe	153

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Nnneknob.exePgefeajb.exePcppfaka.exeQgqeappe.exeCjmgfgdf.exeDaconoae.exeNphhmj32.exeOdkjng32.exeAglemn32.exeBnkgeg32.exeDodbbdbb.exeOgkcpbam.exeBnpppgdj.exeBclhhnca.exeBcjlcn32.exePggbkagp.exeBffkij32.exeCmlcbbcj.exeCalhnpgn.exeOjgbfocc.exeOlhlhjpd.exePmannhhj.exeDeagdn32.exeNjefqo32.exeBapiabak.exeCmiflbel.exeDfnjafap.exeOjllan32.exeDgbdlf32.exeOdapnf32.exePmdkch32.exeAgglboim.exeNgbpidjh.exeBganhm32.exeDfknkg32.exeBagflcje.exeAfmhck32.exeBelebq32.exeDelnin32.exeDmjocp32.exeNpmagine.exePjjhbl32.exeQqijje32.exeBfabnjjp.exeCnkplejl.exeNnjlpo32.exeBalpgb32.exeBanllbdn.exeDaqbip32.exeDmllipeg.exeAgeolo32.exeNgpccdlj.exeOcbddc32.exeOfcmfodb.exeOfeilobp.exeNljofl32.exeNcianepl.exeOpakbi32.exePqknig32.exeQcgffqei.exe9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exeOddmdf32.exePnonbk32.exePflplnlg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnneknob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgefeajb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qgqeappe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjmgfgdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nphhmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odkjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcpbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bclhhnca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmannhhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bapiabak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmdkch32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngbpidjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bganhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Afmhck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmjocp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npmagine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjjhbl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qqijje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnjlpo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Balpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ageolo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ngpccdlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocbddc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofeilobp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nljofl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncianepl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opakbi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qcgffqei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pflplnlg.exe

Modifies registry class 64 IoCs

Processes:

Bganhm32.exe9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exeOlhlhjpd.exeOfcmfodb.exeOddmdf32.exeOfeilobp.exePmdkch32.exeBagflcje.exeBanllbdn.exeCmlcbbcj.exeCmiflbel.exeNnjlpo32.exeNcianepl.exeOjgbfocc.exePgnilpah.exeBnkgeg32.exeBclhhnca.exeBelebq32.exeNnneknob.exeQgqeappe.exeDaqbip32.exePqknig32.exePgefeajb.exeDfpgffpm.exeNljofl32.exeCjmgfgdf.exeDeagdn32.exeNgbpidjh.exeQcgffqei.exeCalhnpgn.exeDfnjafap.exeDaconoae.exeOdkjng32.exePnonbk32.exePggbkagp.exePflplnlg.exeCmgjgcgo.exeNgpccdlj.exeNpmagine.exeOcbddc32.exeAglemn32.exeDodbbdbb.exeNjefqo32.exePmannhhj.exeDmjocp32.exeBalpgb32.exeNphhmj32.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empblm32.dll"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjbnapki.dll"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjkmdp32.dll"	Nljofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjkjk32.dll"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Odkjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pqknig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdeflhhf.dll"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aglemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nnjlpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exeNljofl32.exeNgpccdlj.exeNnjlpo32.exeNphhmj32.exeNgbpidjh.exeNloiakho.exeNcianepl.exeNnneknob.exeNpmagine.exeNjefqo32.exeOdkjng32.exeOjgbfocc.exeOpakbi32.exeOgkcpbam.exeOlhlhjpd.exeOcbddc32.exeOjllan32.exeOdapnf32.exeOfcmfodb.exeOddmdf32.exeOfeilobp.exe

description	pid	Process	procid_target
PID 1884 wrote to memory of 4144	1884	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe	82
PID 1884 wrote to memory of 4144	1884	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe	82
PID 1884 wrote to memory of 4144	1884	9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe	82
PID 4144 wrote to memory of 4892	4144	Nljofl32.exe	83
PID 4144 wrote to memory of 4892	4144	Nljofl32.exe	83
PID 4144 wrote to memory of 4892	4144	Nljofl32.exe	83
PID 4892 wrote to memory of 3204	4892	Ngpccdlj.exe	84
PID 4892 wrote to memory of 3204	4892	Ngpccdlj.exe	84
PID 4892 wrote to memory of 3204	4892	Ngpccdlj.exe	84
PID 3204 wrote to memory of 2900	3204	Nnjlpo32.exe	85
PID 3204 wrote to memory of 2900	3204	Nnjlpo32.exe	85
PID 3204 wrote to memory of 2900	3204	Nnjlpo32.exe	85
PID 2900 wrote to memory of 3192	2900	Nphhmj32.exe	86
PID 2900 wrote to memory of 3192	2900	Nphhmj32.exe	86
PID 2900 wrote to memory of 3192	2900	Nphhmj32.exe	86
PID 3192 wrote to memory of 3696	3192	Ngbpidjh.exe	87
PID 3192 wrote to memory of 3696	3192	Ngbpidjh.exe	87
PID 3192 wrote to memory of 3696	3192	Ngbpidjh.exe	87
PID 3696 wrote to memory of 2920	3696	Nloiakho.exe	88
PID 3696 wrote to memory of 2920	3696	Nloiakho.exe	88
PID 3696 wrote to memory of 2920	3696	Nloiakho.exe	88
PID 2920 wrote to memory of 1092	2920	Ncianepl.exe	89
PID 2920 wrote to memory of 1092	2920	Ncianepl.exe	89
PID 2920 wrote to memory of 1092	2920	Ncianepl.exe	89
PID 1092 wrote to memory of 388	1092	Nnneknob.exe	90
PID 1092 wrote to memory of 388	1092	Nnneknob.exe	90
PID 1092 wrote to memory of 388	1092	Nnneknob.exe	90
PID 388 wrote to memory of 1700	388	Npmagine.exe	91
PID 388 wrote to memory of 1700	388	Npmagine.exe	91
PID 388 wrote to memory of 1700	388	Npmagine.exe	91
PID 1700 wrote to memory of 1560	1700	Njefqo32.exe	92
PID 1700 wrote to memory of 1560	1700	Njefqo32.exe	92
PID 1700 wrote to memory of 1560	1700	Njefqo32.exe	92
PID 1560 wrote to memory of 2340	1560	Odkjng32.exe	93
PID 1560 wrote to memory of 2340	1560	Odkjng32.exe	93
PID 1560 wrote to memory of 2340	1560	Odkjng32.exe	93
PID 2340 wrote to memory of 348	2340	Ojgbfocc.exe	94
PID 2340 wrote to memory of 348	2340	Ojgbfocc.exe	94
PID 2340 wrote to memory of 348	2340	Ojgbfocc.exe	94
PID 348 wrote to memory of 1132	348	Opakbi32.exe	95
PID 348 wrote to memory of 1132	348	Opakbi32.exe	95
PID 348 wrote to memory of 1132	348	Opakbi32.exe	95
PID 1132 wrote to memory of 4988	1132	Ogkcpbam.exe	96
PID 1132 wrote to memory of 4988	1132	Ogkcpbam.exe	96
PID 1132 wrote to memory of 4988	1132	Ogkcpbam.exe	96
PID 4988 wrote to memory of 1192	4988	Olhlhjpd.exe	97
PID 4988 wrote to memory of 1192	4988	Olhlhjpd.exe	97
PID 4988 wrote to memory of 1192	4988	Olhlhjpd.exe	97
PID 1192 wrote to memory of 3656	1192	Ocbddc32.exe	98
PID 1192 wrote to memory of 3656	1192	Ocbddc32.exe	98
PID 1192 wrote to memory of 3656	1192	Ocbddc32.exe	98
PID 3656 wrote to memory of 4708	3656	Ojllan32.exe	99
PID 3656 wrote to memory of 4708	3656	Ojllan32.exe	99
PID 3656 wrote to memory of 4708	3656	Ojllan32.exe	99
PID 4708 wrote to memory of 4792	4708	Odapnf32.exe	100
PID 4708 wrote to memory of 4792	4708	Odapnf32.exe	100
PID 4708 wrote to memory of 4792	4708	Odapnf32.exe	100
PID 4792 wrote to memory of 4724	4792	Ofcmfodb.exe	101
PID 4792 wrote to memory of 4724	4792	Ofcmfodb.exe	101
PID 4792 wrote to memory of 4724	4792	Ofcmfodb.exe	101
PID 4724 wrote to memory of 2528	4724	Oddmdf32.exe	102
PID 4724 wrote to memory of 2528	4724	Oddmdf32.exe	102
PID 4724 wrote to memory of 2528	4724	Oddmdf32.exe	102
PID 2528 wrote to memory of 4056	2528	Ofeilobp.exe	103

C:\Users\Admin\AppData\Local\Temp\9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe
"C:\Users\Admin\AppData\Local\Temp\9b8f126943aefd5b0af5fe6ddc2385b86dd03461f7e5c0930666b4338ebdd683N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\Nljofl32.exe
  C:\Windows\system32\Nljofl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\Ngpccdlj.exe
    C:\Windows\system32\Ngpccdlj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\Nnjlpo32.exe
      C:\Windows\system32\Nnjlpo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2900
      - C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4056
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1140
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3876
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5100
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1272
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4432
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4768
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4992
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3932
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3032
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4684
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2656
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3624
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1112
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2684
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:932
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2404
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3172
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2132
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3928
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3976
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2160
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        67⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4236
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 416
        70⤵
        Program crash
        
        PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4600 -ip 4600
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afmhck32.exe

Filesize
71KB

MD5
d3965ab9c7d865bacc113ecd1c577cd4

SHA1
fa0931ddcac73131e9a22c9b9c9fd22fe7b42372

SHA256
31db05e4fc41fe3481a8c607c3d047dc132521c546597f7a177728be6044ad28

SHA512
5e43369a8e29ef5ffaf1f04b307965ca241217ed7445f7334a7d9330d4468cc026156b1121b735ef0cf7823c27e077d401dec88979f138639b85e7971a4f98ce

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
71KB

MD5
f7a7fb50c7565474638f2eb7a80cadd2

SHA1
7c4f0020443d5b2156bedf9c7af9b103a3bae234

SHA256
f3dd781be1a718a38455465b7728283065075feed0b895d8c185b23154ed0970

SHA512
68b631a9632d1fac93f14863e792eab03276e62b03705fc90288457ca3aef371598d52944b23b72e739e38321be6caa3608fa5c2a9339bd7e982aa9051541788

Download Submit
C:\Windows\SysWOW64\Coffpf32.dll

Filesize
7KB

MD5
262e23dd04543c4b98f090c5b0afad73

SHA1
d8cff1f40a73fde6c8a1b17eb83465403a57e7ff

SHA256
50f96907662cc94c95bd2fa545edd2155c5c859170e9e4dee398b1715960836b

SHA512
e4013f060d009307e352c8b7063245533b4e4fba12da7a70dfe194b1f68819c20a914e9957439eb1d8d5d97c93278805f36bf6644df0b14b0658f7cadaf33ac6

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
71KB

MD5
37da2bf48ae50042f7c2bbcd2301f9ed

SHA1
cdd1bf0a449372f998dec16dab26eaa90aef080a

SHA256
112546f71d413870583505d7dc4ef2a2fc04209b2b7f83fe77804e237f4f46a2

SHA512
d1a35dac32383a8e7218655ee0bf3105594849b8e61c3a5250262f77bce63644fdfc01d27ff0f616258f39158eca89f81af4dda50ea978275458faf337c58f64

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
71KB

MD5
7f57f97957c30191691888ecb7079b62

SHA1
ce40748c2900c02354a4e29ea7e8c9044b1fce6c

SHA256
d2084f9c1d05147e025072ed23fe8a4eb2162e3fce2ce9cec0a29c6f8034fe73

SHA512
55adaaab727bd4a29fa960b0de8fb8d9c86c43896ada02baed7053323efeb40974e112e3a74e7fbf576f551174677685126da9a7669900d5c738db6aa5984197

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
71KB

MD5
1e8adf244e99c824608547d214e96568

SHA1
2c5947b4de545a365bde4c3676ef0329f1ba9cad

SHA256
b736e62e62d5196d5d5f57d0d425fae8bdc25eb25c029f036ca9c7b2c58a635e

SHA512
7fabb8c2597b9785268a63a200c1a92d021648374f33b70f5b8a8c2eff77bfdbbe59f6406a43f764fc199b3b54cb6ec3a7a02de68afe64d4a9cce00d2fa87600

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
71KB

MD5
cae32cb604641c7a3aab30a08912af4f

SHA1
8b07abe6f69f63e47f6a14041b22b74601f97dd1

SHA256
eee397caab12c5592f749d921729dfe8acfcf6d15807f1a798310336125c86b9

SHA512
56febb9612ddaa1818be9861816c6840592f380ae440c9a78c92ae05f22c202d5f7568189619ee62f6a2df188db3a1b7d089595163f9a932c09ffca51e8a2ff6

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
71KB

MD5
c3bf6b43a4510e25af0734d9faf06c99

SHA1
8d54c0e36916ff6a8e55c993656ab5bb7dd4e943

SHA256
5d6a5efb81cbe3042d38e41cb988b8d3ab00604efda33ebbc91a32076d83502e

SHA512
265e13438f7da802c16e9dbcb69e3aa3d2ba6962780da211715fcaec3fab408b15c2f7fcc729cf1463906b612c5f57b062ce46c7e29fae54d1191c6f0e25847d

Download Submit
C:\Windows\SysWOW64\Nljofl32.exe

Filesize
71KB

MD5
35fa5142fe9959961e96db826d838cdc

SHA1
5dcd82f2183b3d12e3cfe69c458c9febcfa6d2b5

SHA256
3287e545548d437fc498f99d82cdcd577ee8363532b3d9337e4f5d817a127767

SHA512
46b32b8edb932958a756d9cdbf4b34afa30aba4b38884c47414582f2a8662a6d239545db73df4612cd294e671532a7fcac702f47d29fab44ca1519b8897d95c7

Download Submit
C:\Windows\SysWOW64\Nloiakho.exe

Filesize
71KB

MD5
725768659de53f5b18780527007e2015

SHA1
af7ded00b919453fabc3b8c7a583d201a5cadca9

SHA256
8645554c09be40da7f768d19c3a19919c05af507f264bf3a115308ab39e6d9d5

SHA512
948fde4fad6d3bee1616135e352306612f7338ffe7be8b4498d8e3e0232bb391b94f81adf0df995868d1f62c4791407e4662efa2cda3115f2c1ab55ae57a152f

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
71KB

MD5
a2caba440a828fbefd54df761a243cf6

SHA1
40d593484f8ca624a827ff8c97f06fdd18a6c713

SHA256
f48d2c698ceca75ef44c1deeb46ba38cb3f584cbc4dfb6f0089ba7dc965333c9

SHA512
73f47c41607ce0ebe93f596818291695f077772dfd0a05f4b60468d97fa9aeed1b586e27d5c1e3df9e047f7c7150deb8060658573fd585c1b5f6f5d9da1eaee7

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
71KB

MD5
c917af8857004fdb65334932ff422074

SHA1
b64a0b7c1374592e4844e50f70786fb3eebf1a85

SHA256
2baecbf62c4c650dc097f28ec0d5162c205b2eb11715fb6fee1568a3bb8065a3

SHA512
7c28d604ba2d32d14b610f4fda4977d282389afe19e083df724877ee3c176e70e6b8c4fbde8bff189f51a77419916956c2ebb601ab8f95fedfd28c108736f93d

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
71KB

MD5
f80126223dbfaba3fb8109ac702789b1

SHA1
f0d11b8bba4763638b4e217f75ef09c29cc0af7c

SHA256
c971daff0d4fff6c75e814983433791e6d9ea84283b9ae994930111c7b4e265b

SHA512
dc1c20869d8127752f3a17bd9744e0764a751a942194124493e249310e46525a57d7c05a5a23e16b1b41c843e548781f9822579a0f159a5dab6380114e1481aa

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
71KB

MD5
3b4a1e0185537378a2022f203fe685ad

SHA1
86dc56fa5d78fee314591c7a239c8ac9312d24f5

SHA256
b81b1a2c286126296a9cd83043158629fcd1ea8c695feea8ef908ff964816686

SHA512
0af373c6f0ba34e92653cb79cc3619ff1321ac0b81352d28b277cf5700b0bd65f95c2e020e064d18d7715db2a7f27666e779fbd527e14f01deba1ff52c1631a1

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
71KB

MD5
bd46dd1d7d31bab153d5d3fa27ba27ab

SHA1
e84d2c8cd825b5d0505cc8fd8ef7143e94ac7eb3

SHA256
cc8569fb6aa9570670916ca22a7025744815015a27a58361ce576611abc3c3c7

SHA512
0e60ff793b4ac41bacfb95355f770cae9e4b274b915396a0643c27dae1894b69b588211d1bfbbf06eb1cecbc4e17373f69bfba0c84553c0a5122cbe178bd0cc9

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
71KB

MD5
33948e62d7ff42b477681f48319cdc08

SHA1
4cdf3ce9427830ba8586e362e3385ea2400f4ce7

SHA256
2ddf69178739ea9f06e6eb04ce1647c032a542ae1140667ee628f73416a8be11

SHA512
a75f35e64ca58ba299edb81bfac12cb99a3a557926b8620e4e10b1cb006aa4d7430d926715cb6d895f1855490db3c6348a77a16e667f182283ecda044f5b50ed

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
71KB

MD5
c8324959b5f2f2fafdc0486173477fbe

SHA1
94153176829cbd16e7850eeb5753ef58e0f29aae

SHA256
79f17adb7591c5ed69145895dfa55be2ba3d4538e5027d626ebc3f86aee9addb

SHA512
6467270f0f48d6fb050c82d0d544bcd487c9b4e9307675b30773dc1936279ed268f5bbdeacaab2f88f450689a82454ac9c0048b669f8ca5ec89d350c003614d8

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
71KB

MD5
9b51dd8e36adb724a4089eb7189762c5

SHA1
362abbf3f61e570674c93551739ec74fb8acbd90

SHA256
4217c4164b9e999ad890060b76d4a8b325f401a37cc05e3cb54d1e4a85e204d3

SHA512
4a5f97d4fa683ca02ea223e0b913c3410e7df1d255e5182e88adf83c22229cfce8f84a1b5ce7363f4b774d6b81364c7218c20ae73c468155d7751ece0986a4b5

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
71KB

MD5
c0529baf98aa259e767e9dd6fe4dc9f8

SHA1
c8dc90a7e4a521a8bb1ddeb465ed85c8df5420ef

SHA256
45368cac8c6496bc637b66cce83de3f4cf34b0040d3185c47c0583e9023bf63c

SHA512
3acc887fe231e8087a555188e9a8d529eefbe262ef359565bc708acab06b800f009ba30e642e29c8ddc4123a38cf5d8c2ddc6c9979b5728999b438bb2536c8af

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
71KB

MD5
674bd34280b230f4dccfd9b73a0e4c1a

SHA1
accd7b915744128d434de32d9987aeb6b873ac26

SHA256
00eb04a17553114e287cf04dd8dd7da2714ff9932a1a9888525844e7af380422

SHA512
3510f3612c4090bfe9772df23077de23017bb66c2aa2877a0917b7765ab80ff0929100e3429dc601f9113aa7e70f508d73714031c09207813b8baad1a9f7ed64

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
71KB

MD5
35fffb2848935a9d6b565218261f616b

SHA1
0d77cd8bf76eaa31e00c25af3c5f38d652323254

SHA256
2bb29e09be9ed42f1f5d1ce0fa853a136aa6b8e147025399075db658df47d9a5

SHA512
e4a760aea5b90fb999a50bb0170da112139b408bad7bd00ae9c5da5a2a58ad4840d02df849d37702245b9c5c42d55dd459bf38d887eaccae56495c6cf6677327

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
71KB

MD5
2dc0e9d53dffefe5d5fcce1ff88e5393

SHA1
b6dee73f98b9f92982d7b11240f52010ab8c4ad5

SHA256
fb52059e54d0b803a5bc777a50f753dc4a9b305852ed35a37402dcb8a3ba1d92

SHA512
d8025ad33d614062e003a987596ea7afe1edf5abd3b126bcc9635f3edde6c52efbf9c6f9d452835bc5ba26bb025d97498692aa6e01d93c58d3f7970d7c93a9c9

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
71KB

MD5
01b716cd4af1d2c6ff4753760faa1112

SHA1
8bf63b681518da4c25fddac7f2b69e062024360b

SHA256
82b2afe8d490fe381f78fd9f7319b60137daaab63e823cc7073d9317c71d051c

SHA512
e106036e86b21e5aebb6741f3729144e6f86ba9bf6f7514326e61eef16e3dc507e9b9df583bda429f0b46d79a171db52bb61aaf3d913fd69870d45db90d371b8

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
71KB

MD5
76396cc1acffe5ffdd19aeda9f123f82

SHA1
7aca0921b7fa34cc516efeaf0ad92d9cce7c7ec2

SHA256
bad62ff4d4d8f5485dbb475cbffa324f585decf0cd9d6e681fd228dcb760cde0

SHA512
7290bf89949cd6fb964919bd96c464d869484df1cfae7080313ec04b9af73b6a2a6ee3459652544b6c9157bbcec778f3c6404294526f768eee5b0c252b9bfa0c

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
71KB

MD5
0a6536d24bb1122ed5de674916d038c5

SHA1
befe119e8234ce9ac732f0586fd658fac157e533

SHA256
5dc5a13407e22e836a92a3c7c56576f8fd3060c004c221d1c7c95e2b0fd6d4c8

SHA512
a6f2d2bb2e3fcf5c8d81f4d2abab8a7610f73e1ef24b4af1e480573cbaea5a5bae61d580951e5b1882a0db03ee4c820131adfc95564e3a58a68285f647fade9f

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
71KB

MD5
8c99810c6b611157593c84b17ffdb213

SHA1
8b873aebce7bfd1aca6446ec6f4d76fe3cc212ad

SHA256
273b64c3c9cf4bb3fc10f5505fb0d4289ab9f9d59723ab52b955a445fdec905c

SHA512
731b0a1786111ca6e293d4fed2d06091c4e63df483b50982ca632e3e044b9b9a740658e72342de295c7cd71037ae00cf32eb268f9f6119a2a7be3b846f376a6d

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
71KB

MD5
4286d460268448059ed84f2d6101c1c8

SHA1
3c7a1a54ba8674fb3cbab99c6ef9215732ef931e

SHA256
518688642c47ddae8dfda70ee6d34779060a5cb5fdab51b55a30132dccba2d85

SHA512
931ba9f9d951cd63460a9e11a487dfa37bd58a01aa436cb802888e80010e29f2f511c8044c8e9f19107f308bffa3804f31acb946bddeb686719949656ed9e18a

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
71KB

MD5
21d720d6fa44584ed81d1d7614e20ede

SHA1
83748d00ab38abe70c3a5d56896a371273966345

SHA256
4bf787b46d93289051e3f96118eba3ed9cb729ec213034886aeac4b1614f669f

SHA512
af3b589aaaeb2c4834e1f60424d1e150a410e1eee08bf02575ca4fb6f21fe7a3d7ccc5901a6f2314f47a4dc66d4026d1ca2ba6e94fc8846af2a1f4e6f309d8de

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
71KB

MD5
68d3467b645b797c76432dca87f05466

SHA1
3bb66f149b664193e42fd72c490d85b0358bab17

SHA256
2bb8f8a911a8386b8bfad393f2e70804df3540c4c892675bb48183c35d07dd80

SHA512
5d68fff67ea442e2fa3d084d062925f4a906f4c0ae1462f0ebd8bb22f55a5589c3328ec00750b9867c3ce3bcb01706ed840a08eb48ead4292800e2855572e01b

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
71KB

MD5
c7f14e419d3af33681d147637d6a3f8f

SHA1
1f150e09afaae29b0a7d439746f5df338505a788

SHA256
913cf3d82b2fb1349406f91521075a844b93f3cc9a8eb4cfe2115ce4745cd49d

SHA512
807bfd01164c86d28cd4500f93c52eb1e95bb4bcb97c02e8915561aab94f9e389d80f0b929b11cda8caa6243a2d97b4e315128fa3ea7a013ffeb09f6064f3d58

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
71KB

MD5
27d47ce5d7bb58281f4fcdd8ee635ccd

SHA1
b7b4a5b8abddbeb6732e5e2ea942188f29a189de

SHA256
30256cf26342c0eb6c0b9c1d38dedcd9dcb6a97d71b021bacbd0e8284a9f7a65

SHA512
368e4f9eea2666e74f3c27397e6b83c93717a675f73b7c256f82b68ac9af5050ef7c8ac31a1e979b8cf54328640f812a487744d7b70c499b3b88f4b142c02f4d

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
71KB

MD5
d49c3d422107a3035f0235545cfc3f8b

SHA1
8fa3d66b5253e01cee199c5c05e1374ca78244bd

SHA256
9ed559b299e896b51fd6d430f0b9c1df74a4f2eb9783f3cea293ef98ed1b64da

SHA512
a2073d7bb93593371c00d6375df29920b315b0ffcafe1051e705737ee26f3de03afe3074feab92333bd848a773c82a43542f009278be764fac0dee3f212d4101

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
71KB

MD5
79a7570dbb0e14261c558f1c3d07794b

SHA1
e5bedf7bd217cb3ce787552c88361f91498c2818

SHA256
069b30450f2c093cd8c69b90b079a5a3475b44d059059f01a708522e79236438

SHA512
9a0958b536619e945330703793ec3fa1cada93a95ddd732314b353a1801c7bce5787c904486140394e28e4d7fa49f48e348ee7650d78f3cc49dd9a0cdee85062

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
71KB

MD5
ae084deaaafea809a48b0d35ee5c95bd

SHA1
7c4c3fa45986ef511299bc856ea27224b113e4fb

SHA256
3caa3a28a0eed5d773218397b13fd2465387888b50c524f22c508f6e0ec0c4a2

SHA512
e8153f5f00ca1e03f33a2c2e20598c62fba8e85f3234172c61c4544d66d9470195b7259811de307fcf523d4f5e34ee5632a80202b0e5be1382fcb065ae043049

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
71KB

MD5
12bf32107bb914637e7fa7b602073cb9

SHA1
ef43b88949b0b7b3f3a42efa1a6a963102679810

SHA256
8b4a26ddce0958f28bcdb9a7339c23a2bfe82c583224fb14e9c62215b0193704

SHA512
f77397f84c5911e053e1c219314b2f54b12fabaa0e5f2f06d087c931dd5efc83999a5878c4d9814c24cf67d1fe0b3e2f162e65750d35d67cfbc25f3ba139aa52

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
71KB

MD5
dcdc074759d4b70276c72953bfb4e31f

SHA1
fe12d11293089ac79e2aee0618b9037bebadb0df

SHA256
a2e974c9bdf16522f23819435fc77b2159d7fce222d0b4fe1918d03c8b467f43

SHA512
78b4c20e0de1a8b99c055e3af1f8c2d9eac6c827830ccfb38ad8b6e803e88818f3d3714e4492afac1c8008ea03cf3981188f399ca9a391e004d9704e7db9f0f9

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
71KB

MD5
079f770e86c4a8049ecd9c651bbe9743

SHA1
d34675d4ec3d0987c664b6fdc04049ed842957ca

SHA256
f073aaa65a2fcb73dff87d18ae8ae58fc36cb737b96b60eacbe325804a4b1cbc

SHA512
06fc3f84d26b2f8d193a66f3f20ee00ac1238f8ad965aa8b1b2141b610e0da25d713cc3b19566c075c69711c4b9e96ac763ec021fa2bca78e345b4e60e988e50

Download Submit
memory/348-103-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/388-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/404-440-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/644-480-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/644-412-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/932-488-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/932-370-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1092-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1112-352-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1112-491-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1132-111-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1140-183-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1144-231-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1192-128-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1272-255-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1388-475-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1388-460-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1456-476-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1456-448-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1560-87-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1588-400-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1588-482-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1652-478-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1652-454-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1700-79-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1884-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1944-247-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2020-240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2132-406-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2132-484-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2160-442-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2160-477-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2340-95-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2404-376-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2404-487-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-334-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2412-494-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2528-167-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2616-486-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2616-382-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2656-340-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2656-493-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2684-364-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2684-489-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2900-31-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2916-418-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2916-481-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2920-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3032-322-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3032-496-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3096-204-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3172-485-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3172-388-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3180-207-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3192-40-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3204-23-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3584-274-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3600-304-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3600-499-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3624-346-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3624-492-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3656-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3696-48-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3876-196-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3928-479-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3928-424-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3932-298-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3956-280-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3976-434-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4056-176-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4144-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4236-474-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4236-466-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4256-498-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4256-310-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4324-268-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4432-262-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4600-473-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4600-472-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4684-328-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4684-495-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4700-497-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4700-316-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4708-143-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4724-160-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4748-394-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4748-483-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4768-286-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4792-151-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4824-223-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4892-15-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4988-120-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4992-292-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5052-358-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5052-490-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5100-216-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download