berbew | d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
Size

128KB
MD5

b1f4a5862fc4ebe468c84447df2fb2d0
SHA1

40722327c509b92f1a7645b66281ab91fe90db57
SHA256

d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc
SHA512

76942c47d05f972de3808245fed834bd94dda4296bcbe8dcc17eea05e7152c6037ffb68a50fefcf9955fdec9072e1a19ebbd53f01d70c46f6cf36a3569210678
SSDEEP

3072:SqaFhecYrqKzgUXQXUKG7UDd0pCrQIFdFtLQ:daFhe3q/UXMxG7Ux0ocIPF9Q

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://tat-neftbank.ru/kkq.php

http://tat-neftbank.ru/wcmd.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggjdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klqcioba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neeqea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmgbnq32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
1512	Kdnidn32.exe
4268	Kikame32.exe
3444	Klimip32.exe
712	Kpeiioac.exe
1032	Kbceejpf.exe
3936	Kpgfooop.exe
2316	Kbfbkj32.exe
3504	Kipkhdeq.exe
5112	Kdeoemeg.exe
2072	Kfckahdj.exe
2964	Klqcioba.exe
3628	Kplpjn32.exe
3932	Liddbc32.exe
4860	Ldjhpl32.exe
3756	Lekehdgp.exe
2904	Llemdo32.exe
4248	Lboeaifi.exe
1392	Lpcfkm32.exe
4736	Lepncd32.exe
1544	Lljfpnjg.exe
1764	Lgokmgjm.exe
2444	Lllcen32.exe
1520	Mbfkbhpa.exe
2212	Mlopkm32.exe
3872	Megdccmb.exe
1868	Mdhdajea.exe
1916	Miemjaci.exe
1464	Mcmabg32.exe
3668	Mlefklpj.exe
1828	Mcpnhfhf.exe
4372	Mlhbal32.exe
4056	Nilcjp32.exe
2508	Ngpccdlj.exe
3104	Nnjlpo32.exe
4348	Nphhmj32.exe
3588	Neeqea32.exe
740	Nloiakho.exe
4564	Npjebj32.exe
4888	Nfgmjqop.exe
4400	Nnneknob.exe
3380	Ndhmhh32.exe
1384	Nggjdc32.exe
3168	Olcbmj32.exe
668	Odkjng32.exe
2124	Ojgbfocc.exe
2340	Oncofm32.exe
636	Ocpgod32.exe
4568	Ogkcpbam.exe
4016	Olhlhjpd.exe
4848	Odocigqg.exe
2812	Ognpebpj.exe
1956	Olkhmi32.exe
220	Odapnf32.exe
3056	Ocdqjceo.exe
2332	Ofcmfodb.exe
1412	Onjegled.exe
4712	Ogbipa32.exe
3864	Pmoahijl.exe
4512	Pgefeajb.exe
4504	Pfhfan32.exe
228	Pqmjog32.exe
2388	Pclgkb32.exe
3772	Pggbkagp.exe
2140	Pjeoglgc.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Mcmabg32.exe
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Acjclpcf.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cenahpha.exe
File created	C:\Windows\SysWOW64\Lekehdgp.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Qncbfk32.dll	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lgokmgjm.exe
File opened for modification	C:\Windows\SysWOW64\Miemjaci.exe	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Hlfofiig.dll	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Pfhfan32.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Beapme32.dll	Odocigqg.exe
File created	C:\Windows\SysWOW64\Fpnnia32.dll	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Imbajm32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Gbmgladp.dll	Ngpccdlj.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qddfkd32.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Acqimo32.exe
File created	C:\Windows\SysWOW64\Dmjapi32.dll	Bffkij32.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File opened for modification	C:\Windows\SysWOW64\Lljfpnjg.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Mcmabg32.exe	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Aepefb32.exe	Aglemn32.exe
File created	C:\Windows\SysWOW64\Cfmajipb.exe	Belebq32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Kbceejpf.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Kbceejpf.exe	Kpeiioac.exe
File opened for modification	C:\Windows\SysWOW64\Nphhmj32.exe	Nnjlpo32.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	Nphhmj32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pclgkb32.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Pclgkb32.exe	Pqmjog32.exe
File opened for modification	C:\Windows\SysWOW64\Cmgjgcgo.exe	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Lcnhho32.dll	Ocpgod32.exe
File created	C:\Windows\SysWOW64\Bclhhnca.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kpgfooop.exe
File opened for modification	C:\Windows\SysWOW64\Lboeaifi.exe	Llemdo32.exe
File created	C:\Windows\SysWOW64\Onliio32.dll	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bjfaeh32.exe
File opened for modification	C:\Windows\SysWOW64\Kdnidn32.exe	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
File opened for modification	C:\Windows\SysWOW64\Ldjhpl32.exe	Liddbc32.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Oncofm32.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ogkcpbam.exe
File opened for modification	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Aclpap32.exe	Anogiicl.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Eiecmmbf.dll	Ldjhpl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5684	5544	WerFault.exe	218

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfnjafap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfckahdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qddfkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfiafg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neeqea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocpgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogbipa32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pggbkagp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjhlml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdnidn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olcbmj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oncofm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pjeoglgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ognpebpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bebblb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klqcioba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfabnjjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlefklpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nilcjp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocdqjceo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajanck32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogkcpbam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfdodjhm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kikame32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Liddbc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Miemjaci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mcpnhfhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nloiakho.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffkij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpgfooop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aepefb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deokon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnneknob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nggjdc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odocigqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfdhkhjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klimip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kdeoemeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbceejpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lllcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olkhmi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ofcmfodb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ampkof32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beglgani.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpcfkm32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liddbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ochpdn32.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaeokj32.dll"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifndpaoq.dll"	Neeqea32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcnhho32.dll"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdeoemeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lboeaifi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empblm32.dll"	Nfgmjqop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnneknob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mchqfb32.dll"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfofiig.dll"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidnp32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amhpcomb.dll"	Lboeaifi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kikame32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekgcil.dll"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeobam32.dll"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anogiicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bnmcjg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1512	1496	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe	82
PID 1496 wrote to memory of 1512	1496	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe	82
PID 1496 wrote to memory of 1512	1496	d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe	82
PID 1512 wrote to memory of 4268	1512	Kdnidn32.exe	83
PID 1512 wrote to memory of 4268	1512	Kdnidn32.exe	83
PID 1512 wrote to memory of 4268	1512	Kdnidn32.exe	83
PID 4268 wrote to memory of 3444	4268	Kikame32.exe	84
PID 4268 wrote to memory of 3444	4268	Kikame32.exe	84
PID 4268 wrote to memory of 3444	4268	Kikame32.exe	84
PID 3444 wrote to memory of 712	3444	Klimip32.exe	85
PID 3444 wrote to memory of 712	3444	Klimip32.exe	85
PID 3444 wrote to memory of 712	3444	Klimip32.exe	85
PID 712 wrote to memory of 1032	712	Kpeiioac.exe	86
PID 712 wrote to memory of 1032	712	Kpeiioac.exe	86
PID 712 wrote to memory of 1032	712	Kpeiioac.exe	86
PID 1032 wrote to memory of 3936	1032	Kbceejpf.exe	87
PID 1032 wrote to memory of 3936	1032	Kbceejpf.exe	87
PID 1032 wrote to memory of 3936	1032	Kbceejpf.exe	87
PID 3936 wrote to memory of 2316	3936	Kpgfooop.exe	88
PID 3936 wrote to memory of 2316	3936	Kpgfooop.exe	88
PID 3936 wrote to memory of 2316	3936	Kpgfooop.exe	88
PID 2316 wrote to memory of 3504	2316	Kbfbkj32.exe	89
PID 2316 wrote to memory of 3504	2316	Kbfbkj32.exe	89
PID 2316 wrote to memory of 3504	2316	Kbfbkj32.exe	89
PID 3504 wrote to memory of 5112	3504	Kipkhdeq.exe	90
PID 3504 wrote to memory of 5112	3504	Kipkhdeq.exe	90
PID 3504 wrote to memory of 5112	3504	Kipkhdeq.exe	90
PID 5112 wrote to memory of 2072	5112	Kdeoemeg.exe	91
PID 5112 wrote to memory of 2072	5112	Kdeoemeg.exe	91
PID 5112 wrote to memory of 2072	5112	Kdeoemeg.exe	91
PID 2072 wrote to memory of 2964	2072	Kfckahdj.exe	92
PID 2072 wrote to memory of 2964	2072	Kfckahdj.exe	92
PID 2072 wrote to memory of 2964	2072	Kfckahdj.exe	92
PID 2964 wrote to memory of 3628	2964	Klqcioba.exe	93
PID 2964 wrote to memory of 3628	2964	Klqcioba.exe	93
PID 2964 wrote to memory of 3628	2964	Klqcioba.exe	93
PID 3628 wrote to memory of 3932	3628	Kplpjn32.exe	94
PID 3628 wrote to memory of 3932	3628	Kplpjn32.exe	94
PID 3628 wrote to memory of 3932	3628	Kplpjn32.exe	94
PID 3932 wrote to memory of 4860	3932	Liddbc32.exe	95
PID 3932 wrote to memory of 4860	3932	Liddbc32.exe	95
PID 3932 wrote to memory of 4860	3932	Liddbc32.exe	95
PID 4860 wrote to memory of 3756	4860	Ldjhpl32.exe	96
PID 4860 wrote to memory of 3756	4860	Ldjhpl32.exe	96
PID 4860 wrote to memory of 3756	4860	Ldjhpl32.exe	96
PID 3756 wrote to memory of 2904	3756	Lekehdgp.exe	97
PID 3756 wrote to memory of 2904	3756	Lekehdgp.exe	97
PID 3756 wrote to memory of 2904	3756	Lekehdgp.exe	97
PID 2904 wrote to memory of 4248	2904	Llemdo32.exe	98
PID 2904 wrote to memory of 4248	2904	Llemdo32.exe	98
PID 2904 wrote to memory of 4248	2904	Llemdo32.exe	98
PID 4248 wrote to memory of 1392	4248	Lboeaifi.exe	99
PID 4248 wrote to memory of 1392	4248	Lboeaifi.exe	99
PID 4248 wrote to memory of 1392	4248	Lboeaifi.exe	99
PID 1392 wrote to memory of 4736	1392	Lpcfkm32.exe	100
PID 1392 wrote to memory of 4736	1392	Lpcfkm32.exe	100
PID 1392 wrote to memory of 4736	1392	Lpcfkm32.exe	100
PID 4736 wrote to memory of 1544	4736	Lepncd32.exe	101
PID 4736 wrote to memory of 1544	4736	Lepncd32.exe	101
PID 4736 wrote to memory of 1544	4736	Lepncd32.exe	101
PID 1544 wrote to memory of 1764	1544	Lljfpnjg.exe	102
PID 1544 wrote to memory of 1764	1544	Lljfpnjg.exe	102
PID 1544 wrote to memory of 1764	1544	Lljfpnjg.exe	102
PID 1764 wrote to memory of 2444	1764	Lgokmgjm.exe	103

C:\Users\Admin\AppData\Local\Temp\d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe
"C:\Users\Admin\AppData\Local\Temp\d57663f5d686bd8ec4aa7bfa89d631ecd04d13be29fe553bed3171cda64566dc.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\Kdnidn32.exe
  C:\Windows\system32\Kdnidn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\Kikame32.exe
    C:\Windows\system32\Kikame32.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\SysWOW64\Klimip32.exe
      C:\Windows\system32\Klimip32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:712
      - C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2444
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        24⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        25⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1868
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1916
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3668
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2508
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3588
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1384
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:668
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4568
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        50⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2812
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        53⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2332
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4712
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3864
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4504
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3772
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4932
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        68⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        69⤵
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        70⤵
        Modifies registry class
        
        PID:4864
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        71⤵
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        72⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4136
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1176
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        75⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        76⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2560
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1652
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:1164
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        82⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        83⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        85⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        86⤵
        Drops file in System32 directory
        
        PID:3332
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        87⤵
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        88⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        90⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        91⤵
        Modifies registry class
        
        PID:4688
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4828
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2144
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        97⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2588
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        101⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1196
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        103⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        104⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4020
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        105⤵
        Modifies registry class
        
        PID:3952
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        106⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        107⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:208
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4892
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        110⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        111⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        113⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        119⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        121⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        122⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        125⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        127⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        129⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        130⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1408
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        134⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        135⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5476
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        138⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 404
        139⤵
        Program crash
        
        PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5544 -ip 5544
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjclpcf.exe

Filesize
128KB

MD5
ad5e615a0912277ed8601c31bdc0280c

SHA1
8e80e82c1c017e8f28937f517bd9c121af5a6701

SHA256
9cfbbda0becf524fe827b381d55f03414aeb67d8d1d2738fc80dcac654c3e7d1

SHA512
0c191abf3256cff3cd96c20532db483c024c585a785b37d3142f312d3ffdacd1cfdaeabdbbf10a0e13260f050d24b24a174aee4fbc6d5b2d847e605a58b4e881

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
128KB

MD5
3f5f5e67b50d2a04790ff0396e3be659

SHA1
df9c7d7a88d72106b9429c5ba8f5667b18fbcd8a

SHA256
2f7507f7c098479f53d3e6fa643ef9f051347099e17b5891b07fa3937df333d6

SHA512
6a0e6489c6861a89cc651dc0623b294f9ad3130b4c264d5ba84d4d3be0602cbdfe43f221b536a01094350fc9b49919cafd7dd650d4614bd236ae16474bed4c0b

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
128KB

MD5
64cb440f9c8f5720897db0c1b90db487

SHA1
f6e8838edbbc1e593eea5e297954b8721406dce6

SHA256
7ccfa8f550acecfe4362e90ed48f28bc898d95bfa2e214e8f37396abbaefce9f

SHA512
e3b1bb29112574b2cd89426a37a37af6904014853a97fa9f665034dbfd1585981d969c42b27d63e241206980e5830df6f28aff24c0231d2ac798737a1f3fe809

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
128KB

MD5
df632442c3bb386e0e099abb9798b3e6

SHA1
cf256ef6a6ea7d1b4476246bc116eb63c80f0069

SHA256
b4848ed9b5aff46df0137bd34bab2abaeae3aa1965dc9d00b0bca9b9d768ded5

SHA512
626dfcf8de4ddee200c13a928e0ab4ab8471fc42eea49e2942f9cba5ee09a84aeb36caae8737c6dad0e13b66cfe63dd4735e2e24195799e09a3da1e322371227

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
128KB

MD5
c6b12941319815f0a12d4b5e5e70584a

SHA1
2b6fd83a4589cbcda865734025552ca042e1b2fb

SHA256
8199eef2c685ad6166de3ee15b8dae239965159f1cd8c7091d10ceae298ed0b3

SHA512
4bdfa3429f46940f35928bb89619c182b94b6eacb6fe74dcb8822d37886623afef5e2cf6ce960c9d5d9d50fb8297837fc698bbf8a232cd01242b72e6509a2a1a

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
128KB

MD5
21b307d62e7fe7937a4743818b2a47db

SHA1
5a9281630140fc834540a940e6ae81898093a0e5

SHA256
94bfaa6e312e05a34cf5c52629dbc5fb17cc2d172525d53d95edad66f6c5e522

SHA512
019e25cc4bc0c3150a3a645ef1f4a551315945803b6b4f8ae93536ce363861b5d05bb670a79e9f6bf7a4c68b56c008fe4c80cb95c1151164e916ad1ded05553d

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
128KB

MD5
c024352dda9a197a63a56ba3db053b6a

SHA1
863a561d1d52bfc827a24ea358b2794fd5728fc5

SHA256
9b34f746264ef9dd40cd619bd846d6a809a9c5af907388a1a289a15a6f3d51ca

SHA512
94e8ed068b6f13c366295508b76c7ad1a5f415d616f211950b8b5ad22eddd6bb12f255f6654013bfa8939c6b08c0dfc55f1dbd6c9476f96777f012422075bf9c

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
128KB

MD5
8e0201e7e329aa612a3bfaa1eb86ff24

SHA1
0747cfd8a2b82353c4df79bb7585168db0880dd8

SHA256
595f53de9b6ace019005610b3a328608ce3ecc8be2c4f1ef3b7c2eb09d9fa365

SHA512
0f090c2c76863a90839cb6c77112e9e3c085cf59337922709a8ddaeecb0af1a5d5dde4398f318fd3af0f4a1703ce2ba60b450cbb1ee3ee295bbb92c15f7766df

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
128KB

MD5
629bccce86c88fc8cdf478bc7649b2a5

SHA1
5747730b22adb64d6da6e19d8449e8f9ba8ded4b

SHA256
b050b3dc571c5fe4c0bcc305a9f018cdcd81648b580221900097cd6a3bfad41d

SHA512
152a0080dc85d9908dd3bf989fa8650823011dfa6ff3c4f05afda7efd872231cafd0d5d926c662c5e872e461a7e38ccf1c67ade5e926b8dc69b4f28bdf801327

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
128KB

MD5
d71b338421edd2b9ae0b33b476aaca29

SHA1
c07dd84f3e10ce7dbff7b191f65a4b89381d16da

SHA256
afb21a890c2c6c71833f1f8b2192be590420da37b36a89c6b27871dfa32c057c

SHA512
9e158026ff444b46704d78007189b8853fcca413688c176bea684aed80008357315a79adde4f9f8cac36bcfbbfcb98649ff7772ccef70527c163996538137ba1

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
64KB

MD5
8be630c47396f3b6e017f05ed04b873a

SHA1
c90fe6671ba880c9c25f67f3fef001d9a453ce15

SHA256
aeff6b07d1d0897a8393e1a2833fc472b008da89a64ad9edaf6441966ff431c8

SHA512
390207f6cdb70a44072dbda80cee9d034c3ce9a6e678b6cfc31a407cae22f7d728d18b83b57883903809d0c3e0d1885e8187f65bd9e1c5b9941103bd3abbff54

Download Submit
C:\Windows\SysWOW64\Cjbpaf32.exe

Filesize
128KB

MD5
233007e60ee12d877195af15fb173459

SHA1
803bff351272a91d27e80d940a9cf5f1e0e15ecb

SHA256
f4d01d46c14d3ff48e97bab75f3f2caa7f314b76f779fb67be61b5408138e63a

SHA512
29ae30d8b8e1d8e202a14025a7565ab5039c5e01f845473be4d3e962c610e455ff5e2a0d07b05c3eeecfac37790a98f0548e8a76dbfb16b7e92d2336794793b1

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
128KB

MD5
3f5bb8c3470dc6e443d314c71bb5a41b

SHA1
b4074b91841239b6b3e3ee28f63beb0de403217d

SHA256
2378e2adb339afb51a28841664f8796a460f043b3173375ce9b04712e3c61ba7

SHA512
29196f3a5eeefe7c6e4d2d1c15f53b6034217a2eb17dfa8c40b327cb3dc9cdb05f5d568f927ebb2f26c1a4401d2a0c07ba2d0427ab782d1962a0b14f7b507ae2

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
128KB

MD5
fd3a7f23aff291358c7ef5249c404e36

SHA1
6a1431dc86fddde14fcbe6b0f925ede515f80130

SHA256
c6d4844e560063b7b2ba5745398009862c38116fd8854a5f6863601cf75fb35b

SHA512
121951265bf62777f2011375294853e2308188cfbdd5b80314c407bbf175d33d3f7aee1130510535aa090c9512f97ccbf52fe29f9e2578e2319257b053f2dc2d

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
64KB

MD5
c05bc6541b29e27471c9ee57223b196d

SHA1
8f90ae172bd76a3487e41cbe28d4e78167e74d10

SHA256
b41db640b4eafa450274f848b91db167c5ca0bf42deb8450dc060d5b7a4f8d57

SHA512
5286dd3d17177ff1916fd64400c4406b0d9dab430e040885d8ae6eb8d5478e98c3768e134588d58f3aab5eccce739dee3f921ed8a84357f4fc3d8f91887790a2

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
128KB

MD5
187f5937d59c233c87afd908ef240f57

SHA1
7183aeeb514b0649f27cb77217332018c421d2e8

SHA256
31d16c934d2ab54ef032ed602d6fdc767f87f25f2b2edd60b3f4d6fc715dfb75

SHA512
7308604030c3c3e228545c6c3539a6f03035f6a2429fd27bb1939986f99971b2bc7f8097de819b61589d187a71baadcfc0ba4a0f663bb864f715cc7fa8410661

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
128KB

MD5
1d76b888a7877360d371aa0176d5b2ca

SHA1
05f2e6651f90922dda2d29f7545d51aef894e217

SHA256
6e259ed0eede44cb0a87e0c54201365c7a46c2fa12bb3802085f7ba3ff878d59

SHA512
a13afa7f4039fcf3b97446c05ac9baf0572688fe161ad3552d7b0e64bb6c12ab4ca5604a870f4dd5ab0483b0f051afc06e8798eb8d131c8b07d31279929641ba

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
128KB

MD5
ca23256ed41e6d0062787af5e2f0bcda

SHA1
54233105ca2c1b709a6db5dacbd14d01d2595b15

SHA256
caccb15124e0fb7006d567f4f8bc583fc658117bc8c46c8868d6fa99f9386fab

SHA512
f787efbc6e067149a5730881929207ba957565c9cd3b2a3398569d168a7835d5292059d262f6e25098599df287d0477a243c183c5f1be4d389e499f928cf5e66

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
128KB

MD5
6f95bab3bd69436640c3764b226b21cb

SHA1
eed9809efeb3edd5fc993794e3717411d33b873e

SHA256
ccf0c7f054d62a2adf24763a8ad77000505b92e24238f26c0594de4ed4b70e6f

SHA512
04ced14fe1329ade9183a296b15726efb8d88d50a57330dfa4541d617a14a7c0b00bf8423f18f28f50bb9f5df3736ece0b1e531409513eaf9c91978d4002d2d6

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
128KB

MD5
723a0ed6c05e93a8b718a86511ddec74

SHA1
94ba9caf0b8474c682dd2d882160f8a81a5a8a52

SHA256
fddbf3870dd1dbf712282e5b108df5b1deeb06f9256d131fea71eac85f834a61

SHA512
ecf711b1113d30a1262a617e8f5e14df711067f52d7052d3f7fa01a73f1175951c2dfb469c321453f4eaefd4010d3b6336efaba18b38d7ad0eb069ca2a286563

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
128KB

MD5
69742249b262886db0e07881a80254bd

SHA1
a0dd23a2cd976a09e805093f0e9c6ffdc710f4e9

SHA256
b9b5f85e5987ef29f69b76ea572d617704acc6cc4704c281da5d3d94914472a5

SHA512
98ef438f9a673e2a6f98b819ba121851e7caa9dfa41128ff7b0aacf9821c772b78d33e9472c7aa32d80abbc62ebd51a925af804ed91f1b59107fc6d27d08fd51

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
128KB

MD5
8df67376268be9936176ac2977374c8c

SHA1
a388c4719f6927e78b7974dce0a168e1c288806c

SHA256
47d2dd19705ca3b6b849bbbe4d52020ced7b6bef0b3dbe8336f9a80542b42cb4

SHA512
b6ff2cf169e9a6a70a6ca70f0f2d33363a40a9a90b9d726d4b1744af92009b25d3c4790aef3f94515e3d1a264d56c4f334ca0a1546e71ed13a4a0f0c6fa72aa7

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
128KB

MD5
da586b543b073369263a6c05761e5b4c

SHA1
52451516fbd78ca0e7d44af99c820daa5d14a2de

SHA256
60a5b6e15a4fc96115db75d93011a7805782819d1f6eda7b87e50a5c3b3faa4d

SHA512
520a1cb6e95e240cc2c62fd6c731262daed1e726dc3baa6b0b22305b0b641bcbc634b2815729cbb80776225ed9a38c8ad437c110545f5240a2d196667bef7226

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
64KB

MD5
94aa82e89c42286f03aa742194913793

SHA1
c96d7b494d4eed7db6f0a948b22735a764c57311

SHA256
119fef34c1291b6d3cd76d65c60edb817158adced00c7f4c6b1234ea35ebf340

SHA512
a789467886fbb4b4928be2cb539febbe40a79e4cb25c56954f6b131198217c90a5853143f6bddf580cb55e9d65cfe41ef12de5329ff77b86f1144a14c909f790

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
128KB

MD5
853a927e87dd30fd8ca098f0b0a9d59d

SHA1
b90672518d20bae628d05e6d534de94ec12cd625

SHA256
9f7e5789c3afd6341ead12609bf70995d78b0189c0df97ebdd0b361c70e01060

SHA512
7914d6debc3a485d47407f81e75835a7511ef719c4cbac907e0db67e39731491c8d6e4aa0728948cbc20dc824c12cfb989a4dcadb646835d35878676e431058e

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
128KB

MD5
8151008be0cb293824d12f5c52e9cf86

SHA1
3d084bb5494e9a8d57f9306783939a1506725ba9

SHA256
8406fc017d4221f1f59da012d5a8a28401c5a44ff6b173c5f521b9acc61e8873

SHA512
75119bb83c53fe3672041c4a3623663ec17fda2c3e4c6d6327705ae08c3b2bce86341aae4786920296a40a1c96bc300657b5c947c777125ce740e6dc0a5a3aed

Download Submit
C:\Windows\SysWOW64\Klqcioba.exe

Filesize
128KB

MD5
3af9ffee158140f858de17d163a99571

SHA1
dce954fdb880c0983a3aad6b9f73a9dfa53496ba

SHA256
d9b4d3ed168c8b6dc10d15e0207a78f9e4583fef6b6906329bec2c0acd07b296

SHA512
634b3c7da8d4ba7d047d768c9f29c28acb72f725b92daa34f542d0e1fd8d6b7c7a85000ea81e5d76bc05e3905457cc904577280f6c1317bd37ad43c0fc85c29e

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
128KB

MD5
31ab6371e672da3d603f6605fb38d313

SHA1
d03fd41f9733d41508de5d5ff6b7a5fd6c36d828

SHA256
c62e7bfc9a98feb489485beeca2f8e5efb2e0435ccdbe8efb951eec5a87ccd78

SHA512
13b1cc7f84da5a51401b9555c132d945aa23c3b2a22894661343f775867fc03852211194489d4bb4bbf39ec7022e9fc5afbc0784bc698b2e3a75f1f18d6258af

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
128KB

MD5
c1481b6bd1a5d7f7084a70315ca630fe

SHA1
95cba1f89e2e1d32c6e2dcf78a3a8989b2b89933

SHA256
7d601896869befa044a73e95b26ca25f92f331864cac95eef672ba360f2d6965

SHA512
c40cf5849e852b4f6cb660469afc3092017be96e7dd74b207f3fd6cc8d4e245e90488383c5d5cd1ddf79af12e2085aef407b4e8a8f21a50b70764646dc2420f7

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
128KB

MD5
1352687b478b66a8831bf00106a82205

SHA1
7995bfc8fdf9c16f3f6dab6f2cb429c911644b1b

SHA256
f84b99afd7d709e0fb85d7c4bedf9597ca6cddd35495759857dc2c6b90e5cf5f

SHA512
0c9f4569d6fdf91d2eac9b7a7bfb8cf8d83c662556ff4ec41113b9edc7bcb98aeae4a3c40023737270d1e22d711d4da215e811156113a784ebbd3fc0fcc00741

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
128KB

MD5
cd68709c949ba114416879d1b8b71328

SHA1
7196f1cae2bebea8d25e6063980b7c60fd39defc

SHA256
3748ef1d1b6f620b2542ba81f679117d4fead3311cbda5fc65992bd7d9be13f1

SHA512
d293f15246bd147f93dd227504772f60da57652d6154210c4763d420c866dcfe1b2e37e3d4bd0a72ced371ddfa365d45f75f0114e4fb0fd99b58165754cddd51

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
128KB

MD5
f827eec0f236d2e0f1bce89db9035a4d

SHA1
35dc36fd91a7056d15cc890ed44942ccc82f5fec

SHA256
ee37b2e0cfa863b07348d49ce5aed390df00562dfd337debb87f39ade32fac7d

SHA512
710e78c0b33affdb08f457cef1c8749c117b67bd2b85f141bfedfc3930e71e24f1b4d2977266d4f372214a7f0871498a6d896d03bc430a6a53af9d7e6534d804

Download Submit
C:\Windows\SysWOW64\Lekehdgp.exe

Filesize
128KB

MD5
820944d5fe054cea47f4e69fc04c5101

SHA1
e67d9890bbdf63a8add6a07c82fe9d24503baf15

SHA256
ef8c9ac9292d7dbf28d3094a2f15b78b60e6314649e5d22d32821d7e5ffc3637

SHA512
367a5da95b0c118b81939654902907911386926afc30d2956d76d1370e03bf752f6ce2e9b7ec43e5568502161c93502a2b9cf321d643a4b6efcda63acf45d936

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
128KB

MD5
3c5068ed64e4036ad5c4ed09cf75e197

SHA1
8aefaddf2e9b656fdc180e5ec15c5341558762e9

SHA256
523e5ada729fc483ff64948b944a89d6f560bce1bac4cfdd8dcb9bc8b13d27d0

SHA512
d75674f4a732e9dba93a17fe29d616d8a1454d3595058cc9f142660dc655e7f5fa787917a6ca6b223af046d128f42fd703e8a7f58362b183e9c51f9c4c005b45

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
128KB

MD5
dc29492c38ed8fb2aa491585579a880e

SHA1
e5033480fa2b577679024e7db6d9eb7f821a56bf

SHA256
7bf26c6ba46ce8e3c34c13e207dbe3bd0f64bb0243e115e42b95b954c971ad7b

SHA512
1e67c9c22d6d743aaf11c4f36f465f15f17f15e53d052a59853d413772731803bcb84950b87f867ce01280214b14e580b08de42cb504ee43602de26d88672c07

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
128KB

MD5
0dfa57c2278c7c56c3f0027d8b9e9d55

SHA1
f8df7f5d51f86e4682df665b7a3e88f477134a44

SHA256
4d20a0e87b0a66247e832088b84659e21fb0275a0caed6f17fa1d1ee41a2f6d4

SHA512
30018c20476cd4cca1b73d7d78aad9b6f8e04523b57c486391c46cda12984467782b0c78344d9c84efb8fdd07dae71dbfd39206c4f6da3cf56736c996b26dd52

Download Submit
C:\Windows\SysWOW64\Llemdo32.exe

Filesize
128KB

MD5
a869fd5dbcf1d7c89e58978dcd10f91b

SHA1
2944f08771e6ef6a38a6a716d4551287c5bfc99b

SHA256
bee252c52bf5e26e8e21a5b87b1d65c336adce4a373f3d8069ddd34824e204c6

SHA512
70850ef02ccaa79daa038a0eb2cce694edb6b44a005c66a0f9d40d6ca62cad03981dc1afe0ce42ce2fb4e90ff73c038a43a5fc36dd6f07f3cbf03170364b50cf

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
128KB

MD5
9d9dd7297592f837bd53b8f1b1378672

SHA1
e1f73b25de81e035cc59572e66826a51af701d92

SHA256
1ab085990431d37823c1c765d0868c92b1f4de3bc6f0bbb0ca71241cbf192071

SHA512
2c6dadbf20c6374a4e0648361df554fbc67c5c01cf726dc365fcf6a5a2e5fe3300d8bd692734be609b952525fd955c58592fb6e431a98aa28ea70111fec0458e

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
128KB

MD5
fcbea7903c95352b22a73aebca36f0b8

SHA1
28394e556662f2f24a1558ee8c1998375cebd035

SHA256
9251542372323bdc5342af17de001e49eeeb4dffa5b3a5cc55d5e39eacf07516

SHA512
6407c5fbdebf5ccf4255470127ab20251718c5de389bcc52ad29c81842b8798836157120c690998ff14655699667c68fed35fcf9c03570402e204f22a138ce3a

Download Submit
C:\Windows\SysWOW64\Lpcfkm32.exe

Filesize
128KB

MD5
c392f82c58a41d56458b36e1f190ecb7

SHA1
0dbe48fb0483e70ce5247357a355640ef74dc1bb

SHA256
46d37fcebde38a4c0d6f2f972549f74893a20f6a62dc0b5a5a1ed59ad7f2f744

SHA512
1498c191a4db80ba0d700357dce3e52f81e11c3ebf55018867a8038759cc93ee73741594733cf3bd231a6431415f77e13d7d8c6ba50b6417976d1e97ca03b14e

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
128KB

MD5
31059dd0de160b81f1372f212dafeef2

SHA1
5adc1a32a0fd0b718616c1353d3b06c0a6daa331

SHA256
55d52f2c00a23599b5b600b586d062ddeeb04aa2d1be3fa98abac1ae8e0e3957

SHA512
1adf8d75bee2b5268d1f3132d5ed9c7d00ccc86c892cc43876d1166ad5cc987b4033a9f4a7e4d978096555798546a725b85c880ffe749c6c7158e5dd4b495763

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
128KB

MD5
585445ab644c0363490a4c4c9ee5391b

SHA1
917c2b02762cdf65515780ef349500e4fa4e3039

SHA256
0db2b058f7cb63616103a081f1bf37c59b5f99b38f8b273fb8d8e14f43de7f49

SHA512
703acaaecbd70ffe9b29c0f42c6fa70332fc2d2c13e04221b4a6a3f9d96202183be61261b2e306ead26c0f34cf6a4dc94fdb9a3ccc1fce4f2de7776b6fb21d55

Download Submit
C:\Windows\SysWOW64\Mcpnhfhf.exe

Filesize
128KB

MD5
4c3483b3477264e2359eda5e5b5628c4

SHA1
70e0c815166c247a1359d8561de07b5414d1fb7f

SHA256
24a3384cb2c739bb3e53cce81731600ee8cec19f2adc09a3fc909193f48a0dab

SHA512
8547d44a035a46cb042ab58bc7ded727dbd64ba93353793efa2ce10c9a3ffaa66fab84eff19402ec69b427bce0028cd4efe392c4dde6a6c610f2753da0abc901

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
128KB

MD5
e782e8b1ccbeef16839d86dbca4353e0

SHA1
4ee6fe950c94180401f8c7e08321340bc81e5b33

SHA256
b931f82bb9734191d57a5f217d030885f7689104b9314dfb50308966687ae8fd

SHA512
d544bb8645fc335ed9308aa5838750645ec835923f9ca7a393b287475f05e01ecc9f6e931706c4e6f70087022c22eb34e529658230d811c74a0c97931390d151

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
128KB

MD5
c92603e4b94b79ca81162b82e848dc27

SHA1
9c05c6021cb6c19c1eb0b562ea503e6c93ecd6a2

SHA256
fb653d4605bb3040db572c1557115e5f59b6bdb57a97c1eb90e56a7a85e5f576

SHA512
d569eb7bb34b8f4cb92fc344191483f7e43472ec984ac19540552b3734d71f46d6cc21c3d72ff23eef99e3a170098c4b35544f6ba3ea5d65df7746d11c0aad2b

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
128KB

MD5
0216bc8cf3098fc046fed81121f3546e

SHA1
7dca88ec571adc81950b25f84a7c387a50bc92a8

SHA256
92ad37b6eece272bef2f620474172bebe9f953a54ac0b076c39211323de97b24

SHA512
d545ec14c144663958ceb870ddc8a4dce8ebec269df2fcb632b04a3a99514593a97fc1e77525e72f420f5038abe11afb317d4c43ad3c9f6ce2a4a3ccd19d2a5a

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
128KB

MD5
59a40a518bffdcbf39c16def4c89020b

SHA1
a76282f7d3e575ea4a0eb54463bcf43136144bc2

SHA256
e374b7d4d80c9766d547b1d3f4cfcaeef1913ee84d36708c44b98ed46de85e72

SHA512
e56c5be8927bb4e8476ea1e3aede1d78951bcbc5c826ed1a4c1283b5cebe1404bc71dfa12c0180cc5beb5851ccfd93616f11267dcb4bc3c9f55574b477405c7d

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
128KB

MD5
dcab6edb990b1bf578725bd4cc01e4a8

SHA1
e0dc1521c50108dc23343235fd16da1f44f2673e

SHA256
db22e7c72aeb598ed0699a4971fbc3b5ff1ba09fcfbd163cd93a9fa325a423d1

SHA512
810a9ed91bc74744fe8da404a40d3962d8daad1a4e6afd78749c9c5ddf5b757f89b6d74865cde65f075b180d682466f20124af918f5275ac6f9a7582a45e403f

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
128KB

MD5
244fdf89e1ad56e86d2e7313a7d4daf9

SHA1
f726f281344123fc8d618e24c6ebce000a8db9bf

SHA256
1e96b1ba31b6a338a0fe123b9981d99482ce4825b034b05a32aaa716ad59be8b

SHA512
f8bcd69113aeeda2fc24077e86bf03026351517812714acc8d9f57e71c687d5e93fc2ad8094eacea142a3ffef58e29aa4e839d84b70e3e1e847f70e4ac1def15

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
128KB

MD5
12ba949deb8874026362f30c99823ff1

SHA1
fe43ca2df6a00a198b440586b364e8d875644bce

SHA256
752d48b5e3da01c559da401c7dca53a92667c71d296539a47acfcc42b7aeaf22

SHA512
5418da2f33da082c886cdd4e5a2b76af7ee66fbc45685766b8210062022cf20419627195f1b74e58314736afdc57775732079b530e3765c2dcf676998e6ade62

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
128KB

MD5
1169d34e8bf516ae2b869ee510783e43

SHA1
730d2098b1c8df7890b7b658f5739dde70b4ccc3

SHA256
0c4452f3f2538460d9926349ea6f0bc36f9c4f7aafacdf8739fb856190245cb2

SHA512
2da6626fdac4e2e312eed95b55c700842e81f0c23db8104a77a83843fe2effadb3147d9391e7c98c6c5d0c10e29b39bf2c6e8785ca3fc286f9f11328e027f1ae

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
128KB

MD5
32abe033dfc8f8dcb15ff37a0f562fd5

SHA1
b0a482c415dd7b18c30f7d3c65a3c308b131e871

SHA256
9eaf17297466503608b0546c277f0761b7ea9e4f8f4ecc76a43b316715182c22

SHA512
ab817067509adb02e276bfb7e7a6698846836ea9c6580a0206bd756907fb567585083b7f92bca2f9370e90c4afc55fafe65570d4e46ac11be1a25abad83d7410

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
128KB

MD5
20134eb51c81c53816a49b085a6ceb54

SHA1
28306c47ca1552a3e7c86bb1417df9e688b4b8c2

SHA256
0366a8b58fb800dcf74898f551c5a9723ff03b9a8a315581b2df64494ce8b6f0

SHA512
03312fe396d3f9101bf71ba9e3f646b6b33a9cf39416de04cd4e5ad89894d9d743cc6a187d7f5d1fa184907089f1a5decfd0a9e32b307cd0f6bad6a1af68ed61

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
128KB

MD5
7431ebb546177c704210c50754377006

SHA1
0c98227714a8f2e018364e686a73d350ef422f90

SHA256
be39388351e8baa15d3fdc222e7a16b64d9dd8dad8940259030d39b0ce0f58c8

SHA512
70ba0b4d0ac0c4eed07016834511698fda36dc01f425595279a5ab63a1655f220e56db0d57fb46898426c1b930717d9fd85dfc56e1913bf144e590a54a8e566c

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
128KB

MD5
8850a2bc3c5cafd8057cb0651af58c69

SHA1
60a25b46809c1043f39aaedb017791bda2fae87c

SHA256
13dd3b405fe6bc3a8ff6b62f21c8389c2c43d8bdba090fbcc2f5848178a1d8fe

SHA512
ae260d76801af7cc9728b49a5c806608d6e8c0314fcba8637be4a8ec53f0d464a489b3f8b0d489ebc1b9ff716717fee56ab1dec73f5ce99119e64e89bff69b59

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
128KB

MD5
32a806f6096aa878a3b0bc9831a49a86

SHA1
faa9f033b9eec75aaa73cc0b309a90d9e311211c

SHA256
a81c48ce77a326f3ec8852393bcdaa98e40fc37f475956d0226454f5e64ac737

SHA512
3bcc1752ae32b5c59942e1a06633c75b4b4b6a5c8dfb702bbf4dfd69679393664f01686f646941bf9d9c1b563bc5fe8a18790f1e239c3c07fc59209af87d32b6

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
128KB

MD5
7cd70973e172932a14fb6ddf6e215c76

SHA1
0f0ed63c403202e55da280c9177c2bf930dcd978

SHA256
41f0ccd5b5a72b64c79362ab048d2c80571a9b2b67e661895dafa8d68a264139

SHA512
141956c4e861d4cee14863edcb3231ad5c6bbd4208e89964636a9cf72e8f6e1603389957e508cf4064d1f014485e38bfb915eab698723e8d6111aa185726bb27

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
128KB

MD5
6ebec28990f9b81845f64f39ecd215e9

SHA1
06a7a246517efdac756773c628e81f19ce4d986d

SHA256
83cae2ed71b8f51246709789956d56fb6d37da0676a8562cd675b95b7d27b17f

SHA512
4abb3ac3bebe9fd0ba8c893b1dad3e220e118d82e5617e4afb9ec5569d454b4166860ae8cc181eab9aeb2e952f6a20021ef39083de5a8cc536fa9ff38fe8df65

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
128KB

MD5
539c3763148143338cdbb7a5ebb47043

SHA1
cbbe76f06a9d621872ba06185b78a010eb008b1b

SHA256
8040c1ca19ad54222ee5dd934f36be70a80ab57d4cc7fa8ae80368d403cdcadf

SHA512
b8e97d37e0a6f86a235c23a4882293abc9e479edf705e3728fc3494a42f685ac64327a25e6b6b87808eb139210fc5bc0eb9dc2cd9d18e311936a6e4de5199f27

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
128KB

MD5
5eca76cf0e7623ce5d3273d3568a433e

SHA1
26a8073aa10e409d8dd9e3d4a54e2bccf1aaeacb

SHA256
6ba2cb55a618900131d41d78f1be8253f2096fd90005bbc753c349736b2bbc09

SHA512
e917dc3e04dfdd64e15883b62aa605f649418efcab8dc236d312046df37b902c15e0a897d25e07e9124fe9578654c3e674925038862d9e047c6c8c900fc48aa3

Download Submit
memory/220-382-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/228-430-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/636-346-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/668-328-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/712-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/712-571-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/740-286-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1032-578-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1032-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1072-586-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1116-552-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1164-545-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1176-502-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1384-316-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1392-143-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1412-400-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1456-593-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1464-223-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1496-0-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1496-544-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1512-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1512-551-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1520-183-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1544-159-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1604-508-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1652-538-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1764-167-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1828-239-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1868-207-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1916-215-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1956-376-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2072-79-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2124-334-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2140-448-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2212-192-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2316-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2316-592-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2332-394-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2340-340-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2388-436-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2444-175-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2508-262-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2560-520-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2792-565-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2812-370-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2904-133-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2964-93-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3056-390-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3076-572-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3104-268-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3168-322-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3228-466-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3332-579-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3380-310-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3444-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3444-564-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3480-484-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3504-599-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3504-63-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3580-460-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3588-280-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3628-96-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3668-231-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3756-119-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3772-442-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3844-490-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3864-412-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3872-200-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3924-532-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3932-103-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3936-585-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3936-47-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/3948-530-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4016-362-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4056-255-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4136-496-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4248-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4268-20-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4336-562-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4348-274-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4372-247-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4400-304-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4504-424-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4512-418-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4564-292-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4568-352-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4712-406-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4736-152-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4848-364-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4860-111-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4864-478-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4888-298-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4896-473-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4932-454-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5020-514-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/5112-71-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads