berbew | 916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684a

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe
Size

128KB
MD5

d8b2335b59b2d9c5dd1b3216860d73a0
SHA1

412b3302697df150092ffb9529e436af16dde5af
SHA256

916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684a
SHA512

db67f2c6838c1b7330f1e74aed97cc40db6e72640c887d7c852d4e351813bd578e2ef5f3466eb7a7be517662c3438de508edfc5a7893bf3ab4f8b36b0da2bd98
SSDEEP

3072:4UZVUV992nIgBfhiYTf1hed4WkWs6FEYtdZCwGtLItkiXOBSLhoMrdGB8rVl:T/i9jghcYTd06DX4EYtCwGtMtkiXOolV

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqbpojnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmodajm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiogdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecjke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hejqldci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnmaea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnonkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gghdaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iamamcop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Monjjgkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fkjmlaac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dojqjdbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kibeoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adkqoohc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgohf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llnnmhfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lplfcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmbjcljl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpfcfmlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekajec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gnnccl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpeiie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iondqhpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnhmnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geanfelc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmblagmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnkbkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bklomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqklkbbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Foapaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inebjihf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhgkgijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdialdl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gejhef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpapnfhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gijmad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hejqldci.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
2216	Mjodla32.exe
4548	Mokmdh32.exe
4568	Mjaabq32.exe
840	Monjjgkb.exe
4908	Mfhbga32.exe
5148	Nmbjcljl.exe
4816	Nopfpgip.exe
2432	Nfjola32.exe
5352	Nnafno32.exe
5520	Npbceggm.exe
5244	Nflkbanj.exe
4188	Nqbpojnp.exe
5024	Nglhld32.exe
1684	Nmipdk32.exe
6092	Nfaemp32.exe
2236	Nnhmnn32.exe
4960	Npiiffqe.exe
4688	Ojomcopk.exe
1584	Oaifpi32.exe
4252	Onmfimga.exe
1404	Ocjoadei.exe
1156	Onocomdo.exe
552	Oghghb32.exe
1336	Opclldhj.exe
5652	Ondljl32.exe
3936	Pfoann32.exe
2280	Pccahbmn.exe
1220	Pnifekmd.exe
6016	Ppjbmc32.exe
1756	Pfdjinjo.exe
1068	Pnkbkk32.exe
1820	Paiogf32.exe
5236	Pffgom32.exe
5720	Pnmopk32.exe
5356	Pdjgha32.exe
4292	Pmblagmf.exe
1984	Qhhpop32.exe
1944	Qfmmplad.exe
832	Qpeahb32.exe
1192	Aogbfi32.exe
2808	Adcjop32.exe
640	Aoioli32.exe
1184	Aagkhd32.exe
228	Agdcpkll.exe
1808	Apmhiq32.exe
5980	Aggpfkjj.exe
4248	Amqhbe32.exe
5332	Adkqoohc.exe
1008	Agimkk32.exe
2464	Apaadpng.exe
1348	Bhhiemoj.exe
1952	Bobabg32.exe
4852	Baannc32.exe
1972	Bgnffj32.exe
4800	Boenhgdd.exe
1680	Bacjdbch.exe
5756	Bhmbqm32.exe
6024	Bklomh32.exe
2984	Baegibae.exe
2032	Bddcenpi.exe
5048	Bknlbhhe.exe
2428	Bnlhncgi.exe
4776	Bpkdjofm.exe
3116	Boldhf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mokfja32.exe	Mlljnf32.exe
File created	C:\Windows\SysWOW64\Pnmopk32.exe	Pffgom32.exe
File created	C:\Windows\SysWOW64\Pncepolj.dll	Gijmad32.exe
File created	C:\Windows\SysWOW64\Onogcg32.dll	Kekbjo32.exe
File created	C:\Windows\SysWOW64\Mokfja32.exe	Mlljnf32.exe
File created	C:\Windows\SysWOW64\Fnihkq32.dll	Mokmdh32.exe
File opened for modification	C:\Windows\SysWOW64\Oaifpi32.exe	Ojomcopk.exe
File opened for modification	C:\Windows\SysWOW64\Lckboblp.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Pneclb32.dll	Gbbajjlp.exe
File opened for modification	C:\Windows\SysWOW64\Koonge32.exe	Kheekkjl.exe
File opened for modification	C:\Windows\SysWOW64\Lhqefjpo.exe	Lafmjp32.exe
File opened for modification	C:\Windows\SysWOW64\Cdpcal32.exe	Ckgohf32.exe
File opened for modification	C:\Windows\SysWOW64\Dojqjdbl.exe	Dhphmj32.exe
File opened for modification	C:\Windows\SysWOW64\Nmhijd32.exe	Nfnamjhk.exe
File created	C:\Windows\SysWOW64\Nciopppp.exe	Momcpa32.exe
File created	C:\Windows\SysWOW64\Gijmad32.exe	Gbpedjnb.exe
File created	C:\Windows\SysWOW64\Ieagmcmq.exe	Ipdndloi.exe
File opened for modification	C:\Windows\SysWOW64\Ihdldn32.exe	Ibgdlg32.exe
File created	C:\Windows\SysWOW64\Fnfmbmbi.exe	Fkhpfbce.exe
File opened for modification	C:\Windows\SysWOW64\Mfenglqf.exe	Mokfja32.exe
File created	C:\Windows\SysWOW64\Pqbala32.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Hlhbih32.dll	Fkmjaa32.exe
File created	C:\Windows\SysWOW64\Gnpphljo.exe	Ggfglb32.exe
File opened for modification	C:\Windows\SysWOW64\Kcapicdj.exe	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Cnocia32.dll	Mjodla32.exe
File created	C:\Windows\SysWOW64\Jkmmde32.dll	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Ojomcopk.exe	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Bpkdjofm.exe	Bnlhncgi.exe
File created	C:\Windows\SysWOW64\Abbqppqg.dll	Kedlip32.exe
File opened for modification	C:\Windows\SysWOW64\Pififb32.exe	Pblajhje.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Npiiffqe.exe
File opened for modification	C:\Windows\SysWOW64\Gbnhoj32.exe	Gghdaa32.exe
File opened for modification	C:\Windows\SysWOW64\Kekbjo32.exe	Koajmepf.exe
File created	C:\Windows\SysWOW64\Eeeaodnk.dll	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Hjcbmgnb.dll	Nbebbk32.exe
File created	C:\Windows\SysWOW64\Cjkhnd32.dll	Obgohklm.exe
File created	C:\Windows\SysWOW64\Hejqldci.exe	Haodle32.exe
File created	C:\Windows\SysWOW64\Nfjola32.exe	Nopfpgip.exe
File created	C:\Windows\SysWOW64\Lhdbgapf.dll	Pfoann32.exe
File created	C:\Windows\SysWOW64\Ppjbmc32.exe	Pnifekmd.exe
File opened for modification	C:\Windows\SysWOW64\Edionhpn.exe	Enpfan32.exe
File opened for modification	C:\Windows\SysWOW64\Khlklj32.exe	Kabcopmg.exe
File opened for modification	C:\Windows\SysWOW64\Fkjmlaac.exe	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Oihmedma.exe	Obnehj32.exe
File created	C:\Windows\SysWOW64\Pcbkml32.exe	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Bhgbbckh.dll	Nfaemp32.exe
File opened for modification	C:\Windows\SysWOW64\Pmblagmf.exe	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Jkmjlphl.dll	Aagkhd32.exe
File opened for modification	C:\Windows\SysWOW64\Bnlhncgi.exe	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Lhqefjpo.exe	Lafmjp32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbala32.exe	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Agimkk32.exe	Adkqoohc.exe
File opened for modification	C:\Windows\SysWOW64\Gejhef32.exe	Gnpphljo.exe
File created	C:\Windows\SysWOW64\Ipdndloi.exe	Ihmfco32.exe
File created	C:\Windows\SysWOW64\Pnifekmd.exe	Pccahbmn.exe
File opened for modification	C:\Windows\SysWOW64\Dnonkq32.exe	Dhbebj32.exe
File created	C:\Windows\SysWOW64\Haodle32.exe	Hbldphde.exe
File created	C:\Windows\SysWOW64\Inebjihf.exe	Ihkjno32.exe
File created	C:\Windows\SysWOW64\Flmlag32.dll	Jaonbc32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nnhmnn32.exe
File opened for modification	C:\Windows\SysWOW64\Lhenai32.exe	Ljbnfleo.exe
File created	C:\Windows\SysWOW64\Hpaoan32.dll	Fajbjh32.exe
File opened for modification	C:\Windows\SysWOW64\Boldhf32.exe	Bpkdjofm.exe
File opened for modification	C:\Windows\SysWOW64\Hbihjifh.exe	Hlppno32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7652	7420	WerFault.exe	346

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjodla32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfoann32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ipdndloi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfdjinjo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhbebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eqiibjlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcclncbh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lhqefjpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oiagde32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bgnffj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jppnpjel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keifdpif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpiqfima.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doagjc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mablfnne.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddifgk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Egcaod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oqhoeb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnmopk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ehlhih32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gbpedjnb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkhgod32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Edgbii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kiphjo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klbnajqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nmhijd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocjoadei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggpfkjj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chdialdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ocihgnam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oghghb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Klekfinp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nckkfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lplfcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bacjdbch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bknlbhhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ggfglb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nflkbanj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opclldhj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpbjkn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hlmchoan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lcfidb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mhldbh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqbala32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iijfhbhl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kcapicdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpepbgbd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adcjop32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baegibae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mbdiknlb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jemfhacc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pplhhm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amqhbe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ieccbbkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilnlom32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpgdai32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbhmbdle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nhhdnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mfhbga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cammjakm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cpfcfmlp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hejqldci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Khlklj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hecjke32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Joekag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhphmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Enpfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gghdaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kibeoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieoigp32.dll"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkcndeen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilpfgkh.dll"	Dojqjdbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Coqncejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Klbnajqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gggikgqe.dll"	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iacngdgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcdihk32.dll"	Fqbliicp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfojfj32.dll"	Hbihjifh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oifoah32.dll"	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iafphi32.dll"	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ehlhih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eciqfjec.dll"	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Joekag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Inebjihf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fajbjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkpbai32.dll"	Hejqldci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lhqefjpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjkhnd32.dll"	Obgohklm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll"	Oqoefand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kedlip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jklliiom.dll"	Ipgkjlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfmlqhcc.dll"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldgkp32.dll"	Kpccmhdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbebbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhbih32.dll"	Fkmjaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgmbbe32.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fllhjc32.dll"	Obqanjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Paiogf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pffgom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bacjdbch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nohjfifo.dll"	Pplhhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pplhhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjliff32.dll"	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baampdgc.dll"	Fecadghc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Keifdpif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chgnfq32.dll"	Lafmjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkfmmb32.dll"	Nqmojd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 2216	3172	916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe	82
PID 3172 wrote to memory of 2216	3172	916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe	82
PID 3172 wrote to memory of 2216	3172	916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe	82
PID 2216 wrote to memory of 4548	2216	Mjodla32.exe	83
PID 2216 wrote to memory of 4548	2216	Mjodla32.exe	83
PID 2216 wrote to memory of 4548	2216	Mjodla32.exe	83
PID 4548 wrote to memory of 4568	4548	Mokmdh32.exe	84
PID 4548 wrote to memory of 4568	4548	Mokmdh32.exe	84
PID 4548 wrote to memory of 4568	4548	Mokmdh32.exe	84
PID 4568 wrote to memory of 840	4568	Mjaabq32.exe	85
PID 4568 wrote to memory of 840	4568	Mjaabq32.exe	85
PID 4568 wrote to memory of 840	4568	Mjaabq32.exe	85
PID 840 wrote to memory of 4908	840	Monjjgkb.exe	86
PID 840 wrote to memory of 4908	840	Monjjgkb.exe	86
PID 840 wrote to memory of 4908	840	Monjjgkb.exe	86
PID 4908 wrote to memory of 5148	4908	Mfhbga32.exe	87
PID 4908 wrote to memory of 5148	4908	Mfhbga32.exe	87
PID 4908 wrote to memory of 5148	4908	Mfhbga32.exe	87
PID 5148 wrote to memory of 4816	5148	Nmbjcljl.exe	88
PID 5148 wrote to memory of 4816	5148	Nmbjcljl.exe	88
PID 5148 wrote to memory of 4816	5148	Nmbjcljl.exe	88
PID 4816 wrote to memory of 2432	4816	Nopfpgip.exe	89
PID 4816 wrote to memory of 2432	4816	Nopfpgip.exe	89
PID 4816 wrote to memory of 2432	4816	Nopfpgip.exe	89
PID 2432 wrote to memory of 5352	2432	Nfjola32.exe	90
PID 2432 wrote to memory of 5352	2432	Nfjola32.exe	90
PID 2432 wrote to memory of 5352	2432	Nfjola32.exe	90
PID 5352 wrote to memory of 5520	5352	Nnafno32.exe	91
PID 5352 wrote to memory of 5520	5352	Nnafno32.exe	91
PID 5352 wrote to memory of 5520	5352	Nnafno32.exe	91
PID 5520 wrote to memory of 5244	5520	Npbceggm.exe	92
PID 5520 wrote to memory of 5244	5520	Npbceggm.exe	92
PID 5520 wrote to memory of 5244	5520	Npbceggm.exe	92
PID 5244 wrote to memory of 4188	5244	Nflkbanj.exe	93
PID 5244 wrote to memory of 4188	5244	Nflkbanj.exe	93
PID 5244 wrote to memory of 4188	5244	Nflkbanj.exe	93
PID 4188 wrote to memory of 5024	4188	Nqbpojnp.exe	94
PID 4188 wrote to memory of 5024	4188	Nqbpojnp.exe	94
PID 4188 wrote to memory of 5024	4188	Nqbpojnp.exe	94
PID 5024 wrote to memory of 1684	5024	Nglhld32.exe	95
PID 5024 wrote to memory of 1684	5024	Nglhld32.exe	95
PID 5024 wrote to memory of 1684	5024	Nglhld32.exe	95
PID 1684 wrote to memory of 6092	1684	Nmipdk32.exe	96
PID 1684 wrote to memory of 6092	1684	Nmipdk32.exe	96
PID 1684 wrote to memory of 6092	1684	Nmipdk32.exe	96
PID 6092 wrote to memory of 2236	6092	Nfaemp32.exe	97
PID 6092 wrote to memory of 2236	6092	Nfaemp32.exe	97
PID 6092 wrote to memory of 2236	6092	Nfaemp32.exe	97
PID 2236 wrote to memory of 4960	2236	Nnhmnn32.exe	98
PID 2236 wrote to memory of 4960	2236	Nnhmnn32.exe	98
PID 2236 wrote to memory of 4960	2236	Nnhmnn32.exe	98
PID 4960 wrote to memory of 4688	4960	Npiiffqe.exe	99
PID 4960 wrote to memory of 4688	4960	Npiiffqe.exe	99
PID 4960 wrote to memory of 4688	4960	Npiiffqe.exe	99
PID 4688 wrote to memory of 1584	4688	Ojomcopk.exe	100
PID 4688 wrote to memory of 1584	4688	Ojomcopk.exe	100
PID 4688 wrote to memory of 1584	4688	Ojomcopk.exe	100
PID 1584 wrote to memory of 4252	1584	Oaifpi32.exe	101
PID 1584 wrote to memory of 4252	1584	Oaifpi32.exe	101
PID 1584 wrote to memory of 4252	1584	Oaifpi32.exe	101
PID 4252 wrote to memory of 1404	4252	Onmfimga.exe	102
PID 4252 wrote to memory of 1404	4252	Onmfimga.exe	102
PID 4252 wrote to memory of 1404	4252	Onmfimga.exe	102
PID 1404 wrote to memory of 1156	1404	Ocjoadei.exe	103

C:\Users\Admin\AppData\Local\Temp\916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe
"C:\Users\Admin\AppData\Local\Temp\916abb0aad1fb82611512b41f51057a6da33a39d4456913a4a84f863cf17684aN.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\Mjodla32.exe
  C:\Windows\system32\Mjodla32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\Mokmdh32.exe
    C:\Windows\system32\Mokmdh32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\SysWOW64\Mjaabq32.exe
      C:\Windows\system32\Mjaabq32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5148
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5520
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5244
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6092
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        23⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        24⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:552
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        26⤵
        Executes dropped EXE
        
        PID:5652
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3936
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1756
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        35⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        38⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1944
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        40⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        41⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2808
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        43⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        46⤵
        Executes dropped EXE
        
        PID:1808
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5980
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        48⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        50⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        51⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        52⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        53⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        55⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1972
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        56⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        58⤵
        Executes dropped EXE
        
        PID:5756
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:6024
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2032
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2428
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4776
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        65⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        67⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        68⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        69⤵
        System Location Discovery: System Language Discovery
        
        PID:3972
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        71⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5000
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        73⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        74⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1568
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3524
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        78⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:872
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        81⤵
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3268
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        83⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        85⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        87⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        88⤵
        Modifies registry class
        
        PID:1640
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        89⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        90⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2492
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        92⤵
        System Location Discovery: System Language Discovery
        
        PID:348
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        93⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        94⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3156
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:576
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        97⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        98⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        99⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        102⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        103⤵
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        104⤵
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5424
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        106⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        107⤵
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        110⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4804
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        112⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        113⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1196
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        114⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        117⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        118⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        119⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        120⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:456
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        122⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        123⤵
        Drops file in System32 directory
        
        PID:3176
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        125⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        126⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        128⤵
        System Location Discovery: System Language Discovery
        
        PID:1148
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        129⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        130⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        131⤵
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        132⤵
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        133⤵
        Modifies registry class
        
        PID:3344
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        134⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        135⤵
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        136⤵
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        138⤵
        Modifies registry class
        
        PID:452
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        139⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        140⤵
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3532
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        142⤵
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        143⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3960
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        145⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:220
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        146⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        147⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        148⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        150⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        152⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1648
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1020
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        155⤵
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        156⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        157⤵
        Drops file in System32 directory
        
        PID:3296
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        158⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2500
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:208
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        163⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        164⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        165⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        166⤵
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        167⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        169⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6488
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        171⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        177⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        178⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        179⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        180⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        181⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        183⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        185⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        187⤵
        System Location Discovery: System Language Discovery
        
        PID:6164
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        188⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        189⤵
        System Location Discovery: System Language Discovery
        
        PID:6368
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        192⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        193⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        195⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        197⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        198⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        199⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        201⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:7036
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        207⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6740
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        210⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        211⤵
        Drops file in System32 directory
        
        PID:6204
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        212⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6900
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        214⤵
        Modifies registry class
        
        PID:7072
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        215⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        216⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        217⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        218⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        219⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        220⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        221⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        222⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        223⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        225⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        226⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        228⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        231⤵
        System Location Discovery: System Language Discovery
        
        PID:7732
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        232⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        233⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        235⤵
        System Location Discovery: System Language Discovery
        
        PID:7912
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        236⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        237⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        238⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        239⤵
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        240⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        241⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        242⤵
        Modifies registry class
        
        PID:7184
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        244⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        245⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        246⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7536
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        248⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        251⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        252⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        253⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        254⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        255⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        256⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        257⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        258⤵
        Drops file in System32 directory
        
        PID:7284
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        259⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 424
        260⤵
        Program crash
        
        PID:7652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7420 -ip 7420
1⤵
PID:7596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
128KB

MD5
e1d882e6e6b8703d7eee6ec9caa921a5

SHA1
3640d6526ad30aad720193802f961cf3645b39be

SHA256
fa62f6a718d2c1ffc8c0efd5a136a88dff9c86ae99a59fbb844f2dac6ccfdc8a

SHA512
2ba14be42fa9d54db3612ab28b19a19c5209e0719c288d2085ada327c810cc314022e0ce0c322c286e6d4f162143f0ab3bf1c31eb95528dac74a602076e33793

Download Submit
C:\Windows\SysWOW64\Agdcpkll.exe

Filesize
128KB

MD5
6e1d96b772f424d4b5a30f7358a5375d

SHA1
18c89891f407a34404c8b48b9d2c1947853aa595

SHA256
49e583e553c37e00e7eeb56a1580f0a4a3939560326b0ca9cca459e3a5084208

SHA512
bb759e42d1b923ca6216bea26ca413445fa3eee3cffe07310da620f6e8b6aa57d3b7377207027bceb9e9129b34d2d3e78b20b72bf51ccb5a5263fdef8754a1e3

Download Submit
C:\Windows\SysWOW64\Cammjakm.exe

Filesize
128KB

MD5
8f8dff3a76fefe03f21abb825b9e3c24

SHA1
5a4c39221377a524e23c894b17c7128ccffbf298

SHA256
85a3e27296369a1e01e9dfcae1e2edaba051c52e339980ceb5a4362e2ec83d3e

SHA512
e713d0b886b4d506866a4a0ca6c05c48edff972c2c61406096897b4cf5c66adbd3b0cd96a4cd49781640841845f75cf9734f6b179a444a954e4bbeebd5a4e263

Download Submit
C:\Windows\SysWOW64\Cdpcal32.exe

Filesize
128KB

MD5
dc31221f5e43c7bc72905a6aa01b537b

SHA1
4a3f694faff20ca9892596299c08403877fb3df4

SHA256
a4502e8ab2fe33d4415fb43d531749633d0d0142598cf63564adc1ec09e2da90

SHA512
7868183a34a7b6139e7150933d32903cd1913dd796a21860531dcbbb96eec821423e76d1b4dd8f666645f58a47398bdb6afef7c8128a3449c7eec99d4911f777

Download Submit
C:\Windows\SysWOW64\Dhphmj32.exe

Filesize
128KB

MD5
3047358c7eb1ba87d49e4bda178a8989

SHA1
c385d3718318e2eeaf014c8361b44e70d3cd42ff

SHA256
c2477d9e060d6424129a49c48eeef9c64f0220805714a76a70eb6b7716529efa

SHA512
21a29621a12e6af3e2a81043747f5b5d6d1be8c00ce536889fbb6613ca7e272290ddbfa16d89906ccf9d8bdcc8e08d549ca791285aba99c0d77351146c3f2b74

Download Submit
C:\Windows\SysWOW64\Dnmaea32.exe

Filesize
128KB

MD5
2676e25679464b57fd3fdb18be72d86c

SHA1
2dd12dedfb02e882a5f570f49978397fd37c48d0

SHA256
717ed2dc8baf6fc81179012079dbf589f81ddd714d9a4a77a131b50589423914

SHA512
19e80b6fdc2f34376a30c4c944063fb6e90d2abe1a321bae25ab1e4aae311c4f692a45114f21ac66273e17f074a313e55a40f656602b86f047ea92424d64909c

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
128KB

MD5
1b09a77be7007882b084aebd3ad64b2f

SHA1
b4bd50d8540c6c340dd63b6aa647f98e80e2e3dc

SHA256
50310abb262149a3e13b4b59803b4895188a81d65d39b1b7f384bf1a93614f4e

SHA512
cf0129e6584802427b9f49bde264f7c3389d5c9b8e1222a4f51c18ce923344572ac10bcacd8c271e9b845081291c2b6f018614aed356b31dc54576c85947b789

Download Submit
C:\Windows\SysWOW64\Egcaod32.exe

Filesize
128KB

MD5
88b2435c278dbfaee9a0e6b1bef48a4d

SHA1
5c5abd4ffe7c69a592dd99354a07db2a7f382473

SHA256
2904ec8a9de1f02d95db4fb109ad620d052bed9e6f29dbfc5cfef3871a1f038b

SHA512
3750699c924863fe8e776a8b71a1c0cfa2c64c76fd5a51bef98eac1d0502f248b169c6a057da432eedeae7bbdfa5df7acde0235ef1f8497c73dd7e5c3c144c0b

Download Submit
C:\Windows\SysWOW64\Ekajec32.exe

Filesize
128KB

MD5
258719d95de0306d76c61aa9a43c01f1

SHA1
3e94534ac6c7d163a9bcef06b47297cbdb3ba86d

SHA256
24aeb11795ccdca24141a45f69a4b18915d26a6315640e4e638af02e40a00d6d

SHA512
b015d4d0b483a9531c8821d0c57b2b9e9cddee3ab283aca453ececf6132ad29117f8d99d7d1a874587e68775b84aa0d9184ebec888c3695ee3681fdaa060c257

Download Submit
C:\Windows\SysWOW64\Fajbjh32.exe

Filesize
128KB

MD5
754693e05250742e2ab688d35ec8fe64

SHA1
c1c4ebb993ba0df981a52f667180ea8768e3ec94

SHA256
3221a23a704543c74da3c9c5027f2807d118c7d0a28b136cdddf06429b5f18c1

SHA512
7a95e3f9e455159d60b88c754d5593831e9f696a22dae05fada4110f97c6935d606d73029551c3980ca9c1dd92cb57c3b75c4e303a5c371e066ea35c94a68afa

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
64KB

MD5
7effebb47c8708ce502defd263b04026

SHA1
ac1798848ad09ecdff0ebe41f8306021b5d8f061

SHA256
c2e48fdaa236ab82f54754944b72af32d0e16ee74d65d54714b6431db4fe0063

SHA512
081c239134ed4ba3abec3bbfd1a60a7c1097ca110995179aecc11edbfc2bf0a60e21d50a02bb343db970779a0cc6d1b9b111e1fecaa0ef04dcd1327c4ec4107f

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
128KB

MD5
ce34091b385e7d59044e4dd55c245fe4

SHA1
f35be71e147d0bf8fe723b0dc7a2f7f9147f6a4c

SHA256
1fe1a423960113851323b587b6f2b0e86a048cc3d5214ed3d1e6adc166c8704e

SHA512
9d0a06b3ca37609fc8752f8dd36689ee68d3fa73b81980302f4bcec6779e0e8c1d73d203c2ef20651cfbb0ba7b1f31414859b33964b06387bf0e177a1a2c5880

Download Submit
C:\Windows\SysWOW64\Gbbajjlp.exe

Filesize
128KB

MD5
fc9fbe7f597332bae91d7817098982c8

SHA1
042a759f233c71d74425f4a0563fa09c82fd8b7f

SHA256
68c70c97ba5b0f037d2c55ea9285b73abb7aac4d48fce1e236c06e8100a7d992

SHA512
82821f293033cbf0e537b4d0d52a20cfde24ab8d5bb0b46709a89f89f32ca21a76d9924412275e8b25b147276da4da8e0f29e538e85d658467cdf381ff90e38a

Download Submit
C:\Windows\SysWOW64\Gbnhoj32.exe

Filesize
128KB

MD5
346c3010defb885ecbb55c07b4801e9f

SHA1
291917fc4155a33dc1c18bedac3b7bb1f776d4c6

SHA256
980a2fcdcddb962000d85db295dac904c3fe6019dc7639428096b67be4828489

SHA512
81fa11b89fe02c076ea028b3ed4b29e67ee27549bd776881d263e9fb5b8c75d6cb41f2930d8548ae02176e6bc305fb508bc2e38e8cf31eaa5c92ede10ba9104d

Download Submit
C:\Windows\SysWOW64\Gbpedjnb.exe

Filesize
128KB

MD5
6d45fc3621c35aa5bd50ab389062fd71

SHA1
d888aa3d95555a713dc548f21341607475d09b41

SHA256
06709c7b79de01fb797d6a6feaba172bd9f1cddd9d0e33a089b95e7921e1f153

SHA512
134c5dfd6904c108023fe8b082225f5a4294646ba64028c558831651eb79101376a7e4c7f9afbe8c18738c3455799ae0757690472d2f5f735d3e8b9a68a07a68

Download Submit
C:\Windows\SysWOW64\Hecjke32.exe

Filesize
128KB

MD5
2940d4569f1136744b945fa383027cab

SHA1
ad41e2297d547518f6c51d90f2f7f7b0db31fe18

SHA256
b62c8009517b33d7b59369b15bc541afdd818601de2dba44e77db2ebafd6aeb2

SHA512
24641268ba52b036d6709ac297f38c12eab3546add3b6b05f806600df733abde73b5a0d311e0165928ecee941c2f0a621160b40e74c308d3c0aeda6a0053a452

Download Submit
C:\Windows\SysWOW64\Heegad32.exe

Filesize
128KB

MD5
3fa29cd79cce0905dc1d3d98ea459d74

SHA1
a7985efedb5fc65aa8cbda359a37f5216dc1007d

SHA256
f9ecd4e16d9e0d9fdc889adca05b39968abd51a363461bd145be47d18d5df214

SHA512
e9ea390064e6ad5853bf8c2851d879d3382fb4d49d7472f239d34d0837b02a2b4c86cd3b660abaa983f09e5eaf12640421c25f18c48d6e1ebe2789f1431203f8

Download Submit
C:\Windows\SysWOW64\Hilpobpd.dll

Filesize
7KB

MD5
8258a3379cbbcd2828fa142d7fc1f6c4

SHA1
e4057be8de4cc07da40e8c44e9b6113ce90bf4dc

SHA256
b06d029247dc39d815e7d1ff1babdb883b68b1986d23d19ba4164310189915ba

SHA512
a99bf01d4842a49ba19dee35110484270e79d8a4322880c42279173fbb6f6f0cabf25f2839ad4b1d1f4823357f11bf6af1941a9d50589082082432b4fc3bcafb

Download Submit
C:\Windows\SysWOW64\Hlblcn32.exe

Filesize
128KB

MD5
7a03f81b6b443dd6fefafcb6d8a438b7

SHA1
26a6cbda8017e2d4407c7a8467c0a9898b0c80c8

SHA256
d079322df25976cafba6619fd531c54982ec3867b1470001c5612aa84818c66a

SHA512
3bd56e4f984fd78e7e8bec3b1a7b4fac9873a886064d1715cfdc254650282d029c281ff9ad69ad53fb36c6b110b42eae24bcf7d76f219aa9174203ccbbcaf308

Download Submit
C:\Windows\SysWOW64\Hnbeeiji.exe

Filesize
64KB

MD5
cf3f1c89c7f500ad251f5cf979619793

SHA1
e10d70abb38291f92dafb6fa0abb547a770c7564

SHA256
5d73212c92be348c418587485806106458e9449b99730f08448a6f9b0c469c6f

SHA512
c80ed723dffcdb3b260827f40a89e09fb85ae215f036a493b92da6ca65118ccc54c04e18b18d69880eeffe615d6e9dad9b7bbacdd34b7f78fc6f37bb89094da4

Download Submit
C:\Windows\SysWOW64\Ihdldn32.exe

Filesize
128KB

MD5
69323fe499c8b433041dfb612ae2d7cd

SHA1
336681d0a24053811d5c20e37dbd7425bcfb0a24

SHA256
3bc0987d81204fdb46751da08812b6401d16ebf7ba2d170ced659ef5795769b1

SHA512
c128496d2c3a17fb2d8bcfd179712129c3fea36824ff22d2137673e79a750a61a35b90b1c18bcee31485f17adfe45afcd3cc276fd1162365021823629f952a94

Download Submit
C:\Windows\SysWOW64\Inebjihf.exe

Filesize
128KB

MD5
a5c0ec6afb734a34f93ec0272af547c7

SHA1
1f7b8fc8ce6f1a475e4e6cf891192fb443fcd9b0

SHA256
b79db7bf77d40ae8afd80f022a57daf60a6df9ede924b6ae666cc28b7e0029e3

SHA512
05047d3f3547c19430146bf4c73c8e4863b593d77a1c67a6b125abd919f529c261fa056b57b4aef9266161106b9eacbf0c84bb70714a6f6a84c9a6b723a72ca7

Download Submit
C:\Windows\SysWOW64\Ipdndloi.exe

Filesize
128KB

MD5
f0157ab18a3f13772cd3cff76a4e0f19

SHA1
704ec7fb370e04eacab41987e989a4d3c1b02016

SHA256
04ea63e7ac04b977ff609230e96aa32b1084f5b21b9c913cb63a08bad792fb24

SHA512
d2bc4433b6ecaa11c8faee56ae6af06fffca3611d0d886bc5b68f6ed8a70735070ac850fe21a645e79c19a641d64a6a817eac586658bb2075797c96493870a0d

Download Submit
C:\Windows\SysWOW64\Ipgkjlmg.exe

Filesize
128KB

MD5
a62beaacf30b2511498e86dc70e54422

SHA1
d3fe25a952687df991a64b4a429d3923907ae4ab

SHA256
7850fcd9bc1fe416d7232329825561e5ebbbf4e15478f9a74aee65514c276df9

SHA512
60de1bb4e4de90a9d550b865765209c164ee6c6f4c8909af9e939774bdf47728a7116463954369546336aef434955ec5f2d1ed7a2cdc3d21ab37dd040f1d7a2a

Download Submit
C:\Windows\SysWOW64\Jaonbc32.exe

Filesize
128KB

MD5
43cea964d3b2581b95c0217d2d635ae8

SHA1
795edf231c7e897e3081c8574d2f9597fdf1f3b2

SHA256
04720d79fd61018223b8d0120f8a50f3a67b3f70c53139be726c634f05ea54fb

SHA512
af768279aa22a9adc0108f80d67159de94c8c9ff8121c51726edaa4c08d8736bdf8feedaf1f13548fdc6b98049b78e6ad9727a04ebba7afb5fdf9ea9ecf86332

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
128KB

MD5
bb80717174e8e04a665f92d6bf245bbc

SHA1
d3a1471073a2c62fde04423a5bf977c4439bf3a6

SHA256
3d4df044e0850b9fde16e6eb9d640613256309723fb01189c29112e064346976

SHA512
2abf6e39d085c42ecd3a42a24e98f29e1a16523957e5a2e0a633248212164a30ae58bb46386b37c01c7f2685211e4a63b1029f1f8c97349fa38c8829807c94bf

Download Submit
C:\Windows\SysWOW64\Jikoopij.exe

Filesize
128KB

MD5
11a900959a363225149f46f38665ee89

SHA1
f5a4ce2dcc4e7e3cf8e9070a13dfbf8dc3c78351

SHA256
3e02ac7e5de9a2cf50d85f3c3670a7e3dd2b1ea34d4a76e196705c0457b76a5a

SHA512
d61108ae64f4932db9839f72b1ea132eaa8c7df136c1e23050cff336fd651067cf84ba87c9b910e7f00be39254daa526ea73282eb78fe6f354f3744dcb758907

Download Submit
C:\Windows\SysWOW64\Joekag32.exe

Filesize
128KB

MD5
5b3fe17b05f687d8805592eeb3c11626

SHA1
71bf056c580fafc90c9d43d449f07f34ab4b085c

SHA256
62549b0352194203e86edaeecfaa34623fe55afb6bc3c7b49b679f435b665794

SHA512
e45c41a93adc85861622d193121cb84bdd9552c64802a39271cf747ce74099bf7a58edacfb51ea2b690301457e90c2e5ed933c4a5685ec83ca8b671004eddfd7

Download Submit
C:\Windows\SysWOW64\Jppnpjel.exe

Filesize
128KB

MD5
3b421598c3ce78d241a57de5d146a519

SHA1
988c14fbd264d7b22f38baa6f68e6786c69edc62

SHA256
fd50f4dd6fc9ce2490ecf2f25e0da3cd303b447f29d4820027e17a8021c02e15

SHA512
09938d9f20ed02b83e3fd71103d1cb461bae20f37af8913e895b646afe01bfbc3754b5a0b90f582aad5f894e6ed6469ced57be754ade6fcdb24cbaa7acd71db4

Download Submit
C:\Windows\SysWOW64\Kbhmbdle.exe

Filesize
128KB

MD5
be2c4f5427350d46d6d0e1f6eae97512

SHA1
26904f6e6de7b99f27782eb17948deb0b0c816e3

SHA256
fa290b08b6bd9c8eaed4f5609735b2685b1b0751218eed0d64bd9ccfacbda263

SHA512
27c998e10d5a962e971c88c21a058a92ab604a67126feaa3152e557b3533baed58333e4172e94edaf53f02ca28b6fac11b916b3704c35befb7f8485f80e2dee4

Download Submit
C:\Windows\SysWOW64\Koonge32.exe

Filesize
128KB

MD5
899b3c1168dda23c9a897384d8316df2

SHA1
16eeac6987cb31b40b7ce306cce9fdfd3367631b

SHA256
9f9ab6ff4d749ff94040c8d39c997962521f99b0d25e0db704e0d79554349eb0

SHA512
ebe20dde850b96340e6746ec7bfd2e582604824d0384c6aaa25222db0d67a43b5c93a516e9e88b687e38962004924e1b56b3950b8d39c3cea4716809f9786c25

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
128KB

MD5
329646003aa25fa557e860533bef3af5

SHA1
b8ae64be62face160c46865d0547d3b61e571ef2

SHA256
37bd3ffed8a6f45e1dbc8d6df2cb60c804d4aafb1da63e16b3e1090967406609

SHA512
84338ca8dc838c9917e5ca2135eaade20868a4c8bc2c118b0845d0125ee5839aa14dc64f1975cbd19b4bb2d0abf4ea5fde7ba6bb4bd67a1c9dd2f57736553768

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
128KB

MD5
96c84f566eb53523d33ba09cc2ea2275

SHA1
1f9ae00c56301cc3b678a4d75f8cb25ac3462410

SHA256
bbe49bef04b68af4129bc08801d1b05ddfcd048d3092585d71e82d5eb327176b

SHA512
b3621256c2e6c380a98287cf065ffcb8d1f9c09c495486de7f02f22a43b9a473db2bfa6a30dd7a6d38eeaf2ef63ee3c3b3c73d7e9453dcc9db52a3c140e12b08

Download Submit
C:\Windows\SysWOW64\Mhckcgpj.exe

Filesize
128KB

MD5
ce846edc6837931bce0a71170c4187b5

SHA1
127409d35fa13d51e9857626be95d0a73a977d1f

SHA256
8bc6d10c767b3f56172a92216003647f3c1a880e270a0daad17c1615703b75a0

SHA512
a8ab04c3868769325394569c03f021126f5141e1e868f5acd9c1305c1ce9aea40dccfea65d6d2c60351c21f3cc5b8dc45d7fc1e3ba0653da3a3353100a547573

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
128KB

MD5
db45ccbd9a535f6559780f66458f2d12

SHA1
dbdc16cb2469391c30b04fbcb9e1b6eda68e10ee

SHA256
c834f17cce4c5f9ed2b91c2a5dd69347b4d91ff66249980d07e4e8d4db41cfbd

SHA512
55ea84a5d4acf42ece0542d7742e8d966d2e083cc059e33121f0b37854fe5891c7cd9062fc5d60abf9a11a7b2964522153a9128ab89d2a0c8e4834f35a63832e

Download Submit
C:\Windows\SysWOW64\Mjodla32.exe

Filesize
128KB

MD5
890bd3e09d7dcbebc316f622da30d7e4

SHA1
de539bb241416efaa604a9b6537edf29fda17ad6

SHA256
34e0b6e0f85819e7b1ad393f398d674bb3843afd853399123dac2bc82bcc30b0

SHA512
ba29bc740d13da3df5a5f24b9433dae6f0480337ba115582aad53eb45a771e231563670125fe44cdf91ffde3d8d92cdef7d4ed5cebe69d4999de61adf8812766

Download Submit
C:\Windows\SysWOW64\Mlljnf32.exe

Filesize
128KB

MD5
ea1140e0c3806a599911aaa98f9a4008

SHA1
57bd7d1a89f7d51416d4b5f5f555c30a655f59af

SHA256
a2f5ef21c547f96c84219700a4f9e080bf51dce39e258eb847e78ce10226a760

SHA512
0c8a02a4fff2e64fe263f5ba0a7fc08e6aeca2e021717ab3a138ad39c7ab217489751f51ec74827c085eab346ad5cb8fc87acc09b9b9bdd293c7b5fdf3546b3f

Download Submit
C:\Windows\SysWOW64\Mokmdh32.exe

Filesize
128KB

MD5
caa3d684a63d4592890dc5b134ba30c1

SHA1
0fdd0d3eb98a08f7f108b9a69600029a8d0abf4a

SHA256
f20bb8c860ecd7c75ed088a9205fd0055601ca5d23d0c69a3dc3b5cafb308319

SHA512
dfadaad86a511935ecc07737878b054b62bebe498d30021e9ab106e19b6a18b8abf1a8d4893f2bdd0f934b9143749d1cd6ff89a4e3f5f39178f971712888d916

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
128KB

MD5
08d84c10ac941746507ae77b37a7178a

SHA1
4629f45c66e2003cbc5b0d6c40de307fd6cdba9c

SHA256
b35d6a005592f36603c3b259fe9072de851ebfdccab61f257d5c063f67b51a67

SHA512
172e3009f417d6cd002f0358e1687244ed51f65fc5523cb5c7280d67264bb03f75934967012360b83c71b76af53ef0cd0ae38a338860898d96fb9272a431a103

Download Submit
C:\Windows\SysWOW64\Mpapnfhg.exe

Filesize
128KB

MD5
bbf605b9071da0ce442a8e94c827f760

SHA1
0ecbd2fbd8e3056cf1029d63f4a7f14c9f1a2191

SHA256
1b3acf34d1d18ca5d2408569b756472d7dd4ba93043eb4aab5883ccad55779c4

SHA512
e89cbb4486e76884efa7d25ee581e2ca68936bab02666f3019463542563d4cbfba7805ee0d407bd40a8e7a663deaf3caf03b35758f9f7e29cf475b8db3802f10

Download Submit
C:\Windows\SysWOW64\Nbebbk32.exe

Filesize
128KB

MD5
3317a524c7a20116f519272bb95151c4

SHA1
117ce48c518c3e002b7c43a28474d63848e94be4

SHA256
8b5ab1234d106ecacbeacf06804d34cf987a52918ced20f6dba2b10953130f46

SHA512
cf182c0a50cf5ecae5eaa0ce270be7ffc74df1337d2e2c23603e9062b4d727f5ede34f5036ff3e46fc82786f48e8c1fb795b6e9b023d7b6549fc2f94e030416f

Download Submit
C:\Windows\SysWOW64\Nckkfp32.exe

Filesize
128KB

MD5
fa7f7d25c39c6cde74cffdfb8e13512d

SHA1
b2333c1c73f8b70a35a3d566814d04728c89b22a

SHA256
d295e481ab3efe4e6a7c02d405a48db92a5d47fbb1f934c5a6d8f5450f6fc816

SHA512
1720fc41585d0eacfe5531e39515ed18793d6f9c3da7cf7b604119305c75c22e56699d77e983178e20790e9d1ca6189d65e278a8627447a5657c52befd9ceb7b

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
128KB

MD5
e4042cfb76259363628bfb90cf88b4f5

SHA1
1920365ad6dff6abb1afb2a51f00922a67b68f4b

SHA256
ba48f8c264f1e4a8ab7fbb100a164ac9a2f4c72610604e1b182edfeec342c9f4

SHA512
e9dabd1f59f1b6165307e7c96e732bed191189a9e0b459af98222de1e56ee9974f03573fef54daec57fb5c70337517cadfaaaaba7d385906f2c1af0c92cffa4b

Download Submit
C:\Windows\SysWOW64\Nfjola32.exe

Filesize
128KB

MD5
a782dcc0f5343a8060e3d24e3f898124

SHA1
edf367c7127d41a5f39d35d463444306f1496222

SHA256
dc99c21a64246ff781269f6adf9da29475e59b6bc039b184015aad530a43b1be

SHA512
81486d8208fe8d8dfdb6949e04a5420320979b2ab3aba2c8071379510ef215e1c336a411caa481e73bb1ffb67c343f34bd393d70a66670d66706e830fb3322ba

Download Submit
C:\Windows\SysWOW64\Nflkbanj.exe

Filesize
128KB

MD5
2c1386b523575cd8fb9dff55969f2b16

SHA1
9b292dac33c013f29cc9e131bafe2b32f558f870

SHA256
65067e4c86d18802856cadd7ebf03be95d19bbe94473067a99cb9c76a2904bd7

SHA512
5d98aebe3d8a21bd58799c1f26894a9511e93730857bc6f3fba75bd508f5a044b2c9e7f95d0e90f59104399cfcf909524f89cd9814312307a46858e793263838

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
128KB

MD5
a13e0a65ecf57773506267020e1cd294

SHA1
c35069b7783b448f1e15964f3545cf752a9bd1af

SHA256
7e0aed92f69eb821dbafaeb3ad3e7fb9271909bb54c7b4338592144205bbccaa

SHA512
71a6e0722bf05912ed440ab5f4f9ab05a05740a1afdf076dd20351a4d608d17724003fc53442ce078bf04fc10ea9825ff96813f6f3c81b941006cfacde776ef4

Download Submit
C:\Windows\SysWOW64\Nhhdnf32.exe

Filesize
128KB

MD5
d8d09d843f7b96cde3ba6eb76981ec1a

SHA1
8c7eeb1a36dd962a44e376367c77f5182d01426e

SHA256
28f521decb878240ffd9a164842a5f88f9be702f8675f53f613fe56d1811a960

SHA512
fac63e5e8a500d235b5e6d8e16db9f0bc8f0553b93c80b24fd377343b0425fb1dfcd50a87a22151b0ce69850947698837a61ae8c2f3dd5c37ae420d33c450c01

Download Submit
C:\Windows\SysWOW64\Njgqhicg.exe

Filesize
128KB

MD5
41c62bae01bced693e078c395e6ef2e1

SHA1
cc74ad8627379e2654ff20d15ea99bf876bbd46f

SHA256
7976c402ea785c00a976463ecd2044b68c1e25930406c22aeeeaffbb0f7c80f4

SHA512
45d8069c77bfabd135053aec1a6de738317b2f609e79070ad0541449c7a043c4a129656ad86bf75947725ae41583970baa5a6bf77afd76c618dc6ca898393d5f

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
128KB

MD5
2d614081f64566b4a5102dfeea3f48d3

SHA1
148c68c62199771726460fe14dff82520ca3ea67

SHA256
a726833550698a579318471bb1a7b5f9937b0f775a1ca80e125f24b3c4f3ba34

SHA512
b7664f4098793b1d0223900a14971644404e79e76a592d565903b4dfb2ab6452e7fd62bd26a9aa8ae3df0f5238ab75b14fbbcc4d0020e36c90e9af0956f683b0

Download Submit
C:\Windows\SysWOW64\Nmhijd32.exe

Filesize
128KB

MD5
d3ca9cab423431ecf66641d7f402ed37

SHA1
0066cac12c3da0df72ba8d8c031015d853f6ddf2

SHA256
ba3a12f698f0efb33a78ce2fba06d06df77a54a876a1a51a2ce9452fa8a2d50a

SHA512
70d1263c5ababc6c98d67e09dfa910e794d8d43cca411bde30b076d67ea4cb40683b03a27a448ba40d16e61a0583b41c7827073d315ab4fb926d8186408ce232

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
128KB

MD5
eff4260ce5f6c7a4384f5452d8e63e07

SHA1
d852a7bc97465220d3a2cc47342f159bb64a974a

SHA256
158ec7f78033f17f9184626d5d6ca7c73b4a44ff36f9bfcd642306c41339fee1

SHA512
fe728eb178f07f98d00732a400fcd96706a61e3e7fffdb22bf4cca611d11e696ff3708f8e552c730666f328a31a7ff342a652425b8fa8bdd98e0f31fb11b0023

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
128KB

MD5
9cbcb94039dd219340cc0cb7d38c5a9b

SHA1
2eeb638fe95603c715930927f20468ecf41553cf

SHA256
7055037d26a70ee50546c010a725d933eec58b02f435776900daac4954a17c62

SHA512
63ea36dae8425f3174b44e051769be00f92d9618bf3b5b088554267ef84d2157bf2dbef970b4e5721a90bac570c9ed0ec8338f3b3212f1222305c1f2064f275e

Download Submit
C:\Windows\SysWOW64\Nnhmnn32.exe

Filesize
128KB

MD5
8978c7a9cea9acf1f06c824ce08086b0

SHA1
03fac508fbb6201c79463fc72441427cf9ab0c4c

SHA256
2ab2f35669735f362645a7ddcec0317c7d22299b55a13600aea2617a3c8e5153

SHA512
330014b564f1db277c2dccfa6c4f78397900892d6beef1ea2b93131e52649770d6a37ef3e6faec53883714e1f8e138305dc69dc7fa1e2638744ee32863c1b745

Download Submit
C:\Windows\SysWOW64\Nopfpgip.exe

Filesize
128KB

MD5
b5e21ff3efd0dd82892a0b6afd19bcc9

SHA1
1bde7db9d46c94c304028611f732069d7ec0075b

SHA256
c1bb6249c321612f73570ecad27fc81b93c5903d470b2587d8e7d16acf290816

SHA512
1cdd6982d688ea147acdc9f7663f5f1bb4849c9c473d3f09f4f7a672654ac334af8bebd07b761a1a75601755c2b03cd7d527e2322ec7a909f9434d3d16fa200a

Download Submit
C:\Windows\SysWOW64\Npbceggm.exe

Filesize
128KB

MD5
1f450bbfa0385c81345747027d3a3b1b

SHA1
e89a7bbcf40505a8e79bbe165dc35b6b9c08e77f

SHA256
a49e63466d046904f7b5f2a2688405f96bef4b29022d734e77f79ac57a16c13f

SHA512
06424783cb34d86dabef0c5ebeb80549e0d23032af7deb1835a05231f517f1e031ca9af24e41d0b16e3fa5d4069da9f656fe9e41c292da03694bfc5c6d0d7fcc

Download Submit
C:\Windows\SysWOW64\Npiiffqe.exe

Filesize
128KB

MD5
274e791be63de348d2f9e1e6e0096441

SHA1
adbc9a634aac7cfa25b8b9d8966c14c9248d71ec

SHA256
5a131b1ce55f465a41a3be6077aa59043bf162f8c765944a17d2ce000ad33342

SHA512
9baa29f4868891406841fa37a1bbdbd8cb501a293aaf2a9b783eeea0739463946e35a25fbb1570ea6de8f7acb419e096390e4dcdee719ab194fd7a88886f5586

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
128KB

MD5
02cf9fed323e267ce8dcdefb91424972

SHA1
96bc2bc12a388aeb0d4f97ed4366fd691404eb49

SHA256
14d51379a512fce3b85e5067b176bc91d390d0d76fbbcea8f9f094c762fb9b8d

SHA512
d1bd1dcf97043e5c9b258289be662540f78b55d61028c77f8514585f64ab3f097a370ca5f281592a497300d8b5f7941903d2c505faa527616cc26cd8776017b3

Download Submit
C:\Windows\SysWOW64\Oaifpi32.exe

Filesize
128KB

MD5
644f88f9c900e0a9dfa5fd7575957597

SHA1
cb322844a0fc94df2fc94aa2e29d582107418eae

SHA256
48d1f86094c86abdeb57491eb3a3452b197de3ba2d76a26952ca1f5fcfc9319a

SHA512
2c13207128af5249501156db2ccfcc630d2326b75b066ced9e5e920bd6be542b542aad4679481197c4e2581b6e9e4b4031b026a12a48e948c6b283ca282ac52a

Download Submit
C:\Windows\SysWOW64\Obqanjdb.exe

Filesize
128KB

MD5
29b8e0c836577494c8280839326d01fc

SHA1
a322e1c7125eb7c06b4bea1bc9e362dd30c316cf

SHA256
b23f5aaf724d4a924b6cd1f057d6ce250e817f959704b2f43f520bb58e5a4fe9

SHA512
595ce25d0f1e926fc3540e2bd1fc12f138a59ac359f083b0f38943ac5d8be49cc04390b612f09f57dcb6e9ab41652b00f6d92bf94a31393e3c00cbb80188e400

Download Submit
C:\Windows\SysWOW64\Ocjoadei.exe

Filesize
128KB

MD5
ac8102297c50477fb40b822560375e40

SHA1
045e2c7ab54a6605c18deb83004ebf108756a0f5

SHA256
286f4fafe293afaf40cd4ab1fbcd2059dc6353b8db213c8c3964a60f511d050e

SHA512
22d243d0429b499140d8521bc77b4e019f0266e3823e80bb6114b1b2dbc5ab67662db2018d8fa95f69be5dccb0b57d623004a21b9e88afdb5db2ff8f90a29b1d

Download Submit
C:\Windows\SysWOW64\Oghghb32.exe

Filesize
128KB

MD5
3c727d3c1447e35bb588bd4cf90b1551

SHA1
dc48262e7b0bcd148be1a8d642b48a3af1419870

SHA256
0b3178afebdc245ac40d82be85b9ef8bd5a21b7bc2d3dcc1fc25ff60a0f18bc6

SHA512
7f30f1679438792c9938c2f9f67e99bfd3b2ff3d8e3be22ba6b37bfa9d28e510223127913098e9735154fb673d494a8fe92a5df3e829768ab50b5a1eafd3e939

Download Submit
C:\Windows\SysWOW64\Oiagde32.exe

Filesize
128KB

MD5
459283944da8445689dbd1b1eecb8a2e

SHA1
d64e88511690bfdfddcdbdcab127dc70c85e1585

SHA256
9a22838cbb72635a204cd7e0777784e1d940e2a6a7be7d23925e116d12a4a264

SHA512
787e3dfc8cc91380292c62a4456f8dd54724d18aec34f7ec3d5d48c3c79ac4bfc2b73400899cd68184eda9757f04a5810acf9e879b7997723d85ec14f1bb0e36

Download Submit
C:\Windows\SysWOW64\Oihmedma.exe

Filesize
128KB

MD5
50fb7c3f3e1ac463b71dd0f674a29e5c

SHA1
929eca86b9c1567e88ce986423a2ae94ef9f666f

SHA256
945df6becc3c1503d447e362c5753f40171213206867360f3922ad0e07d71ad7

SHA512
9c70ab8625a6c364bd67174f0f51686f56a99f447bcccd021d39a48663ff3c79c12582bfc10b583c089ab15c9d0bfcbbf2a001adcad62bc6eebdf1ad9be37006

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
128KB

MD5
9bb2c35da5738012b8022ad4c82d6b6f

SHA1
4b264e50b38f0f3684b2d599780d0e154be286d1

SHA256
fbbb2c51e73b548182cef1c8213fecfc787d9dbf5a5f528b05a76870e9348295

SHA512
b4c17b556f300e7db9d11584b83cd2ca558881884d0c4893b8e40d0464c7e42d218b15a2c14b886e600fb12f5123fe2398b4e2682ee446495ad0a2546e37bb9a

Download Submit
C:\Windows\SysWOW64\Omalpc32.exe

Filesize
128KB

MD5
ed59ace88267beb58b4614a2d0f2b5a1

SHA1
f4c4e4eacacdfcd0e9defcafb9e71a96338c75d4

SHA256
b17fcea02257f75b2da93a23792df70c0c443a69d47127b023036568623d7f27

SHA512
68a2622ddd196c3ad156ec8e1292091d371e27da58c731ee74252d7a7c443804344fd46d251875cb3d680f4065afadaa34ded700dcd8b49770347683366126c1

Download Submit
C:\Windows\SysWOW64\Ondljl32.exe

Filesize
128KB

MD5
af0ec1f2b8599a6c6ef9728bf87463ac

SHA1
ab136bfe75f9c0fd74a64081b072928a0f47678f

SHA256
1cf4ccd13d2e470ac6b0ff7973c50de6a5a0528472fceabb057473f208a7fa6d

SHA512
e1c9278620039ffa376e40b4767f589b378c8440b0d78e5ab7ec12b43da3fc13384b1a422e84598f7af105cecf281fe7d93620bb9320b2566f346b110a776ccd

Download Submit
C:\Windows\SysWOW64\Onmfimga.exe

Filesize
128KB

MD5
e9c3a729a359d6428a4d1a2e4ed5fe88

SHA1
0c34701744ff1e6eb5d61d47b476f82383f34002

SHA256
f0c6bd2b1d00add26f427e7596ae77057ce6354827cc7197be181229522c30a4

SHA512
844e655537fdbdbfabd9a564ab3b0d4092fadc6375df2ca86ff3862ab37ce50c9d6656679529f3622f8d2ae9003548892af1202a1086fef2db1e5fd687811a3f

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
128KB

MD5
b75d910bae68a41a3b92a5ab5fc88049

SHA1
7e6eeb43fef6d5e4fda9a8f3f0ae5f8a42508c4f

SHA256
9225bf1a9915aadd24c11a2fcec9e642fe54b7e865a2640a29f3a5c5fafb3bd1

SHA512
fa3f35adde9d63d111525063871e0309951e349ff26342923bec8f49603e031e5419d566208438fffdecd2a5a34548aa9c8292b6277394fc142b0a84d235f882

Download Submit
C:\Windows\SysWOW64\Ooibkpmi.exe

Filesize
128KB

MD5
48a85afcf222abcd16c6f40578841c11

SHA1
714976aab6a139bd55a3fba4587f8a6e9f8c3d3a

SHA256
b1cb349365ca3c8bcb1f1c4f8bfb7fdf5819fd40174d711b16e6bfdb9868934a

SHA512
0338321e4d2f149bd457bb242436cda41cde51fbdcf5559eaa41f8610cf24d96a052e240fda34e270ad98900b5e77c86d8d0e26e459a03c0a96c8efe4d106577

Download Submit
C:\Windows\SysWOW64\Opclldhj.exe

Filesize
128KB

MD5
12ca3e51ba7f39bc34f0050c8577ba53

SHA1
917e53e89fc5d4be72f32cd9eca3e358b874998c

SHA256
a7522d0ad048ec3dfa0c7c42e49750e5a0cb0aa0ba9cbece049a641a79d9e8d6

SHA512
a98da5447caf07cfc071213feac6d1803ea1ebce6ea00d1da00e28b7522bd1c065ef339465f9307b68420f96700abf8c0a4a6a2ab278a1e77eda2d2ff50afdd3

Download Submit
C:\Windows\SysWOW64\Oqklkbbi.exe

Filesize
128KB

MD5
691d6638a987986f16a46b9387faedb8

SHA1
e8cfb0112b1d7492976f531328d64133c078ad89

SHA256
a8747c4c29ab18f301f399b7e0b7b9c15ee762b0090f098754bbf34e1452dfd8

SHA512
82a8cd8b8cb4f84a08fea1baf684e214b4e4913bfaa1551c7cd80862f2d95b1fc6d9dd8c153280cce05fb7e9b25c0e6be53836376fdf6ad3891a47660078716b

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
128KB

MD5
53045efd55e871bafe7cd318a6d3c56d

SHA1
05415b65b4a498cc5aefecb25cf47e873922d5fb

SHA256
bbdd20b51f40bbdd70d98ecf7dc947b23f7117eb06a83f25d0bd5beabe3a7be7

SHA512
19bd6dc75f8af49a564a93743a9ce5008fc2fa9926c1e4e18f13c303f54b379dbc5d855fe92a91ecc7c32f16323c1075d7d2df0b194ceec30001ce5ef2749b6f

Download Submit
C:\Windows\SysWOW64\Pcbkml32.exe

Filesize
128KB

MD5
da715ea887a26f2f5291b92467d613af

SHA1
48a12c48523484c7b5489482e38269d5426edd39

SHA256
6f7f93a88ee4ec8229affda675de0c3b7f8f5580d973d50a3fea503a90cd1de0

SHA512
7c19011b922272c543a75ef1fdb5b2f58b03dfeef74618f24332231b6f456daa8609d51509b383b018757787c74fcd046897c6503e7ab1142818da4bbdc7804c

Download Submit
C:\Windows\SysWOW64\Pccahbmn.exe

Filesize
128KB

MD5
e41b3ae47e20636a7c25f9f52456c021

SHA1
0b746f1bef58ade1c029ed6ae1d84f47b5a4979a

SHA256
05c2e94aedfbe15567412906462131c2076bd67027cf58799b15ab5980a29465

SHA512
c7c20ef4f75ffbe64b48fc201273bac2b8b8f4f443c13f51c9f3180b118350aa461fe29d050df3ec6f631d889be3aa63cc8b4afc723b69bcb9b88d7ad388df4c

Download Submit
C:\Windows\SysWOW64\Pcegclgp.exe

Filesize
128KB

MD5
46ccd43a11a94121438db79f59427c69

SHA1
0b3c0ecb86844d2515d24b754b10cdce23c89d19

SHA256
77edea7da19e789ff475302243609d27a1e88d829ce5d3cd97715da4ac5cab19

SHA512
875b6f7cfa4179da52f23534c5600462daf0dbcf287be41791f3fa7895ccf0d78eb2214c0825be23fd412e613ff8cffa2ead64c18ab1cdb377e55b0981b538b4

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
128KB

MD5
c19d8a456df2408c417cd5f7aa553b97

SHA1
fc270c6f4e92e44a6d8620b96e041847559a8ff2

SHA256
97468bc155906771586b6e6e23bff8d41ef6d17e50b2460e93f9898619af2b1b

SHA512
d4233e5b52498581d0fd352901e622354da070f37e57950edcbb5ee19ccbe71262deca11533fbb332e8ae2fb6a86e4dabdfdfb9b99c103fdb07d5f17ad1ef532

Download Submit
C:\Windows\SysWOW64\Pfepdg32.exe

Filesize
128KB

MD5
100dc8f4b76c1c63e0e58947f88af706

SHA1
ca15d78294c52f2d0d59ffae68bfa5b926fc06d7

SHA256
3a109132e9be21597eafc1a91a09715fe8758b6d9d7ab173d71d2c9bb0fcd32c

SHA512
9a6ce30cafa752b9eb6934792f4d58748de2ceb8b272067308946ffec95d4c473846de5e386b58b430dd361680b8dbc2134e3624b39dabca79dcf59beaf51765

Download Submit
C:\Windows\SysWOW64\Pfoann32.exe

Filesize
128KB

MD5
4992009d7b94a4783a7b97d74072f882

SHA1
f3be7dd2789eb56f83d2aa40767532d5ef093ea3

SHA256
32b4632c71183725fcbcd1816696eb61af8f6f8f30ad108d4c73fec09a77a97f

SHA512
a72d57f94f9dceb8122c5f73a158054901158add9f31c1e972f2aa6735ce5d97bebb2dd2d8ec1ba85dc80c388a5a62bc9eb5687714fe6bbdbb19917a7ff084fc

Download Submit
C:\Windows\SysWOW64\Pjjfdfbb.exe

Filesize
128KB

MD5
4bb2aa98078dc33453d127682b660d19

SHA1
c810f555e84d4da442c2abb5628a578b09c186bc

SHA256
77270cd2fa11731485c9db2164f68121eef6f7a65b90673560e9729eb38b829a

SHA512
a9d94ac912ffe745e7e68c70c5ffa0285d5da2088ab47142a1febcdfdb6efbdd3369bc3ada6f64428bce0af250e6b7492436238fdcb42272e5be21ae617044b7

Download Submit
C:\Windows\SysWOW64\Pmblagmf.exe

Filesize
128KB

MD5
f4c2a2c4cfc02cafbecfd0c82be33f88

SHA1
e73f4f1bf8f5b5c824435b44d4e557631f319070

SHA256
64e104bc8431cb5ade46745ff1615d9300f2172c52888a32d78ec21799d04060

SHA512
c3ff8672666f1bf3dbb0b9618ef8f794fef1601044808b3fd5c108e3ffa06d63c67b82bfdf9cc9adc6925a0917608256bc352ebc15dde80df9d1a03cd6f322f9

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
128KB

MD5
e2093a019dc1be7dc313dd72ae41bf62

SHA1
c82f2ff6902a8142ba2cf21559b66165fd1f7b03

SHA256
bed330609b48ec81e6eef9b18ca993bb0f293db84969a679a3b93896e7dac5e6

SHA512
169b19ec5106aef2b2493d0fbde9fa7ae00e6fa193af09751def608290111fa0d0c287da7cc118f1206b07fce710f1aff527dc5a58a7f61f7bc7b4ab60caaf04

Download Submit
C:\Windows\SysWOW64\Pnkbkk32.exe

Filesize
128KB

MD5
307d6e0431845cbd5e6e0954046591d4

SHA1
553f8e60a5a623082e9a1becb21ed9e263b302a7

SHA256
04183e3bd90fb2a8a32e809a8b8d48e6cbea97a44350d005118859da2e5e0f74

SHA512
062e86db8a59d32bedef174102759fe3e3788019f0bfb6305bfda073ce90a8aaa85b24cca4190c2b8873217bd37e253cb69dcc6196aeea5021f4cdda0fceeaba

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
128KB

MD5
573a2165bd6eb1868eb511cfb1e010ef

SHA1
e6b1fb233011fd249e01938640e7e4f0c6b24564

SHA256
7b15f1a09817846e01e796a62d7b266ee04a8bff8fd528acbbd6558a4b5e600d

SHA512
69f9bc91c7514aeb3ecd16332c642dba7e530cf75172cbe9b3d7d0ae367d465c8f19882ca92b2dfab486e6f601b6d74c7f44b0bbce733305eb82895ce695e7a1

Download Submit
C:\Windows\SysWOW64\Ppnenlka.exe

Filesize
128KB

MD5
48a5797d25481f75fbc6b35198d8f815

SHA1
25fbca96a80477218827d8dce3629925b4f29916

SHA256
e38a1812089336235937186c9703c694fb0f7f023ac9d1917bc7a065d84e1d2b

SHA512
d1d340cec06e2ca658a0d42d66d9a25f83a680d98d72f7eafb42308fa95cfaadd7542839f6e085aab1b082d7f1aecc4f86d198298f783761b153fca6a02e08c1

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
128KB

MD5
12bc3ec71fba9ffac03182a90e5f29cf

SHA1
520efa36b41b38843a3a379c847fde981f5e8550

SHA256
f276c46f372d5e69f39b6f6e40186511eaeb59b3252950850f6357cd77c90723

SHA512
d1c83a1b772be36883ab09318fb8131df10878bd2f5e4c296157254e32eccf99cd627d30603a8438c88e8c6b965cf666f922763c7e060253cab5200310fcd5bc

Download Submit
memory/228-328-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/552-183-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/556-526-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/640-316-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/832-298-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/840-572-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/840-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/872-532-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1008-358-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1048-566-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1068-248-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1156-175-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1184-322-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1192-304-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1220-228-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1336-191-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1348-370-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1404-167-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1568-508-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1584-151-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1640-594-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1668-563-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1680-400-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1684-111-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1740-454-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1756-239-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1808-334-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1820-255-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1944-292-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1952-376-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1960-484-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1972-388-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1984-286-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2032-424-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2216-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2216-551-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2236-128-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2280-215-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2356-545-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2428-436-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2432-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2464-364-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2480-587-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2608-478-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2808-310-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2984-418-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3024-576-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3116-448-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3172-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3172-544-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3268-552-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3524-520-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3800-502-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3936-207-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3972-472-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4188-95-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4248-346-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4252-159-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4292-280-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4548-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4548-558-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4568-23-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4568-565-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4604-514-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4688-149-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4776-442-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4800-394-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4816-593-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4816-55-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4852-382-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4908-39-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4908-579-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4960-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4968-496-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5000-490-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5024-108-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5048-430-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5148-47-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5148-586-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5236-262-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5244-87-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5272-470-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5332-352-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5352-71-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5356-274-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5520-80-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5524-538-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5616-460-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5652-199-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5692-580-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5720-268-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5756-406-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5980-340-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6016-232-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6024-412-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6092-120-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads