berbew | bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe
Size

94KB
MD5

552c80c623d8a0d9be2bb5ffc3531eb1
SHA1

19141f24e75d8e7804920b25a9a26e8861b6d09a
SHA256

bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c
SHA512

68229f69b186ab00abbb508a63eacea173ea38cfb62b83341790624b3fab3e519de97d2774b2b8f97ad01b178392d55f373a727338cfbbc67dcd165ca88db035
SSDEEP

1536:+HLSNvLHYuxAhqLtA+aDte6zhW/LPHq39KUIC0uGmVJHQj1BEsCOyiKbZ9rQJg:+HL4L4/4xaJe+W/jH6KU90uGimj1ieyR

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://crutop.nu/index.php

http://crutop.ru/index.php

http://mazafaka.ru/index.php

http://color-bank.ru/index.php

http://asechka.ru/index.php

http://trojan.ru/index.php

http://fuck.ru/index.php

http://goldensand.ru/index.php

http://filesearch.ru/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://lovingod.host.sk/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

http://promo.ru/index.htm

http://potleaf.chat.ru/index.htm

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gododflk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gododflk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Melnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikpaldog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkagbej.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew

Executes dropped EXE 64 IoCs

pid	Process
5052	Fkopnh32.exe
3232	Faihkbci.exe
4256	Fhcpgmjf.exe
2376	Fkalchij.exe
2648	Fchddejl.exe
3696	Fakdpb32.exe
2924	Fhemmlhc.exe
4188	Fooeif32.exe
2012	Fbnafb32.exe
1392	Fhgjblfq.exe
1600	Foabofnn.exe
3668	Ffkjlp32.exe
3264	Glebhjlg.exe
3788	Gododflk.exe
4216	Gbbkaako.exe
3348	Gdqgmmjb.exe
4028	Ghlcnk32.exe
3704	Gofkje32.exe
1852	Gdcdbl32.exe
232	Gmjlcj32.exe
1640	Gcddpdpo.exe
4168	Gdeqhl32.exe
5040	Gbiaapdf.exe
3500	Gomakdcp.exe
4832	Hfifmnij.exe
3300	Hijooifk.exe
4332	Hcpclbfa.exe
5004	Himldi32.exe
3744	Hofdacke.exe
2200	Hfqlnm32.exe
4844	Hkmefd32.exe
1708	Hbgmcnhf.exe
4384	Iiaephpc.exe
2476	Ikpaldog.exe
4436	Ibjjhn32.exe
1376	Iehfdi32.exe
1556	Ikbnacmd.exe
4240	Iblfnn32.exe
4860	Iifokh32.exe
3620	Ippggbck.exe
4356	Ifjodl32.exe
4004	Iihkpg32.exe
2252	Icnpmp32.exe
3628	Ieolehop.exe
4540	Ilidbbgl.exe
3736	Jfoiokfb.exe
4824	Jlkagbej.exe
4976	Jfaedkdp.exe
4980	Jmknaell.exe
4488	Jcefno32.exe
4584	Jefbfgig.exe
2752	Jlpkba32.exe
1220	Jbjcolha.exe
3820	Jfeopj32.exe
3096	Jcioiood.exe
452	Jeklag32.exe
2936	Jlednamo.exe
4536	Jpppnp32.exe
3392	Kemhff32.exe
4352	Klgqcqkl.exe
4572	Kdnidn32.exe
4312	Kfmepi32.exe
2008	Klimip32.exe
3044	Kfoafi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hkmefd32.exe	Hfqlnm32.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kemhff32.exe
File opened for modification	C:\Windows\SysWOW64\Nnqbanmo.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bjmjdbam.dll	Pfolbmje.exe
File created	C:\Windows\SysWOW64\Clhkicgk.dll	Gdcdbl32.exe
File opened for modification	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File opened for modification	C:\Windows\SysWOW64\Jcioiood.exe	Jfeopj32.exe
File opened for modification	C:\Windows\SysWOW64\Lbjlfi32.exe	Kplpjn32.exe
File opened for modification	C:\Windows\SysWOW64\Lingibiq.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Njqmepik.exe	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Gododflk.exe	Glebhjlg.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kimnbd32.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Onhhamgg.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Dejacond.exe
File created	C:\Windows\SysWOW64\Gpiaib32.dll	Ghlcnk32.exe
File opened for modification	C:\Windows\SysWOW64\Himldi32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Ngbpidjh.exe	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Fkalchij.exe	Fhcpgmjf.exe
File created	C:\Windows\SysWOW64\Jfaedkdp.exe	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Nnbnoffm.dll	Jcioiood.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ambgef32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Ophfae32.dll	Fooeif32.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Kibgmdcn.exe	Kbhoqj32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Acpcoaap.dll	Ojoign32.exe
File created	C:\Windows\SysWOW64\Ojaelm32.exe	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Pmoahijl.exe	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Chmndlge.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Klimip32.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Jmknaell.exe	Jfaedkdp.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Npjebj32.exe
File created	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Qopkop32.dll	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Dkifae32.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Fooeif32.exe	Fhemmlhc.exe
File created	C:\Windows\SysWOW64\Dndgjk32.dll	Ieolehop.exe
File created	C:\Windows\SysWOW64\Kedoge32.exe	Kfankifm.exe
File created	C:\Windows\SysWOW64\Dapgdeib.dll	Npfkgjdn.exe
File opened for modification	C:\Windows\SysWOW64\Faihkbci.exe	Fkopnh32.exe
File created	C:\Windows\SysWOW64\Namdcd32.dll	Kibgmdcn.exe
File opened for modification	C:\Windows\SysWOW64\Aeiofcji.exe	Aqncedbp.exe
File opened for modification	C:\Windows\SysWOW64\Jlednamo.exe	Jeklag32.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Pcppfaka.exe	Pncgmkmj.exe
File opened for modification	C:\Windows\SysWOW64\Lbdolh32.exe	Lpebpm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6888	6500	WerFault.exe	304

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iifokh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gofkje32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Himldi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ghlcnk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gmjlcj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncdgcf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfeopj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kplpjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aadifclh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmajipb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gdeqhl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hcpclbfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kpgfooop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pcppfaka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agglboim.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hofdacke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iehfdi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ippggbck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lpebpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nnqbanmo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ogifjcdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnonbk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Faihkbci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmppcbjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npjebj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acjclpcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ilidbbgl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmidog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnicfe32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jfoiokfb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfmepi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbjlfi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lmbmibhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aglemn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Glebhjlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hijooifk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Llcpoo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fhemmlhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Iblfnn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jpppnp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odkjng32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Foabofnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njqmepik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gcddpdpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkmefd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lenamdem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfjjppmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddakjkqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ambgef32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cdhhdlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jcioiood.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kfoafi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlopkm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cffdpghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hfqlnm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mlampmdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Npfkgjdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ncianepl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojgbfocc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmgmnjcj.dll"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbhll32.dll"	Hijooifk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikbnacmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjikg32.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ainpbi32.dll"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eheqhpfp.dll"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfmccd32.dll"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccdlci32.dll"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcbifaej.dll"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dobfld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmlbfod.dll"	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophfae32.dll"	Fooeif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efjecajf.dll"	Kedoge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodfmh32.dll"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphcjp32.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coffpf32.dll"	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Melnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nckndeni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcapmm.dll"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkmjgool.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkblkg32.dll"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnaabfm.dll"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjiccacq.dll"	Melnob32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 5052	4816	bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe	82
PID 4816 wrote to memory of 5052	4816	bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe	82
PID 4816 wrote to memory of 5052	4816	bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe	82
PID 5052 wrote to memory of 3232	5052	Fkopnh32.exe	83
PID 5052 wrote to memory of 3232	5052	Fkopnh32.exe	83
PID 5052 wrote to memory of 3232	5052	Fkopnh32.exe	83
PID 3232 wrote to memory of 4256	3232	Faihkbci.exe	84
PID 3232 wrote to memory of 4256	3232	Faihkbci.exe	84
PID 3232 wrote to memory of 4256	3232	Faihkbci.exe	84
PID 4256 wrote to memory of 2376	4256	Fhcpgmjf.exe	85
PID 4256 wrote to memory of 2376	4256	Fhcpgmjf.exe	85
PID 4256 wrote to memory of 2376	4256	Fhcpgmjf.exe	85
PID 2376 wrote to memory of 2648	2376	Fkalchij.exe	86
PID 2376 wrote to memory of 2648	2376	Fkalchij.exe	86
PID 2376 wrote to memory of 2648	2376	Fkalchij.exe	86
PID 2648 wrote to memory of 3696	2648	Fchddejl.exe	87
PID 2648 wrote to memory of 3696	2648	Fchddejl.exe	87
PID 2648 wrote to memory of 3696	2648	Fchddejl.exe	87
PID 3696 wrote to memory of 2924	3696	Fakdpb32.exe	88
PID 3696 wrote to memory of 2924	3696	Fakdpb32.exe	88
PID 3696 wrote to memory of 2924	3696	Fakdpb32.exe	88
PID 2924 wrote to memory of 4188	2924	Fhemmlhc.exe	89
PID 2924 wrote to memory of 4188	2924	Fhemmlhc.exe	89
PID 2924 wrote to memory of 4188	2924	Fhemmlhc.exe	89
PID 4188 wrote to memory of 2012	4188	Fooeif32.exe	90
PID 4188 wrote to memory of 2012	4188	Fooeif32.exe	90
PID 4188 wrote to memory of 2012	4188	Fooeif32.exe	90
PID 2012 wrote to memory of 1392	2012	Fbnafb32.exe	91
PID 2012 wrote to memory of 1392	2012	Fbnafb32.exe	91
PID 2012 wrote to memory of 1392	2012	Fbnafb32.exe	91
PID 1392 wrote to memory of 1600	1392	Fhgjblfq.exe	92
PID 1392 wrote to memory of 1600	1392	Fhgjblfq.exe	92
PID 1392 wrote to memory of 1600	1392	Fhgjblfq.exe	92
PID 1600 wrote to memory of 3668	1600	Foabofnn.exe	93
PID 1600 wrote to memory of 3668	1600	Foabofnn.exe	93
PID 1600 wrote to memory of 3668	1600	Foabofnn.exe	93
PID 3668 wrote to memory of 3264	3668	Ffkjlp32.exe	94
PID 3668 wrote to memory of 3264	3668	Ffkjlp32.exe	94
PID 3668 wrote to memory of 3264	3668	Ffkjlp32.exe	94
PID 3264 wrote to memory of 3788	3264	Glebhjlg.exe	95
PID 3264 wrote to memory of 3788	3264	Glebhjlg.exe	95
PID 3264 wrote to memory of 3788	3264	Glebhjlg.exe	95
PID 3788 wrote to memory of 4216	3788	Gododflk.exe	96
PID 3788 wrote to memory of 4216	3788	Gododflk.exe	96
PID 3788 wrote to memory of 4216	3788	Gododflk.exe	96
PID 4216 wrote to memory of 3348	4216	Gbbkaako.exe	97
PID 4216 wrote to memory of 3348	4216	Gbbkaako.exe	97
PID 4216 wrote to memory of 3348	4216	Gbbkaako.exe	97
PID 3348 wrote to memory of 4028	3348	Gdqgmmjb.exe	98
PID 3348 wrote to memory of 4028	3348	Gdqgmmjb.exe	98
PID 3348 wrote to memory of 4028	3348	Gdqgmmjb.exe	98
PID 4028 wrote to memory of 3704	4028	Ghlcnk32.exe	99
PID 4028 wrote to memory of 3704	4028	Ghlcnk32.exe	99
PID 4028 wrote to memory of 3704	4028	Ghlcnk32.exe	99
PID 3704 wrote to memory of 1852	3704	Gofkje32.exe	100
PID 3704 wrote to memory of 1852	3704	Gofkje32.exe	100
PID 3704 wrote to memory of 1852	3704	Gofkje32.exe	100
PID 1852 wrote to memory of 232	1852	Gdcdbl32.exe	101
PID 1852 wrote to memory of 232	1852	Gdcdbl32.exe	101
PID 1852 wrote to memory of 232	1852	Gdcdbl32.exe	101
PID 232 wrote to memory of 1640	232	Gmjlcj32.exe	102
PID 232 wrote to memory of 1640	232	Gmjlcj32.exe	102
PID 232 wrote to memory of 1640	232	Gmjlcj32.exe	102
PID 1640 wrote to memory of 4168	1640	Gcddpdpo.exe	103

C:\Users\Admin\AppData\Local\Temp\bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe
"C:\Users\Admin\AppData\Local\Temp\bb5d32908d1ea4742392f18c11e6170614235a1c416540a0342a001883a0647c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\Fkopnh32.exe
  C:\Windows\system32\Fkopnh32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\Faihkbci.exe
    C:\Windows\system32\Faihkbci.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\Fhcpgmjf.exe
      C:\Windows\system32\Fhcpgmjf.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
      - C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1600
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        25⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        29⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        30⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        33⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1556
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        40⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3620
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        42⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        43⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2252
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3628
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4540
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        47⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        50⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2752
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        58⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4312
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        64⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        65⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        66⤵
        Drops file in System32 directory
        
        PID:4284
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        68⤵
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        69⤵
        Modifies registry class
        
        PID:912
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        70⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        71⤵
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        72⤵
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        73⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4708
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        76⤵
        System Location Discovery: System Language Discovery
        
        PID:4644
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1016
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:872
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        79⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:2232
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        81⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        82⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        83⤵
        Drops file in System32 directory
        
        PID:3184
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        84⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2952
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        85⤵
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4940
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4528
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        89⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1752
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        91⤵
        System Location Discovery: System Language Discovery
        
        PID:2176
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        92⤵
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:692
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        94⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        95⤵
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1656
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1836
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        99⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        100⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        101⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        102⤵
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        103⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1328
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        105⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        106⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        107⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2564
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5172
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5216
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        113⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        114⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        116⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5392
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        117⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        120⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        121⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        122⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        123⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        124⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        125⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        127⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        128⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        130⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        131⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        133⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        134⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        135⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        137⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        138⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        140⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        141⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        142⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        143⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        144⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        145⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        147⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        150⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        151⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        152⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        153⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        154⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        155⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        156⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        157⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        158⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        160⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        161⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        163⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        164⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        165⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        167⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        169⤵
        Drops file in System32 directory
        
        PID:5668
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        170⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:5712
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        172⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:5888
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6168
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        175⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        182⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        183⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        185⤵
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        186⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        187⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        188⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        189⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        190⤵
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        191⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        192⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:7000
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        196⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        198⤵
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        199⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        200⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        201⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        203⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        205⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        206⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        208⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        209⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        210⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        212⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        214⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        215⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        216⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        217⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        219⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        221⤵
        System Location Discovery: System Language Discovery
        
        PID:7096
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        223⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        224⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 408
        225⤵
        Program crash
        
        PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6500 -ip 6500
1⤵
PID:6632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
94KB

MD5
8bdbae30b5bb684478a1672a5dc617b8

SHA1
c999014bf26eb67a63ceebff7b45b1fdcd7c01ae

SHA256
7f87551f66911fb30b07001ce47e03f7d24a935872e23ea1c2fe95ab05be7cf4

SHA512
5d9a22646e4a75726fdabf5587d43e44cf1fa4a26e6c801dcda99b996481cbe565795b7c83f5207015dc2376503f6d35634bc60e6f2d941cc0484484f5901816

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
94KB

MD5
e18fd33199bf9eda03b12a5112f1e7f6

SHA1
e1c68a81e43ce5e6f617076eeab397eaef08a9da

SHA256
910c8179a9f9bde474b18f7a181de46ac973296764b46cc887a4307b93beea52

SHA512
e23fd73d34e0a0509b107dd0293b0cb71c18ef9b275dcc33879320b83453752974ac96277a62d30b3c20e9bd1be3f70d6fde80bc2885798f2c594331fa16d877

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
94KB

MD5
e6654e30f88bcb98dfb7cb11cb212b93

SHA1
7d798e3e6d138892a742400de9c62d24d369e9c8

SHA256
20e77a63a6824ebc965a3290327e51583615f7d4392e7324369f312f964d1d2c

SHA512
077d10ccd3dac8141ebfe3f166b6d9a44006158e0c1cb6175565dde6948f99a928bae776e898703fda558e30f08b0033d55edb02f7b67d6ea602614ef47e537a

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
94KB

MD5
293e26f4c4138630d21af1267e44535c

SHA1
bdb0f6cbf6a001d2ede3a1f700dc3ecc393c9251

SHA256
b1b613e162d1ac0b18fa0bd5db08a4ddeed76f318a943c60b6067024ccad7da5

SHA512
e248afe212a634510036d01e2f7253f58a24d5a2a90eb5284d9e4315e4bac7d5c3c9f6cb398ed7bf4f9e12975e92767cbf3f3b8beae9a35e0f728e308b21b7ba

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
94KB

MD5
068835a67a93a199e81809ea35e40240

SHA1
e31a8a0bc97aa09471439c412020ca96615dd06e

SHA256
4fb8b2347f48ed7b749d2e5617f3c787d80f3f0edb1b36e1e289ed5892be646c

SHA512
4d57360305f67d3d3e005442da4b39cac2f4db72bfa3ed9b1aac4ce1e0fe77d5fd6971ef2adbd64c28311617f7b3cb1eff7a19209e502c6d9c79b70709f1a2f7

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
64KB

MD5
7e9da50d2e2401b280e4fb4ce24cfe91

SHA1
58ce735dd230e6896fa7c1aa299a613be0fe720a

SHA256
30b3c379b1b812484b794c7f67b7f64cc56ffff39b27464bb1bd00ae973b5e34

SHA512
9b41f010aa44370a2af2d043452cf51b1066f8c134a012a0f370be23f60b6a94b93a3d30c13102ee211e93ed889bcf4efcb25afbb5ee241f2c8013c593b35601

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
64KB

MD5
812d9a8ad6748c63766b676b5b7203c7

SHA1
c13fb0605a417fed5f3e851900c85c7cb4563b37

SHA256
51c5419771c3bc3c8ee5108ba47fd9235688be36e44358a4d4951ad53349a534

SHA512
500e887ae7a35c44c95f1c84bbb8520cd4fe310b36e717035737839a2701f96a16400d4831cf66d20467a05716e014aeef1f368103f963fbe01d9941376c80cd

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
94KB

MD5
356e718a5000f5958768fa729eea65db

SHA1
095929d50843ae928dd9e1c0473f79978a9593cb

SHA256
23059f9c6cca7d95e20cca535de4f43e04051d0500ab502dbdc44bd6f44d3d4e

SHA512
fbaa9eb645b02fa2f8ae46041d659f26584bd3363f8b03e80eb2a4eb79a7041da633de29bdfa7f6f40f4885e52717f57c731a858e8a448bf4048ade69d3adebb

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
94KB

MD5
eb59d82cab9030307cf0c76656a31f5b

SHA1
1632dc7ee0d10e3c9d4c3f4bbddcbe17dba46ee3

SHA256
fc66e9176921e8be61bdf877f7b8c3524323f834b7f00ee0db4e0bf1cd86058b

SHA512
63aaa179ce45de1ae5419cb19cc5d2581c86325e875355f8c83e2057075666c4a9ccf87c3d21d293d9bf4fb5fc1718a693599fe942a4645c9a360541d4737096

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
94KB

MD5
273d9c8b87b2f37b4075654f6dc6347a

SHA1
fdc9d0b220abe611ded0a2bab0f3a45ff8930769

SHA256
e0c2743085b22799d331c9c54c581e957886a0c01f95f59665cfbfd005c8126c

SHA512
9d26131ff1eba05454e5c55705d378f55f53e388eb276b78fcd7e88b5c233b09a8a1aec3f90702401f16e242fa65ef617f9b8e0fd4f09972b68f7ab51e9c3df5

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
94KB

MD5
3d51daf0a2068008aea150a913065cfd

SHA1
8a718905e0b14e8c6594366c06398e1b31694b1c

SHA256
eb6dd4dfebd6274d66077089cd5681170daa0bb8ecd50eade7c2b5ecedae5cf9

SHA512
5596e2970bb8cd2c1117c43b2acf79bb8852b702b8b12338cbdd6db02e9777b79676be2d3560adf3dc68486e0ad7212ff4fe470212e664431787b24e2d6a3e45

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
94KB

MD5
89ec63b0c1a7998297eabe6371ed44ae

SHA1
4be48382dfbab2bf382e3806758b76a098db2ad8

SHA256
18ac45c0e4a214a0a3f3dbb018c1c4355388c777cb5fdfd265a6b3cfec46fced

SHA512
f138ff34167db97c6d1fd0edf58125de374ecf532a19d394964fa89ed9051c11f8d26cd13030a33c3a29ff847ea12938281b623d9b9618beb0d85de0b20de765

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
94KB

MD5
6756835ba2b115bc0fc29825f8aa5bad

SHA1
d902042e62f04f23a2214abfe75200a4f049c473

SHA256
28b498d5f56f710db4717fd5b4aadf28f0cf697e83c8ebd112c91ceedb62ef95

SHA512
d0f0a10e95b468b587093add3a7c329c71f5fd5a4293c1276d4c886c6ac92a0244dedd83733871ce401a229fc3d2fcd54bd3bcf303d93f4dd00dad51cde0faa6

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
94KB

MD5
18e2038d8452d8f4587a730d71dd2413

SHA1
ddc36b6d88a296dc2519e99ea73b184c1eb10b0c

SHA256
ba2541309053cb5ce1b537cd5f50ae0e4127ec386795f437d8ccf9f4a7703cb4

SHA512
7b9c0833f9813faa017dbcaa552e5388946b9d876dbac7d131bd7ae28079a4426d8cd2835417c777c599f51d0ea4a6eae526b80f88a926bdb27db3319f883209

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
94KB

MD5
77c80f095178b4b062705dc0e7b07826

SHA1
403560f443f5fabb793ae1561b3ff6f9df8060b3

SHA256
611c52a72e7da36e2e6028f3d03bc5fdfc7ee8fd9e3b5286587351f50c5b7a6d

SHA512
9feefff00d9272406098d46ccd9f9f831bd35fd28c19201e4f557f721918e5972638b0066734ecd2e08ad2b82e623c86f7b916d0b28f7d9e5cd7a399a13f1227

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
94KB

MD5
107ee756d3888bbf7c9ca2f56e15c1f7

SHA1
384b097e00693369007729d416d0709ad32c175e

SHA256
9813a71e7d0a82c49686b1bf5564a09acb420896c3838b71f6d989bcba0cfe5e

SHA512
96bdd957a48df4e17d2d237ce72614dcfeba4faa2171247d2c3368a13bf19562261c28652b3bb6f19f36656ed49147b81ccdffde1a189db67ff61db0e2a5fbc1

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
94KB

MD5
eded47635a724e77afb863ec3f27e9a1

SHA1
8f4877ed7b43b00359bb9b2df8373ca3ade445fd

SHA256
7122a005efc9c52ee46b4dae46e4e5fd21a7882b68d854a49f978974f9a93bd8

SHA512
9b62d679708f866787cd1541c0bd6870cad4cdc95e6b12fa3c918369b13b2e1698838074f65d6a564433d84b19f307fd5cde3a1fc147274e43682ec084f68f40

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
94KB

MD5
1834f37331a795f3cf8a29fd24c0a265

SHA1
a9227785e82158e2ad17821286eaf63e097c7fe8

SHA256
889a0599532afdfbe6f8a967e432a078b195e58dd3b241b531160846cd492a24

SHA512
100d3bf7d95bb62fb9b5c5eecb6009aa020934f3e0abe99e14c7c085ed414efc2734ef7c9b1a9af9e59be45a05a255ce37d19d5f359c7aa0f2dd93b39c375407

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
94KB

MD5
4da89962d549f14b8d61cba5b55e5e10

SHA1
dd106990f9290f3ce90b329e7cf3b3f5c67d58e2

SHA256
0ed305dd5f3a5dd71bae1af1331dbc9801d8318a390946be9c0b8c4d1e736a20

SHA512
22c0d600c3aa51a969e96e1ab2deea7c9902cf14a7e02f25fb043188a3ccadff9f4287421d2f61e9fd0d25df0950a110b7eb9534443a27982104b478eaeee346

Download Submit
C:\Windows\SysWOW64\Dmcibama.exe

Filesize
94KB

MD5
5f89dd7f7602975b621ff8ae37ec4eb1

SHA1
795b0be141f0c1c254ee9536443a665658523548

SHA256
241ec4e3ca001bbc4fdc4757effec22e1ca13f69811dbf8458896ffcc0ead235

SHA512
6788555e8ee6423f63d4adb8c4e1ce6b34dc8153d89630161cb67e397c03c25cabe774f916fe978d52baf891d3e4278aefd453f08eee9a91f797e0dbd33a55e0

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
94KB

MD5
91cac691be2236795c679f7fb2e3a272

SHA1
de74824ac1a353746d3ed7ee547eaa3a8db6530f

SHA256
3368c657213dfad180cf5f1ae0e68f8bdee4b4f360e7ec8eca70e6195c2ac934

SHA512
2ecd79cfd7754f96d4eeda238322f776e4108070ede2a51215990f541180d9621db90b1a5fcb6a7a44fd46c4041c8c08f73feb0bf4bd995c4f5022c46a8dc6bf

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
94KB

MD5
8ee3e8d37733981d7c46201f7da883f8

SHA1
8e22da6275dd4747dc582446ce16dd7829372f25

SHA256
8b0a8de1097b1e4134ada204b1ba82d5f6f8aa66cba46edeaf8695d43ab44148

SHA512
5d31bd808d301d9d723564c42271401da0e92341b3a6f28272d9e09920006734fbee1a60eec021897ff6def29e2e345705721e731759c128a1eee8ca399a4799

Download Submit
C:\Windows\SysWOW64\Fbnafb32.exe

Filesize
94KB

MD5
58077c338192347d0d64d05a24979e6e

SHA1
245fcaaac6ba30f74b13b244d16995ae018e49f0

SHA256
d84071568ffbc3facf05f40024b45a304501953ebf0a98a68e43d60b1e32256c

SHA512
5236019c64b857eacc877c61301118a434b91f51ab66a5a45ae99f38d5da5e2745de2a5e44a9621006ccdc11f035a3e75001b6dc2498ad5eeb52345d1bc1037f

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
94KB

MD5
9df2014a4b097ff85b434ee7edf48e07

SHA1
c81eb93bb80d5a919982848a5bdb2730100447c8

SHA256
af856647d1c58bb6c3857e61d0658e15f4326435581b7ffc39d315bc21cce750

SHA512
5ecfc27cff9b66db4a2043d10cac78f58486257accc81217c37ecc9895c9ef49ac059cee96250da6d0c4aaca03f3aab71b286028f8e1144ed4c8a1b11c11cfe0

Download Submit
C:\Windows\SysWOW64\Ffkjlp32.exe

Filesize
94KB

MD5
92b3a558f52a4186c98f2f6ba6cb9f9e

SHA1
bd43a87913ec2df87d2c6d149a4eeadb06b68415

SHA256
3bb17ed06c6322c847071ca856c54c801d88172840a8ef254eb3714b5c60bdb1

SHA512
e8a36c9d7de18fd632ef7cb28bc1f42ffcef0973e94225a5f776ee0b053b569450b5550f00838aa9c3b6330deb2ac672d5f2fb15fd59094df476f11537a361ea

Download Submit
C:\Windows\SysWOW64\Fhcpgmjf.exe

Filesize
94KB

MD5
d09c08a33a03440c3111e1e88c4dcf56

SHA1
7c22a55b9be4fa1fb1f2573133f8ff5e3233c97e

SHA256
ac0db2087f010448ff3da121b9f799f6872626d0efbbeef8bdd8016e90deb181

SHA512
a0ff63b564ca9594c768826e3f7b63ffa40c146cf0d7f042e687033f7c70f63e907d61fdf3bcaa792be0da086082a8d4d0a915169f4f1036c67a991a3b6ad62c

Download Submit
C:\Windows\SysWOW64\Fhemmlhc.exe

Filesize
94KB

MD5
7b9ba8264ba45762e8a05c27c35fe2b9

SHA1
a43d0e3719e435c81a047315d4fc07bb38c1ff4f

SHA256
7e2a906b3ab61544b412e59b98ccc2e293f8aed1807ac72439cffdb4cfda1a66

SHA512
d8682aa5dbf7e283df4916d96b94213b012748c5ce659340a0f6983b6814b9303f3c549512e7e4b283b61de7e6ddb18fdff58f25a3d780a2bfa8860c8804310b

Download Submit
C:\Windows\SysWOW64\Fhgjblfq.exe

Filesize
94KB

MD5
e92146426e24083634e0c242ad3bdeca

SHA1
3ec777fffc5e6e412fd9c649cc832884f5db4248

SHA256
f0641b4ebba16e2bdb4dfdcddf3035f3643d5e04a2ff00ffb822113b87f38510

SHA512
7c381a2480a7ab1a2ca59999906bf83fae03d38db2b17c057faf9f89494fb68b45b79f37766fa6b780ed52544b614b0cb4becf718b439d3fc36f6b450cc476b5

Download Submit
C:\Windows\SysWOW64\Fkalchij.exe

Filesize
94KB

MD5
46c58af3cbf1e414ab2a29114f61ed9c

SHA1
843620171c180786fc6ce4887bc2d5fa0f7ccee8

SHA256
a617851e3384ef0216f90ce4b410eda45d3e2e18a20e3b7693bbf950754d7f94

SHA512
266014a65117c41de8930058e4e0f3f3a508b4d1e01658a6bd9fa24736ede3c85eeefa9130d210672476f2c2bd91a713b05ae69912612072d590feb532a7c6f0

Download Submit
C:\Windows\SysWOW64\Fkopnh32.exe

Filesize
94KB

MD5
d01a8dcf57591235be0bc817f7dd4e04

SHA1
2d448668870125acdeaa48993998ae9581b6deca

SHA256
0eb5b79646c3b09179858f7294d32b88f4aa1d6c0ea2046a618855e66dcc98a5

SHA512
8f1e3dbe021812c66a0a646ee16e40ebcb8923204875d9ba966c0d5a3e601cac4fd1e1439e3497ca3c55fdfdda0d2a3f21afbde76daf06254a447a4c2372466a

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
94KB

MD5
fc9242bc98b696a98983abb02f1e929c

SHA1
200aa67096ae67ba247653a9b5e88302367b86da

SHA256
e9cfa94e3925d337b966d71a4b728376f407bb18dc090b0a4006f9515e6dab43

SHA512
480c0ab304faeb79a2a528d6ce1e832e2d59437f2d82272dda58693f5abd9850b753480de8a1cddf2353e0f71902c73bc6d1749a53e2f7df5b2a163d31273bbb

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
94KB

MD5
40f1cd85685e68aad2ac8f2624b12503

SHA1
12602e483bb5e03b5785a37e5e0f25d7f4ebd9cd

SHA256
e4f1846ebbc629863264c97f81e77296d99d5510c46c37700ef769d2d93768ff

SHA512
e85e2023b54e811cecdd0a1596f36c79071e24870368511b1e968c1380be8f3827ddb853c190b9c6b975152e95ae4799afa874682047dbd5c3e9254a5d17faf2

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
94KB

MD5
07139e80dbbed9016fa6a89ca792f537

SHA1
999d94698ec80a7f9eaee96f6d70071a3b1ae751

SHA256
935377c4d4b09a5d301a770fb1b4519adfbe35884d4684350d7b31b63343bb6e

SHA512
b6f30e4bd2e9a5dea0d830c7fb3afa2d8b0ff5a292f8e74a37c5bb954d9ee749ea353e7cc3126a7d176dd4ebdb5dd0c27d0bd4a2db6d9b37cac1b7bfee8e1ad6

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
94KB

MD5
668896128b77ca7c7f8b842bf8aa7863

SHA1
d5a1be5c70ad0ec924cc8344a5cc9cc72e655939

SHA256
b17d62e80988bc0795d23056a58c45c5f5057825957a120eb70da6a4a6cd8e7e

SHA512
33ee19cf76dc4dd218a72c3c79d140c627a65f6637dfbcb47465dc84b310c898c1195ce9d2d9ec3d7be1f727d71465324a059d301ce7bbc2845e3c8b7cb16c51

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
94KB

MD5
87ba9cf0298f106c696a4424626eb546

SHA1
c226b52b97cb8c0f2bc8af4f8b6cc043c4bcdec9

SHA256
43fa04b6a36903f82fa9eb48bc4d8a348efa4d63fb7ae775613f1e92d9c7e302

SHA512
a12d26fe063cecf91778a087d1b4797d9cf1706185f683426570fcd2ebb1d5025b8cba72b022a087201fc4e65ee243957e015bda6ff2f5ee41c8a71f02f1dcc0

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
94KB

MD5
f224394d4b048bda4ca24325aa2bdf6b

SHA1
8f76dace520aa4765173a65d412a587788d08778

SHA256
5e3f55d7906c77784627226f027c37202e0cb4de8c9ed9331d35c9ddd08170e9

SHA512
ec5164257b72d678dafd2aa41927327583e6929342548e3deec89375e23d0d7617b58626bb4fce9a36520f36e649eb54132e389cbff7b7e0eb57ae111dbdd032

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
94KB

MD5
e5c693d0635f42bc85416c4653f5e7cd

SHA1
27dc7c6e4e65dd1d7b95d1d191c7870b1c0a64f7

SHA256
ba7e9847d4876d521460941eca390544c9ff231398453b265af7e68896eb4391

SHA512
e821e98454c4be0fd6c1f9bf6d03003dd93f2a18f5706ea0de928a5c4ee1fcb125349a71c4c08588b5a830bf9f299aca40c626d78f4a03635edce8320a0e7927

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
94KB

MD5
94127985cf189f45fcfc76d7a8f307c4

SHA1
8633eb16f2ddac0a12e3bb3eee2e53dcf3790a34

SHA256
cdedbf6cf8c6edece7bdcbbe4130f5833ab0b63be33ef20dcd4114bc5fcd9fa1

SHA512
e7fb70c91cd7ccec932bcee9a6ddc45ea170c0f8d9e331566f3eaef8acd487707b91dd95f64febb3af5ce17d3fc31134b16bcbbe4a813cd24b6e415784719919

Download Submit
C:\Windows\SysWOW64\Ghlcnk32.exe

Filesize
94KB

MD5
a6f22fe032213014dd158de903bb39dd

SHA1
dfe37b1d69456be70d89b7daf2bd8272c10a21af

SHA256
e58a752271821c220bb1d2d9bd379ec5f20f493d7ed617031ad532759b249dc8

SHA512
48883017e57c0fa8b55fd25efa0ce3a9639863ca500fbd47ca9b319af29531b908c38e4a8a42ff0478a873b59abbd80c6886ea531bfb7e6079bdc61066c2bd0e

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
94KB

MD5
7471b0bdde5b1c4b9067da80ebc8b733

SHA1
76ac0be7f1ac9902a5c14f088a9d3455e9e9acae

SHA256
b7b63a96450bdb361afe492f3f5ef1cd6722e72b0e231d6db5282edc94783336

SHA512
ec5217a8d4a248d79b59b7bc6c920dd4b5c4460b3e1f1bceb8b6dc25a4a284be054b7f79066b66efca7f5894f3acb060d67b676d5286fc548c506ca91267e874

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
94KB

MD5
963c1a56f21b13f963c6bede52c43cbb

SHA1
186f24213b143ac9d1153f892833ef9929a0cc64

SHA256
96dfc4039ac663ef69e6cc145e42ab6f7223381e4272a35eadaba2ae4f70deed

SHA512
3c5f019ce42ca5f86e1b07b320b0fa6976676ec824919e152a00f9baf6147ce554f06ffd0e6120dbd16e8e3e96ae33a8f20325d963145870333ffd29f9315af8

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
94KB

MD5
36e5a78559a0150446da61ea72707480

SHA1
546b02b013063f84d772d411cd80cb52320e813a

SHA256
ac7d9f3423f46a26d316ce6cb44535c8eb5dd7927a85a80a6d9ffe0bab8b7e3f

SHA512
dc97887173f50f674799f8aa656f3f476d7df7c854feafed3ffe0e6e1e9052a6efdb66b0ae6c02557a81f22f5bfbb922d1ceb8b4ff5e228d1d5b2b7cf48fb0b1

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
94KB

MD5
a1ea4cddf8b4b0dba88b84aedac69935

SHA1
3015c99d5d1bb39176d790edca44319ad3603344

SHA256
9cbe74177447c945f056ac3a61fc89af8c73849a3f34741b8aad9942a752a2ea

SHA512
ee6ed4504fdf7a439ddf4555bdb70c73660e363bd42c0316c81d934543a95d7a5afd17048500ba2eea593286d9c0f87b5c6c9e4cafab0f53ec2f1fda41f42629

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
94KB

MD5
e7bf0769e5eea5ea769531cd15a0a572

SHA1
e4b8733465cbdc3fdc31053a258b98b1f13b2dec

SHA256
6228afe6686d7dbc83544306c004a9e726cf5caa4343daff423bea8f5323f94e

SHA512
ab8722703f41752905519757616e6986970909187e201700237ea8da004a715feba963a3c9e5cf96171897106c38a71288fae9f9f76068ffd37de264a1ec9310

Download Submit
C:\Windows\SysWOW64\Hbgmcnhf.exe

Filesize
94KB

MD5
fdbdaa2d08a8927d75d1b23d1f3063d7

SHA1
db6ce65d4f8060fde20bff741ba919b30f71b1ca

SHA256
4690da3b6995247ab4e8b1ca098646ea6e3e3aa84c847ddd4c3781113883214c

SHA512
e5814d55bde64e47bcf739ad88ad4d7ed9acadf182bc14e5a7f03ffa8eb3ecfdfcf611bdbfa69bbee25c92f45b474a2ff90274cff5c52974520cdfb3f1f916b9

Download Submit
C:\Windows\SysWOW64\Hcpclbfa.exe

Filesize
94KB

MD5
330218e6e7a7616f84fa6b09c240c58c

SHA1
a327e685f5bab9399e149af074d88b183a85f003

SHA256
6d414986a985f5b844f62024d73d52e472c141ad8c9c3434633f8a3f9b1cf536

SHA512
e5a2ae41e9d8504ae3b55532d8d69fe88691b50f81b013d1d2a25c9e4296875213b0f651403a2f8ecb874c24c94bf7f7d26f04b55a0a2f06a83059fc369d28d1

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
94KB

MD5
93f1cc1015ed167dc8455d175f1f84ed

SHA1
c23c867d640a7396a427867e0bffec1962703418

SHA256
1ba390473358623e05899e06ed1d6bb041d624098594f51c757fc96f8385ebae

SHA512
f50de67aa1bbb3b09c4c44265971b87f912ad5d1436738f2660803d39846d45c86fe54141763a9a86172e47d884a02487c81391f94bb3812d2b13338318e6674

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
94KB

MD5
0c80ae56422c7d1694cb942fdf2fdd69

SHA1
958ce6313989e2b752cd4e74839f653336c23ec0

SHA256
ea94fe30b0c4b89938d7ad60c89a16125170a83830adfe2e7891b272b1260d1c

SHA512
f8809e122ed10ac35d564c80e667458293fc61fc0aa4476533647901912b7aa63fa7462ec9f93c4a1039ddf2287012aa2150942743d49c6b9a8fa8fb72befc61

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
94KB

MD5
759974ac7a79986aebf48bd835f8055c

SHA1
31d1130c44d75bccc0ea8048e2c76ea9840b7456

SHA256
a0f35a37098c147077adb37b4902c7cc17acb30540489b520ba4176be43afae0

SHA512
0eb3a2fd14eaff9a74c9d4db0de04452b4feb17db59e0a297669ce07dd8705f2489bf8ed7863118f0fc3a26c8ce906a8e59b6d00b61f2eaa7d0dce43efb66582

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
94KB

MD5
9464955dd5f3eda59d1dc094baa25732

SHA1
421ebdf7ce635e62d2ac6058e883a4c24cec4aff

SHA256
fc78165ae5b476965d3827a2d65d532ee26b833b4897af08f78a93e75a010ad3

SHA512
51e6ec362ac6481a52b78f9f56e95a25b427973195e86924decdfed590f87e7bdb8648f9ffaf20b9a1f2111ade138b344b15e6b4225dc6b24a0827b648cfbb91

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
94KB

MD5
47b6fc3f792209bf2d2e6b7abe64c151

SHA1
4748addf950b19f82a14a717f929fbc34fd9e874

SHA256
095497fd81d798fda3f9d4ce8a5e0e52ac58b898e5647598382805271526b502

SHA512
dbe822d75523ecccec54a5a6f21c89694079f7cd9e461277921f12f0d499da3a21c45c1da3fb35b15f24949b95e72d2af33ebb3229bf83f025d2a00c25a48d1d

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
94KB

MD5
8716474612e773f69311abb7e00e1947

SHA1
2e8cffe780161c7028028992c7bf643e66eaabe4

SHA256
d608fe3b4ceb5c9e5fdb18fbc8fea8dc10b3b307c7fa801f696f869fa108a28a

SHA512
f242cf0cdf554b6574285b41bf9bd32189cbe60719a2ae09a296591891e8a4f58ecba19a30ae5367d47d4ef098359dce2700ba6e7a95f97d0dddad5357c43692

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
94KB

MD5
f2a59f0ed4a518cdbcb70756ebb56361

SHA1
c45cf13fce4cef94759353f5f8ea29fe05c4cb6d

SHA256
bac6f06c4454f4e5f45fcab97393a5c95a6eb5338650c1e31509904e70d02192

SHA512
6efc7721547a16c16c2f29f3dd303d6331ff6a29c01484393a5af1797cdea0c1cd57ed050aa4f8cb255f583fb3c8e8dd519fd60f281559175dd093bed7786d41

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
94KB

MD5
1a53171307562fb02fc80047d139c5ac

SHA1
abec16d485b372a400c50369b9ad5c2655d30fd8

SHA256
a8bcaea3deaec916c1651a236c9b32c3da4f127c8889df20ba1cb3f3633fceac

SHA512
3043f3fa95171f87a56ed83e7122e99cdb0e86e1d55da0101cc2e300735937d59bd9c1bedaf0808015027329dc7e40c12043daca3c18da5eb6d7a66505c72cb5

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
94KB

MD5
869d16533bff60544f149b884a394fff

SHA1
65e48f6a8000e4ed951e84f699bd9305d707275a

SHA256
d8907ab4cdbdb066700816a59024044895e796a80023049c501465e22d7a5e32

SHA512
d336ba99bea152664f6d8e5ff768378a8672a59ff2c76df6fac0e2fa2b9ed414ef871bedef764c2a5ba9907a7ca586425270beaafaf2848fb541576339f8eb73

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
94KB

MD5
28df2e8c8d5967006fe98c65868fc6dc

SHA1
98e383ba013f8846768b923a496a0173b4a3a62f

SHA256
5afb30fcbfa41d0807ae017344ea469b1703d6fbf1e4c6d06c2223fe487746b3

SHA512
585e855c8b653f15fa7bd3c4b01e2a0bd4f0ef2c09ee1742410a4c1e8169ce621f89e41aa489934d1cb968c30e3ab485d0ccf304c398c6079345cf73bd99360b

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
94KB

MD5
dd61d541c8d35cc1bc637034ef08bdc4

SHA1
ea2a742b86bf0f1c6382de53f5583da7680edb19

SHA256
7e65242a586335964497259899b14899cee092bd85e416f252992c81db15c7cf

SHA512
a21c48a4cc393faa39210c4afbfbe3c978b66d618436a9f5458ea19fa781cab42316a3fea2d5c49beb9c674f788ee8dded803f592eb4687e15ec06d308668718

Download Submit
C:\Windows\SysWOW64\Jlkagbej.exe

Filesize
94KB

MD5
3b5cb73d3e79fdb9b09d3957a2de4467

SHA1
66c5fee0b6ff51d57957578f7e65890c3a43f6c0

SHA256
491098cc84bae275eb01960c5260900bbecf6e92e174f498b7381700f0f44f7b

SHA512
df1d285b89b3a6a85c77e8215d6be698e698354a48b95fb172b18262d034826837a1e3bb6287989a4d7f4a0825731ad167765b21a63b374d5bf40bb4b86e602c

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
94KB

MD5
dd725419a19293a238b0584cc8af29f4

SHA1
b404ab5f282758252b2df4610b97b89c2ca7e750

SHA256
cea7adfe6dcbb26257ceb440845296407c8304bff73fd431ac3a4f831181c811

SHA512
2764e6a33633b1b306bba4051163ff7e7202d933984f59f99cd28e060f09852990f5527c87e15a04c5db56c43fc43776622182fbf4a321d68a528e2ef526b4d6

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
94KB

MD5
88b0ac177d075677ca5f2bda75ec3a18

SHA1
27a33ce3584f118b86f9a85a899f8be02a2238d4

SHA256
446ece627f4e16436b1c2c33b33d1d2e6958669f0fc6babe4bf886abd6b1542a

SHA512
037a573c4c11a147322bfcfd5e5ffab03bff477250c1e8a9d1e898fdeabcf3756f58e3ae62b43eadcc468ff7cff42eec218c586bc1962973977fc51c99355d24

Download Submit
C:\Windows\SysWOW64\Kfankifm.exe

Filesize
94KB

MD5
f997c26885d16a4e55facc2718527599

SHA1
c3d287ec8a57234cedc403b58b1666eb2bd71b93

SHA256
ed119b53cab1e62d2c36b011d49da39a2c11e4e3312f9ea004bd350946a3978d

SHA512
e02a6892ca3a7c4385ea45c0518c9535ebaf2bb905986cc86715e0496cd1012dd4d3d8b0f39e266d6eb560aea73ae82ecdc5823e96f001f71bfe249ba3f6ef63

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
94KB

MD5
f1baeced9f6831e0a6d0fb7d9afb3768

SHA1
f2a1fb61cc77d0f7950a16a0812221dc55157275

SHA256
9e0f2c0cde6873c3ab6121e6f9684593475706ee82b01cb946e92f53f8dc0775

SHA512
f46ee8da24a29908f5196d63ad2ab0d8867fbf0e5b182efde8977ca1f933231c4964564a5dc2ef7d89552ecb487e57d0ace8f74c13f66494469b29691ccc61e6

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
94KB

MD5
d5fd517a68721a86ec16f993e3b5a049

SHA1
6e321b7ab0e02c1bdaf3092499fce25e1e29966d

SHA256
bf762c8cfac94ad061cb2dcf981c96a7b1c7055a95f0f70e48c57324c1602bb1

SHA512
a32ff0fe8560f9d526c3aa7d2d31165d7149a27e2082e521c53fdacb31dbb6b394f3d7c5fd1a070dd071efef4b93bb7fe30ce9fea973f9049880265f580b2780

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
94KB

MD5
0f256a1eb9db896bedd1adb2eaded0b4

SHA1
2eeb206911e1bdae37782fb36474dcec7fb92c24

SHA256
5f61df88e95778ffa48ff678a9476fe8397209c38f2360cda149f4179cb8965b

SHA512
b228acfdd2fd010306cd3073fddba8854583ad32b0f9c19adb9300f4f5a2dcd8669fb3fe7a7f4957aa602ad7912e73d620cc7746665d0c00798747779d0b126a

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
94KB

MD5
a15132acbcc88afff8d3b6788d7e8849

SHA1
4ad5c228b4348980108e43d8195b86b083aa1806

SHA256
86296f9505fcf86b26594a08f43191da775cc18c98ff136fd5886bd7a9e21b29

SHA512
34b65c5272ab1c7b4aa73a13b5e82268122c6ae346a1e8f03e43c121747fe8c41e79dbfcaf257d9427f8e6837caa5c3e3e42e9e908b9752903eae696c4372c68

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
94KB

MD5
d5918757a1f7145536192d71fdac8138

SHA1
01c33dbb0305c0f73ea307ab7150b3776f21f2e8

SHA256
ee98f818aa2d3fa1fbd726d56a49bb928ad3a27b3819becef7077ea3210c4bd1

SHA512
8a7c6155b9434be33e97dc0a01c2d5a7f2e65d48febafc63960aefd3693d8485d7d6a5436d6500168a102b5ee53de4a3378afc4f49158ee90630915f5a69a12f

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
94KB

MD5
4a974b896864417093019d69d5d16794

SHA1
977d995c5c1d1580a12a02e4007c408c1eb68e89

SHA256
a8cf86eed771a87fb53c4c1d66cee6034fd19ccbe010745bdfed13d1eb1001af

SHA512
c44fe4ee4313256ce913061f4443a3c1f0b88984a3aca65dc08ac5d3e90865240c6ce5c294fdce974f15b38ef4e320a2a986700bb687a940d71cf9fc650acf6e

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
94KB

MD5
fdd9ca43dd3297080b6efd545e9f9b71

SHA1
0d98573e2125e36573a764aefa250cd751c58fb1

SHA256
335143925ec3c0df5c033734db5c7b125bae4c02c8c8979a29f0674834f108d6

SHA512
944ee837dae9f844fc0dc53520512d53550ffb653b863a70e1d9d4b6467edd6b75a8f63950faecce9357bd50a212509b5310be1fd4c06a7ab9c878d147521227

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
94KB

MD5
88e48750499b64b8a34220cec8310826

SHA1
55787252d1437c342e1169136da5dc3bd3786a72

SHA256
2a17934cf032457fa074126afe7f788071e9a0364dc22d8a7c8ecd7c503ccdd2

SHA512
3434a1cd8fa4af6296a94dba658cd9448cdd80cefc3f64275a2a8e536d1bce00053e473a238243325c09ccf6c6b9e2a474748ad721942181b78af1df05242405

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
94KB

MD5
b6afa7d60a3dc69d70dc54b04e0067d1

SHA1
9639e5e185150a65852a9d2019bf9993125876a4

SHA256
f0ef8b29a4d23bd16cceb6c67c8cdc76de07a1b2e28c84133ed2fa4fa9b24433

SHA512
946dbff6410c426eb1dc313992c5dee52169097d11ce547a8e112c18aaeb8abac3b4e89a25894726f59888e8137e057c366b56c1582240f17cd12e015bdbfb20

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
94KB

MD5
2c23f3a785e64daf36702df37cf18388

SHA1
d101d710002f86e88b56fae3f84e97630396d4d3

SHA256
340864a5583df90d7e976b140b78e808ed54f6c4bfb9bd4cea460c1130ab1a77

SHA512
f96fb93b75ca9669ae7dd9765a4d99a58f206ddc492148e64ac19f0d353d871e48cd98f70b4f7218cf0d367e8a7a7ede46a615477a84e8fb6241df14e9b31fe8

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
94KB

MD5
f103117fcc738c7bc34fc1013ab61685

SHA1
9fffc3b676cfdebccfec5c9aa965d6562acc40fa

SHA256
8631afff14ff0657333e39db4903da3a7ef5c42fd93efc83eabe1b43ad7b627d

SHA512
8d1d7e6c78118fcf19a2de7d368a4a888998892b2bc067cf2e841aa3fad3534dd9423fa29e955ed238d8a9803ff2a6a503ed7f17afcde7f660219acb34cfbba7

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
94KB

MD5
07d72061c1312e83630f64fd3234061e

SHA1
fc63a78aad4070d7ee673f57da78a80d64fee1b6

SHA256
4208258c9388d20955cec4c2ba0b85b46f1ca8b15555be18f2c5ca05616706ea

SHA512
3c4eb0bcb75b119bb32014d4ef4dfd3d48b009ca7943fc821914713a0a59467f79dbb26da2dc5c57e1ac4b21f909abd300cf5751ebfaeb7487a26d2bc6dceb66

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
94KB

MD5
c360e02b9836aea8d210cc8f78f37f00

SHA1
6da7086175c3ee4e906914e66cb8c720aa5b01a9

SHA256
aa6d47e223579af2026a33b0c81ecba03e5d84aea632aecaec9e2b5404793276

SHA512
43cbac2ecd448ccf26b267e649acf84c503e0861e5039995a01c0938b8db295c82bf26beeb5f3c4af5bb50b29099c54a022f9c0912ecea34064ed83c3aa27e1a

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
94KB

MD5
60d3584dff99eb9e0196de2ca3ed7cce

SHA1
20472c99900844ceffbdb9b798419494fcf1de55

SHA256
e76ac311bab8170d45868f828cb3dc08cc17b8889385cbd0373cdac7063969bd

SHA512
409644a7fc1e3b983385303f7fc5c6e5f0e155a2ec6044f1fc1b40a88ce59919a708d03d47f2edaedef224d74721fd79e20ef0d58ea244540d574b8bf320c369

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
64KB

MD5
f83ab30b5e0188d18ad223478dd3f78b

SHA1
67496fe679f294957f91df32f061b330244579c1

SHA256
3ec2f0f3356146e36ebd6144795888de71fe4ff7b91b258b354492296eb6e6fa

SHA512
28f2bbad880acb88f7ada6fd7264872e0a76b82b13eee49664c494338978c770c3e04127d7492d0f15f45b46dfd3afd6ffb688e14ab884ef90264930cf548386

Download Submit
C:\Windows\SysWOW64\Ofqpqo32.exe

Filesize
94KB

MD5
9b21e91b2a5c8ae3d1559f9b8bbbde78

SHA1
c9f9bec199fa556a637ca20495231a7519d15682

SHA256
8eeb5b58a3f83264fda6459388974f178e9c59e1f71043f87c0952552cd9b032

SHA512
30c56769c9238f46bebafbdd4c1b9b22579461fc1a5ea5f1a8cdcccfc757504425d43e21204c732cdfcc033dc3f60e63e308f09ba7f0f459fbd7fe49f4d84b8e

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
94KB

MD5
b93ce74bb97852d0b0ccdeb63ed7dfae

SHA1
ee3b65270fe18f4098f7570530648f881470e753

SHA256
d456f708f06068d66f523cec8ccd1852d178bd6c43d69672bf26642f1442191b

SHA512
124328380df87ed67d09e93125f3d59d004eb61d526540bbc462399b3ed3b3e4f4cf79e032f970805d83d4f21bc5e1b4b618612df6d5a6d40033394de012b188

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
94KB

MD5
8f97214325c93180e0b33ab7ac1bf273

SHA1
a8ed23ac827861fc363f9901651a4b4bf6dd2864

SHA256
0b669fd0c89f4ed26a66ce078df733196deb33993f284dd5432bf8ed9f2da8bb

SHA512
9c38ce71b79fc702412b0545664accf508d56c2f2598ca18da0f7eacfc655f1b711991c887d31767c408d56c42668ed9df5a18ea04b44ebf9d35a6ad9809f5a0

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
94KB

MD5
674f28049eebe0b61149ada0bbe5e7d6

SHA1
2a80277a96af46eb884b17466ba21b76f404c035

SHA256
e11a0929423dca1f66ef35181c2b73c050d70ca201c660bcbede2ffffb679ef1

SHA512
1e04d1266274fb4e83c37e581991f8c121273fb35203b9e66fded661348c93e864c2891d33e47c6309ff63fe25b90adc75b7f79118b472fc44466d6b4b4c96ad

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
94KB

MD5
ec3c6a5e5504a2c702c0d33dcc20ccef

SHA1
9eccaf9768ba7da33a98af0f65f5f06dc0e414eb

SHA256
a2d8f83b346f8d7af8ea2247c0a2c64cbe8d7f14466f022fdf109b1ec441f325

SHA512
b780784349e6f51b555f9efb169f31367673c3e79d91ad7c1b274a76477f46bd7bf3be01f2ea6d5681532b4c2e3cfbec6972310f99d9850b812e2178aa08c2d8

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
94KB

MD5
24ad7cabf17d832a6ecce216f46baeb4

SHA1
d5a632fa01e45ac4fc8edee5e3a5507d2a455cac

SHA256
4eb2687775256b8d1c32304304457451bf959c8f51b33ecd98bc002f4616e374

SHA512
d5c8ab7ef1b1ef0fe201f778850bf6a5de292b68798d9a8d99a3e9e395505432a3d477d67bbbae40150bac620bf3f1c4b864f527a80d06247ba46260cfec60be

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
94KB

MD5
f675f3bc161bd4b465b13b6f0d74d0cb

SHA1
f9f0ed612f27617229f4a22a48b5ad2aa65993fa

SHA256
99f0e699aef7f9fccd7449002868f73d3101aebbf569fd7b36ab0082ede9ecfc

SHA512
6b694a87dbd121ef8d9a20a95f78f270a1e7b74fb745acec582033ce8ff3b561009b98790e5d55942c57bc01d64e617e321a7a4342fd9ce28a3c6f44f3bb6c3b

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
94KB

MD5
789181fcfd08e7b59ab2ced8417e5f01

SHA1
692cb2bb73b91fa9d6032aa93c06941c2e042342

SHA256
d0b241a65f4a6755595e603f12dd882e7bf126551d59ad2c9340acc8396f1487

SHA512
b8d344ca3b1275cec87f829c3af3b4e21cac28b0918f1b4879a98cee9d81d911c24568204f8970c6e8e334910876dc3b8f7421cb41aafca65958f26bc20166ea

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
94KB

MD5
7eeef34b2212f279d23e01e41a7f9c9d

SHA1
4cd8fb87227090cb5923edee17da2e4159615fd1

SHA256
3e1c7e0f057755ae275ff1f225d15f39ae3ada22bc27edf6a1c6d2ea85413730

SHA512
57e16189b4b52bfa07636106b7d26a3df488277ec89a90ea08e3b3c6c4eee168851bea8dd62740dace8e2a2cba51fe4f59fec57dcb478c71ae37b00cba3e5da6

Download Submit
C:\Windows\SysWOW64\Qmkadgpo.exe

Filesize
94KB

MD5
9a8ed2729f301400a8f150f48e3f7d81

SHA1
7d47f42cff9cb088e9ea99cef4c81c7482909ffe

SHA256
3638d5b99979c913ef84e85c5d7232ff35c67dccc388bcd9f168d9a7c81fc590

SHA512
00ed6702c053f5f679d103096c1eaaf5dd10568c04daa08ed6d33e3bfbd77fc3ecf953fa2d7f4216adb9642a080a66e65097f148ed7409f741e699d29bb52de6

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
94KB

MD5
d3debdd61e0de461e1b919beb9817884

SHA1
3a07ae879bd586b817eda01f51bbbbabbb5e09e6

SHA256
89c32f6d19f17f39f434f29421c520f5ff38f6b3c1edabc47574e70f2fe44b2e

SHA512
09ce3444a9de138a714a319c4c3af492c727aecf69bbf92f9811582e46f3f5c7bdce85e50a7c089f285f17fa5e1105df4dd5710d3d4508d0926fad580361de23

Download Submit
memory/232-160-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/452-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/872-527-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/912-473-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1016-521-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1136-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1220-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1376-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1392-80-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1412-513-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1556-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1596-491-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1600-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1612-594-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1636-503-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1640-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-256-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1820-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1852-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2008-443-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2200-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2232-540-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2252-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-573-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2476-269-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2648-45-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2752-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2924-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2924-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2936-411-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2952-571-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-449-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3184-564-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3232-559-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3264-104-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3300-208-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3348-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3392-419-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3412-479-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3500-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3620-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3628-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3668-96-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-48-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3696-586-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3704-149-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3744-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3788-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3820-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4012-553-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4028-141-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4044-574-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4168-176-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4188-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4216-125-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4240-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4256-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4256-566-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4312-437-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4332-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4352-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4356-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4384-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4436-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4488-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4528-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4536-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4572-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4584-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-518-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4708-501-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4816-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4816-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4824-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-200-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4844-248-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4860-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-580-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4976-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-359-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5004-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-461-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5040-184-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5052-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads